본문 바로가기
KERD
논문KCI 등재

내재적 리스크 감지 모델을 사용한 사용자 인증 편의성 향상 프레임워크

The Framework for Cost Reduction of User Authentication Using Implicit Risk Model

이윤호|김수형|조진만|서경진|김평
한국정보보호학회 (Korea Institute Of Information Security And Cryptology)|2017.10|정보보호학회논문지 (Journal of The Korea Institute of Information Security and Cryptology)|제27권 제5호|pp. 1033-1047|DOI https://doi.org/10.13089/JKIISC.2017.27.5.1033

1

조회

0

다운로드

0

인용

0

참고문헌

키워드

AuthenticationSmartphone authenticationBiometric systemImplicit authenticationTouchstroke-based dynamics
주제분류컴퓨터학

초록

사용자의 인증 프로세스에 대한 인식을 필요로 하는 기존의 명시적 인증은 그 과정에서 사용자에게 많은 부담이 되며이는 사용자가 인증을 기피하는 원인이 되고 있다. 본 연구를 통해, 우리는 바이오 인식 및 위치 기반 인증 방법과 같은내재적 인증 방법을 사용하여 사용자 인증의 편의성을 달성하는 방안을 제안한다. 이를 위해 명시적 인증으로 달성할수 있는 4단계 보증 레벨을 정의하고, 내재적 인증 방법과 명시적 인증 방법과 같이 사용하여 보다 적은 인증 비용으로동일 단계의 신뢰 보증 레벨에 도달할 수 있음을 보인다. 제안 방법의 유효성을 보이기 위해, 스크린 키보드 기반 인증, 얼굴인식 기반 인증, 위치 기반 인증을 내재적 인증 기법으로 도입하며 이를 안드로이드 응용으로 구현하였다. 실험 분석 결과, 제안 방법은 패스워드 인증 대비 21.7%, 6자리 PIN 인증 대비 14.9%의 비용 절감 효과를 달성하였다.

Abstract

Traditional explicit authentication, which requires awareness of the user's authentication process, is a burden on the user, which is one of main reasons why users tend not to employ authentication. In this paper, we try to reduce such cost by employing implicit authentication methods, such as biometrics and location based authentication methods. We define the 4-level security assurance model, where each level is mapped to an explicit authentication method. We implement our model as an Android application, where the implicit authentication methods are touch-stroke dynamics-based, face recognition based, and the location based authentication. From user experiment, we could show that the authentication cost is reduced by 14.9% compared to password authentication-only case and by 21.7% compared to the case where 6-digit PIN authentication is solely used.

참고문헌 (49)

  1. W. Shi, "Senguard : passive user identification on smartphones using multiple sensors", IEEE 7th International Conference on Wireless and Mobile Computing, pp.141~148 (2011)
  2. H. Khan, "A comparative evaluation of implicit authentication schemes", International Workshop on Recent Advances in Intrusion Detection, pp.255~275 (2014), Springer
  3. V. M. Patel, "Continuous user authentication on mobile devices : recent progress and remaining challenges", IEEE Signal Processing Magazine, 33(4), pp.49~61 (2016)
  4. Y. Xu, "Virtual u : defeating face liveness detection by building virtual models from your public photos", 25th USENIX Security Symposium, pp.497~512 (2016)
  5. Measuring strength of authentication, "Information Technology Laboratory", NIST, ~ (2015)
  6. "Strength of function for authenticators - biometrics" (2017)[URL]
  7. ISO, "Information technology — Security techniques —Evaluation criteria for IT security", ISO, 2009
  8. Shin-young Kim, "User authentication method evaluation and selection guide for electronic financial transactions", E-finance and finance security: AR - Ⅵ - 2015- ① - 15, Financial Security Institute, ~ (2015)
  9. Comparative analysis on the security of major simple payment services, "Seung-woo Han", Financial Security Institute, ~, pp.E-finance and finance security:AR - Ⅵ - 2015 - ① - 15 (2015)
  10. Measuring real-world accuracies and biases in modeling password guessability, "B. Ur", USENIX Security, 463~481 (2015)
  11. D. Gunetti, "Keystroke analysis of free text", ACM Transactions on Information and System Security (TISSEC), 8(3), pp.312~347 (2005)
  12. 김평, "자유 텍스트를 이용한 터치스크린 기반 인증 방법의 성능 향상을 위한 연구", 한국정보기술학회논문지, 15(4), pp.45~54 (2017), 한국정보기술학회[DOI]
  13. "What is the future of wi-fi and mobile?" (2012)[URL]
  14. Report on the survey of the user behavior in mobile internet, "Jae-myung Im", KISA, ~ (2013)
  15. W. Luo, "Proving Your location without giving up your privacy", Proc. ACM 11th Workshop Mobile Computing Systems and Applications, pp.7~12 (2010)
  16. S. Saroiu, "Enabling new mobile applications with location proofs", Proc. ACM 10th Workshop Mobile Computing Systems and Applications, pp.3~ (2009)
  17. A. Gupta, "Intuitive security policy configuration in mobile devices using context profiling", International Conference on Privacy, Security, Risk and Trust, International Conference on Social Computing, pp.471~480 (2012)
  18. J. R. M Filho, "On the equalization of keystroke timing histograms", Pattern Recognition Letters, 27(13), pp.1440~1446 (2006)
  19. J. Hu, "A k-nearest neighbor approach for user authentication through biometric keystroke dyanmics", Proceedings of the IEEE International Conference on Communications, pp.1556~1560 (2008)
  20. A. Messerman, "Continuous and non-intrusive identity verification in real-time environments based on free-text keystroke dynamics", Proceedings of the International Joint Conference on Biometrics, pp.1~8 (2011)
  21. T. Shimshon, "Continuous verification using keystroke dynamics", Proceedings of the International Conference on Computational Intelligence and Security, pp.411~415 (2010)
  22. Y. Kaneko, "A hamming distance-like filtering in keystroke dynamics", Proceedings of the Ninth Annual International Conference on Privacy, Security, and Trust, Montreal, pp.93~95 (2011)
  23. S. Bleha, "Computer-access security systems using keystroke dynamics", IEEE Transactions on Pattern Analysis and Machine Intelligence, 12(12), pp.1217~1222 (1990)
  24. H. Davoudi, "A new distance measure for free text keystroke authentication", Proceedings of the 14th International Computer Conference, pp.570~575 (2009)
  25. P. S. Teh, "A multiple layer fusion approach on keystroke dynamics", Pattern Analysis and Applications, 14(1), pp.23~36 (2011)
  26. Y. Zhong, "Keystroke dynamics for user authentication", Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition Workshops, pp.117~123 (2012)
  27. T. Hoang, "A lightweight gait authentication on mobile phone regardless of installation error", IFIP International Information Security Conference, pp.83~101 (2013)
  28. M. Trojahn, "Toward mobile authentication with keystroke dynamics on mobile phones and tablets", Advanced Information Networking and Applications Workshops, 27th International Conference on, pp.697~702 (2013)
  29. T. Y. Chang, "A graphical-based password keystroke dynamic authentication system for touch screen handheld mobile devices", The Journal of Systems and Software, 85(5), pp.1157~1165 (2012)
  30. N. Jeanjaitrong, "Feasibility study on authentication based keystroke dynamic over touch-screen devices", Proceeding of 13th International Symposium on Communications and Information Technologies, pp.238~242 (2013)
  31. N.K. Rantha, "Advances in biometrics:sensors, algorithms and systems", pp.447~472 (2007), Springer
  32. P. Tresadern, "Mobile biometrics : combined face and voice verification for a mobile platform", IEEE Pervasive Computing, 12(1), pp.79~87 (2013)
  33. J. Montalvao Filho, "Multimodal biometric fusionjoint typist(keystroke)and speaker verification", International Telecommunications Symposium, pp.609~614 (2006)
  34. J. Fierrez-Aguilar, "A comparative evaluation of fusion strategies for multimodal biometric verification", Audio-and Videobased Biometric Person Authentication, LNCS 2688, pp.1056~1056 (2003)
  35. H. Saevanee, "Multi-modal behavioural biometric authentication for mobile devices", IFIP International Information Security Conference, pp.465~474 (2012)
  36. Son Do, "Using Keystroke Dynamics for Implicit Authentication on Smar tphone", 멀티미디어학회논문지, 17(8), pp.968~976 (2014), 한국멀티미디어학회[DOI]
  37. "Using access control in iPhone, iPad, or iPad Touch" (2017)[URL]
  38. "Kakao pay" (2017)[URL]
  39. "KPay" (2014)[URL]
  40. "SKT launched T-authe ntication service for user verification" (2016)[URL]
  41. D. Wang, "Understanding human-chosen pins : characteristics, distribution and security", Proceedings of the 12th ACM ASIA Conference on Computer and Communications Security (2017)
  42. J. Bonneau, "A birthday present every eleven wallets? the security of customer-chosen banking pins", International Conference on Financial Cryptography and Data Security, LNCS 7394, pp.25~40 (2012)
  43. A. Mahfouz, "Android users in the wild : their authentication and usage behavior", Pervasive and Mobile Computing, 32, pp.50~61 (2016)
  44. L. O'Gorman, "Comparing passwords, tokens, and biometrics for user authentication", Proceedings of IEEE, 91(12), pp.2021~2039 (2003)
  45. M. Harbach, "It’s a hard lock life : a field study of smartphone(un)locking behavior and risk perception", Symposium on usable privacy and security, pp.213~230 (2014)
  46. R. Chatterjee, "Password typos and how to correct them securely", IEEE Symposium on Security and Privacy, pp.799~818 (2016)
  47. Research on risk analysis on the service use activity and the method for evaluating authentication level, "Hyper-connected Communication Research Laboratory", ETRI, ~ (2016)
  48. A. K. Jain, "Learning user-specific parameters in a multibiometric system", Proceedings of International Conference on Image Processing, pp.57~60 (2002)
  49. C. Lobrano, "Dynamic linear combination of two-class classifiers", Joint IAPR International Workshops on Statistical Techniques in Pattern Recognition and Structural and Syntactic Pattern Recognition, LNCS 6218, pp.473~482 (2010)

이 간행물의 다른 논문 (21건)

SEED 블록 암호 알고리즘 확산계층에서 낮은 복잡도를 갖는 부채널 분석박애선, 원유승, 한동국pp. 993-1000Ring-LWE 기반 공개키 암호시스템의 선택 암호문 단순전력분석 공격 대응법한동국, 원유승, 박애선pp. 1001-1011윈도우 최대 절전 모드 파일의 메모리 데이터 암호화 기법 연구이경호, 노봉남, 이우호pp. 1013-1022부채널 공격에 대응하는 마스킹 기반의 블록 암호 LEA하재철, 박은수, 오수현pp. 1023-1032모바일 광고 인젝션 사례 연구김영갑, 허규, 최현상, 조상현pp. 1049-1058
원문 보기