DOI QR코드

DOI QR Code

The Extended Authentication Protocol using E-mail Authentication in OAuth 2.0 Protocol for Secure Granting of User Access

OAuth 2.0 프로토콜에서 E-mail을 이용한 사용자 권한 인증

  • Chae, Cheol-Joo (Dept. of R&D System Development, Korea Institute of Science and Technology Information) ;
  • Choi, Kwang-Nam (Dept. of R&D System Development, Korea Institute of Science and Technology Information) ;
  • Choi, Kiseok (Dept. of R&D System Development, Korea Institute of Science and Technology Information) ;
  • Yae, Yong-Hee (Dept. of R&D System Development, Korea Institute of Science and Technology Information) ;
  • Shin, YounJu (Dept. of R&D System Development, Korea Institute of Science and Technology Information)
  • Received : 2014.10.21
  • Accepted : 2014.11.01
  • Published : 2015.02.28

Abstract

Currently there are wide variety of web services and applications available for users. Such services restrict access to only authorized users, and therefore its users often need to go through the inconvenience of getting an authentication from each service every time. To resolve of such inconvenience, a third party application with OAuth(Open Authorization) protocol that can provide restricted access to different web services has appeared. OAuth protocol provides applicable and flexible services to its users, but is exposed to reply attack, phishing attack, impersonation attack. Therefore we propose method that after authentication Access Token can be issued by using the E-mail authentication. In proposed method, regular user authentication success rate is high when value is 5 minutes. However, in the case of the attacker, the probability which can be gotten certificated is not more than the user contrast 0.3% within 5 minutes.

최근 다양한 웹 서비스와 어플리케이션들이 사용자에게 제공되고 있다. 이러한 서비스들은 인증된 사용자에 한해서 서비스를 제공하기 때문에 사용자는 매번 서비스 별로 인증을 수행해야 하는 불편함을 겪고 있다. 이러한 불편함을 해결하기 위해 $3^{rd}$ Party 어플리케이션이 웹 서비스에 대하여 제한된 접근 권한을 얻을 수 있게 해주는 OAuth(Open Authorization) 프로토콜이 등장하게 되었다. 이러한 OAuth 프로토콜은 사용자에게 편리하고 유연한 서비스를 제공한다. 그러나 OAuth 2.0 프로토콜에서는 재전송 공격, 피싱 공격, 위장 공격 취약점이 발생할 수 있다. 그러므로 본 논문에서는 OAuth 2.0 프로토콜의 보안성 향상을 위하여 E-mail인증을 통해 Resource Owner를 인증 후 Access Token 발급을 할 수 있는 방법을 제안한다.

Keywords

References

  1. Seon-Joo Kim, "An Efficient Access Control Mechanism for Application Software using the OAuth in the SaaS Cloud System", Graduate School of PaiChai University, 2013.
  2. Jeong-Kyung Moon, "A Delegator for Authentication Management System using OAuth in Cloud Computing Environment", Graduate School of Kongju National University, 2013.
  3. Myung Hyun Han, "Research on the extended OAuth protocol for real-name authentication", Graduate of School of Information Technology Chung-Ang University, 2013.
  4. Meng-Yu Wu, Tsern-Huei Lee, "Design and Implementation of Cloud API Access Control Based on OAuth", In Proc. Of TENCON Spring Conference, 2013. http://dx.doi.org/10.1109/TENCONSpring.2013.6584492
  5. http://en.wikipedia.org/wiki/OAuth
  6. Daeyoung Heo, Suntae Hwang, "OAuth based Proxy Delegation Service", Journal of Internet Computing and Services, Vol. 13, No.6, 2012, pp. 55-62 http://dx.doi.org/10.7472/jksii.2012.13.6.55
  7. D. Hardt, "The OAuth 2.0 authorization framework," Internet Engineering Task Force(IETF) RFC 6749, 2012.
  8. E. Hammer-Lahav, Ed, "The OAuth 1.0 Protocol", Internet Engineering Task Force(IETF) RFC5849, 2010.
  9. M. Jones and D. Hardt, "OAuth 2.0 Authorization Framework: Bearer token usage", Internet Engineering Task Force(IETF) RFC6750, 2012.
  10. Feng Yang, Sathiamoorthy Manoharan, "A security analysis of the OAuth protocol", In Proc. Of Communications, Computers and Signal Processing (PACRIM), 2013. http://dx.doi.org/10.1109/PACRIM.2013.6625487
  11. T. Lodderstedt, M. McGloin, and P. Hunt, "OAuth 2.0 threat model and security considerations", Internet Engineering Task Force(IETF) RFC6819, 2013.
  12. K. P. L. Francisco Corella, "Security analysis of double redirection protocols", Pomcor, Tech. Rep., 2011.
  13. J. Richer, W. Mills, and H. Tschofenig, "OAuth 2.0 message authentication code (MAC) tokens", draft-ietf-oauth-v2-http-mac-02, 2012.
  14. Won-Jin Lee, Kee-Won Kim, "Cryptanalysis and Improvement of an E-mail Exchange Protocol with Mutual Authentication", Journal of KIIT, Vol 11, No. 10, 2013, pp. 61-68.
  15. Hae-Soon Ahn, Jongjung Woo, Ki-Dong Bu, "Robust E-mail Exchange Protocol with Mutual Authentication", Journal of KIIT, Vol. 10, No. 11, 2012, pp. 105-112.

Cited by

  1. A Survey of Internet of Things (IoT) Authentication Schemes vol.19, pp.5, 2015, https://doi.org/10.3390/s19051141