Shin의 TMIS를 위한 동적 ID 기반의 강력한 사용자 인증 기법에 대한 설계 오류와 안전성 분석
Design Errors and Cryptanalysis of Shin’s Robust Authentication Scheme based Dynamic ID for TMIS
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
본 논문에서는 Shin이 제안한 TMIS를 위한 동적 ID 기반의 강력한 사용자 인증기법을 분석하고, Shin의 인증 기법이 스마트카드 분실 공격에 취약하여, 공격자가 사용자의 ID를 획득할 수 있고, 이로인하여 사용자 가장 공격 등이 가능함을 보인다. 2019년에 Shin이 제안한 인증 기법은 ECC를 사용하여강력한 난수 생성을 시도함으로써, 난수 ri를 모르면 ECC 알고리즘의 난이도에 의하여 난수 r′i를 계산해낼수 없어서, 스마트카드를 분실하여도 안전하다고 주장하였다. 그러나 본 논문에서 Shin의 인증 기법을분석한 결과, 전송 메시지와 스마트카드를 사용하면 난수 r′i를 쉽게 계산할 수 있고, 이로 인하여 공격자는세션키 생성도 가능하였다. 또한 Shin의 인증 기법은 안전성 분석에 대한 취약점뿐만 아니라, 서버의ID인 SID를 사용자들에게 전달하는 방식의 부재, 사용 시마다 약간씩 다른 템플릿을 가지는 생체정보의특성을 고려하지 않은 점 등 다수의 설계상의 오류들이 존재하였고, 서버에서 사용자의 ID를 계산해내는시간 복잡도가 다른 인증 기법들에 비하여 상당히 큰 오버헤드를 가진 것으로 분석되었다.
Abstract
In this paper, we analyze Shin's proposed dynamic ID-based user authentication scheme for TMIS(Telecare Medicine Information System), and Shin's authentication scheme is vulnerable to smart card loss attacks, allowing attackers to acquire user IDs, which enables user impersonation attack. In 2019, Shin's proposed authentication scheme attempted to generate a strong random number using ECC, claiming that it is safe to lose a smart card because it is impossible to calculate random number r'i due to the difficulty of the ECC algorithm without knowing random number ri. However, after analyzing Shin's authentication scheme in this paper, the use of transmission messages and smart cards makes it easy to calculate random numbers r'i, which also enables attackers to generate session keys. In addition, Shin's authentication scheme were analyzed to have significantly greater overhead than other authentication scheme, including vulnerabilities to safety analysis, the lack of a way to pass the server's ID to users, and the lack of biometric characteristics with slightly different templates.
참고문헌 (13)
- Leslie Lamport, "Password authentication with insecure communication", Communications of the ACM, 24(11), pp.770~772 (1981), Association for Computing Machinery (ACM)[DOI]
- B. B. Gupta, "Machine learning and smart card based two-factor authentication scheme for preserving anonymity in telecare medical information system (TMIS)", Neural Computing and Applications (2021), Springer Science and Business Media LLC[DOI]
- 김기원, "Cryptanalysis and Improvement of RSA-based Authentication Scheme for Telecare Medical Information Systems", 한국컴퓨터정보학회논문지, 25(2), pp.93~103 (2020), 한국컴퓨터정보학회[DOI]
- Dharminder Dharminder, "Construction of RSA-Based Authentication Scheme in Authorized Access to Healthcare Services", Journal of Medical Systems, 44(1) (2020), Springer Science and Business Media LLC[DOI]
- Chun-Ta Li, "Cloud-assisted mutual authentication and privacy preservation protocol for telecare medical information systems", Computer Methods and Programs in Biomedicine, 157, pp.191~203 (2018), Elsevier BV[DOI]
- D. Mahto, "Cloud-based Secure TeleMedicine Information System using Crypto-Biometric Techniques", EAI Endorsed Transactions on Pervasive Health and Technology, 5(20), pp.1~11 (2020)
- Arezou Ostad-Sharif, "An enhanced anonymous and unlinkable user authentication and key agreement protocol for TMIS by utilization of ECC", International Journal of Communication Systems, 32(5), pp.e3913~ (2019), Wiley[DOI]
- A. Durlanik, "SIP authentication scheme using ECDH", PROCEEDINGS OF WORLD ACADEMY OF SCIENCE, ENGINEERING AND TECHNOLOGY, 8, pp.350~353 (2005)
- Xin Xu, "A Secure and Efficient Authentication and Key Agreement Scheme Based on ECC for Telecare Medicine Information Systems", Journal of Medical Systems, 38(1) (2014), Springer Science and Business Media LLC[DOI]
- SK Hafizul Islam, "Cryptanalysis and Improvement of Authentication and Key Agreement Protocols for Telecare Medicine Information Systems", Journal of Medical Systems, 38(10) (2014), Springer Science and Business Media LLC[DOI]
- Shehzad Ashraf Chaudhry, "Cryptanalysis and Improvement of an Improved Two Factor Authentication Protocol for Telecare Medical Information Systems", Journal of Medical Systems, 39(6) (2015), Springer Science and Business Media LLC[DOI]
- Shuming Qiu, "A Robust Mutual Authentication Scheme Based on Elliptic Curve Cryptography for Telecare Medical Information Systems", IEEE Access, 6, pp.7452~7463 (2018), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- 신광철, "원격 의료정보시스템을 위한 ECC와 동적 ID기반의 강력한 인증스킴", 한국정보기술학회논문지, 17(6), pp.123~132 (2019), 한국정보기술학회[DOI]