원타임 키패드의 보안성 분석
A Study on the Security of One-Time Keypad (OTK)
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
보안에 관한 많은 암호 기술의 도입에도 불구하고 어깨 넘어 훔쳐보기 등과 같은 사회공학적인 공격은 원천적으로차단하기 어려운 공격기법이다. 현금자동입출기기와 같이 개방된 공간에 설치된 금융시설에서는 더욱 그러한 공격을 차단하기 어렵다. 이뿐 아니라 업무처리 비중이 점점 늘고 있는 온라인 금융 서비스는 공간의 제약 없이 어디서나 사용가능하다는 편리성의 이면에 어깨 넘어 훔쳐보기, 스머지 공격, 구글 글라스를 이용한 비밀번호의 위치점 유추 등의 공격에 취약한 부분이 있다. 본 논문에서는 현금자동입출기기와 인터넷 뱅킹에서 원타임 키패드(One-Time Keypad)를사용함으로 비밀번호 유출에 안전함을 보이고, 기존에 사용되는 키패드와 OTP (One-Time Password)와의 보안성을 비교 분석하였다.
Abstract
For all the various cryptographic techniques related to security, social technological attacks such as a shoulder surfing are infeasible to block off completely. Especially, the attacks are executed against financial facilities such as automated teller machine(ATM) which are located in public areas. Furthermore, online financial services whose rate of task management is consistently increasing are vulnerable to a shoulder surfing, smudge attacks, and key stroke inference attacks with google glass behind the convenience of ubiquitous business transactions. In this paper, we show that the security of ATM and internet banking can be reinforced against a shoulder surfing by using One-Time Keypad(OTK) and compare the security of OTK with those of ordinary keypad and One-Time Password(OTP).
참고문헌 (19)
- The Bank of Korea, "Use of internet banking services during Q3 2016", ~ (2016)
- 2016 Survey on information security(individual)executive summary, "Korea Internet and Security Agency", ~ (2017)
- Financial Security Agency, "Guide to financial applications of cryptographic techniques", ~ (2014)
- 김성환, "어깨너머공격 모델링 및 보안 키패드 취약점 분석", 정보보호학회논문지, 24(6), pp.1159~1174 (2014), 한국정보보호학회[DOI]
- H. Kim, "Realization of virtual security keypad against shoulder surfing attack", Journal of The Korea Institute of Information Security & Cryptology, 23(6), pp.21~29 (2013)
- 서화정, "입력 위치 유추 방지를 위한 보안 키패드의 설계", 정보보호학회논문지, 26(1), pp.41~47 (2016), 한국정보보호학회[DOI]
- I. Kim, "Keypad against brute force attacks on smartphones", IET Information Security, 6(2), pp.71~76 (2012)
- V. Roth, "PIN-entry method resilient against shoulder surfing", Proceedings of the 11th ACM Conference on Computer and Communications Security, pp.236~245 (2004)
- T. Kwon, "Covert attentional shoulder surfing : Human adversaries are more powerful than expected", IEEE Transactions on Systems, Man, and Cybernetics : Systems, 44(6), pp.716~727 (2014)
- P. Marquardt, "(sp)iphone : Decoding vibrations from nearby keyboards using mobile phone accelerometers", Proceedings of the 18th ACM Conference on Computer and Communications Security, pp.551~562 (2011)
- A. Maiti, "Preventing shoulder surfing using randomized augmented reality keyboards", Proceedings of the 2017 IEEE International Conference on Pervasive Computing and Communications Workshops, pp.630~635 (2017)
- S. Choi, "Inputting system and method for security key using one time keypad", Korean Patent, 10-1629495, ~ (2017)
- K. Kim, "A study on user authentication based on One-Time Password", Journal of The Korea Institute of Information Security & Cryptology, 17(3), pp.26~31 (2007)
- K. Kim, "One-Time Password (OTP) integrated authentication service framework", TTA Journal, 153(5), pp.56~61 (2014)
- C. Xiao-rong, "Research and realization of authentication technique based on OTP and Kerberos", Proceedings of Eighth International Conference on High-Performance Computing in Asia-Pacific Region, pp.409~ (2005)
- Foo Kune, "Timing attacks on pin input devices", Proceedings of the 17th ACM Conference on Computer and Communications security, pp.678~680 (2010)
- C. Mulliner, "SMS-based one-time passwords : attacks and defense", Proceedings of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Springer Berlin Heidelberg, pp.150~159 (2013)
- G. A. Alvarez, "The capacity of visual short-term memory is set both by visual information load and by number of objects", Psychological Science, 15(2), pp.106~111 (2004)
- PCI Security Standards Council, "Information supplement : ATM security guideline", ~ (2013)