Andola 등의 동적 ID에 기반한 사용자 인증 스킴에 대한 분석 및 개선
Analysis and Improvement of Andola et al.‘s Dynamic ID based User Authentication Scheme
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
본 논문에서는 Andola 등이 제안한 멀티서버 환경에서 동적 ID를 제공하는 사용자 인증 방식에대한 안전성과 설계상의 문제점을 분석한다. 본 논문에서 Andola 등의 인증 방식을 분석한 결과, 스마트카드 분실 공격에 안전하지 않고, 이 공격으로 인하여 사용자의 패스워드 추측 공격이 가능하고, 결국 공격자는 세션키까지 생성할 수 있다. 본 논문에서는 이러한 문제를 해결하기 위해서개선된 인증 방식을 제안하고, 이에 대한 안전성 분석한 결과 스마트카드 분실 공격, 패스워드 추측 공격, 사용자 가장 공격 등 여러 공격에 안전하였다. 또한 개선된 인증 방식은 안전한 동적 ID 를 제공할 뿐만 아니라 해시함수의 계산 복잡도 측면에서도 효율적이다. 게다가 개선된 인증 방식은 전송량도 크게 증가하지 않아 전송비용의 측면에서도 효율적인 인증 방식이라고 할 수 있다.
Abstract
In this paper, we analyze the problem of the user authentication scheme that provides dynamic ID in a multi-server environment proposed by Andola et al. and propose an improved authentication one to solve this problem. As a result of analyzing the authentication scheme of Andrea et al. in this paper, it is not safe for smart card loss attack, and this attack allows users to guess passwords, and eventually, the attacker was able to generate session key. This paper proposed an improved authentication scheme to solve these problems, and as a result of safety analysis, it was safe from various attacks such as smart card loss attack, password guess attack, and user impersonation attack. Also the improved authentication scheme not only provides a secure dynamic ID, but is also effective in terms of the computational complexity of the hash function. In addition, the improved authentication scheme does not significantly increase the amount of transmission, so it can be said to be an efficient authentication scheme in terms of transmission cost.
참고문헌 (12)
- Leslie Lamport, "Password authentication with insecure communication", Communications of the ACM, 24(11), pp.770~772 (1981), Association for Computing Machinery (ACM)[DOI]
- Ya‐Fen Chang, "Untraceable dynamic‐identity‐based remote user authentication scheme with verifiable password update", International Journal of Communication Systems, 27(11), pp.3430~3440 (2013), Wiley[DOI]
- Y. Y. Wang, "A more efficient and secure dynamic ID-based remote user authentication scheme", Computer Communications, 32(4), pp.583~585 (2009)
- Saru Kumari, "An improved remote user authentication scheme with key agreement", Comput Electr Eng, 40(6), pp.1997~2012 (2014), Elsevier BV[DOI]
- Morteza Nikooghadam, "A lightweight authentication and key agreement protocol preserving user anonymity", Multimedia Tools and Applications, 76(11), pp.13401~13423 (2017), Springer Science and Business Media LLC[DOI]
- Shehzad Ashraf Chaudhry, "An enhanced privacy preserving remote user authentication scheme with provable security", Security and Communication Networks, 8(18), pp.3782~3795 (2015), Wiley[DOI]
- Yeongjae Cho, "A Secure and Anonymous User Authentication Scheme for IoT-Enabled Smart Home Environments Using PUF", IEEE Access, 10, pp.101330~101346 (2022), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- Moneer Fakroon, "Secure remote anonymous user authentication scheme for smart home environment", Internet of Things, 9, pp.100158~ (2020), Elsevier BV[DOI]
- Shuming Qiu, "An Improved Lightweight Two-Factor Authentication and Key Agreement Protocol with Dynamic Identity Based on Elliptic Curve Cryptography", KSII Transactions on Internet and Information Systems, 13(2), pp.978~1002 (2019), 한국인터넷정보학회[DOI]
- Nitish Andola, "An enhanced smart card and dynamic ID based remote multi-server user authentication scheme", Cluster Computing, 25(5), pp.3699~3717 (2022), Springer Science and Business Media LLC[DOI]
- D. He, "Enhanced three-factor security protocol for consumer usb mass storage devices", IEEE Transactions on Consumer Electronics, 60(1), pp.30~37 (2014)
- Hamed Arshad, "An efficient and secure authentication and key agreement scheme for session initiation protocol using ECC", Multimedia Tools and Applications, 75(1), pp.181~197 (2016), Springer Science and Business Media LLC[DOI]