Journal of the Korea Institute of Information Security & Cryptology (정보보호학회논문지)

Korea Institute of Information Security and Cryptology (한국정보보호학회)
권호 표지
DOI QR코드

DOI QR Code

IP Camera Authentication and Key Exchange Protocol Using ID-Based Signature Scheme

ID 기반 서명 기법을 이용한 IP 카메라 인증 및 키 교환 프로토콜

  • Received : 2018.03.26
  • Accepted : 2018.07.30
  • Published : 2018.08.31
Download PDF
⟨ Previous Next ⟩

Abstract

Currently widely used IP cameras provide the ability to control IP cameras remotely via mobile devices. To do so, the IP camera software is installed on the website specified by the camera manufacturer, and authentication is performed through the password between the IP camera and the mobile device. However, many products currently used do not provide a secure channel between the IP camera and the mobile device, so that all IDs and passwords transmitted between the two parties are exposed. To solve these problems, we propose an authentication and key exchange protocol using ID-based signature scheme. The proposed protocol is characterized in that (1) mutual authentication is performed using ID and password built in IP camera together with ID-based signature, (2) ID and password capable of specifying IP camera are not exposed, (3) provide forward-secrecy using Diffie-Hellman key exchange, and (4) provide security against external attacks as well as an honest-but-curious manufacturer with the master secret key of the ID-based signature.

현재 광범위하게 사용되는 IP 카메라는 모바일 기기를 통해 원격으로 IP 카메라를 제어하는 기능을 제공한다. 이를 위해 카메라 제조사가 지정한 웹사이트에서 IP 카메라 소프트웨어를 설치하고, IP 카메라와 모바일 기기 간 패스워드를 통해 인증을 거치게 된다. 그러나 현재 사용되는 많은 제품은 IP 카메라와 모바일 기기 간 보안채널을 제공하지 않아서 그 두 주체 간 전송되는 모든 ID 및 패스워드가 그대로 노출되는 문제가 있다. 이러한 문제점을 해결하기 위해 본 논문에서는 ID 기반 서명기법을 이용한 상호 인증 및 키 교환 프로토콜을 제안한다. 제시된 프로토콜의 특징은 (1) ID 기반 서명과 함께 IP 카메라에 내장된 ID 및 패스워드를 이용하여 상호인증을 수행하고, (2) 프로토콜 메시지 전송과정에서 IP 카메라를 특정할 수 있는 ID 및 패스워드가 노출되지 않으며, (3) 디피-헬만 키 교환을 사용하여 전방향 안정성을 제공하고, (4) 외부 공격자뿐만 아니라 ID-기반 서명의 마스터 비밀키를 가지고 호기심을 가진(honest-but-curious) 제조사에 대해서도 안전성을 가진다.

Keywords

References

  1. J. Park, S. Kim, "Security requirements analysis on IP camera via threat modeling and common criteria," KIPS Transactions on Computer and Communication Systems, 6(3), pp. 121-134, Mar. 2017 https://doi.org/10.3745/KTCCS.2017.6.3.121
  2. A. O'Donnell, "How to secure IP secur ity cameras," https://www.lifewire.com/secure-your-ip-security-cameras-2487488"
  3. I. Badgujar, "How to hack CCTV priva te cameras," "https//null-byte.wonderhowto.com/forum/hack-cctv-private-cameras-0159437"
  4. J. Eom, M. Seo, J. H. Park, D. H. Lee, "Efficient ID-based authentication and key exchange protocol," Journal of The Korea Institute of information Security & Cryptology, 26(6), pp. 1387-1399, Dec. 2016 https://doi.org/10.13089/JKIISC.2016.26.6.1387
  5. M. Bellare, S. Miner, "A forward secure digital signature scheme," CRYPTO'99, LNCS 1666, pp. 431-448, Aug. 1999
  6. R. Canetti, H. Krawczyk, "Analysis of key exchange protocols and their use for building secure channels," EUROCRYPT'01, LNCS 2045, pp. 453-474, May. 2001
  7. H. Huang, Z. Cao, "An ID-based authenticated key exchange protocol based on bilinear Diffie-Hellman problem," ASIACCS'09, pp. 332-342, Mar. 2009
  8. D. Hofheinz, E. Kiltz, "The group of signed quadratic residues and applications," CRYPTO'09, LNCS 5677, pp. 637-653, Aug. 2009
  9. M. Abdalla, M. Bellare, P. Rogaway, "The oracle Diffie-Hellman assumptions and an analysis of DHIES," CT-RSA'01, LNCS 2020, pp. 143-158, Apr. 2001
  10. L. C. Guillou, J. J. Quisquater, "A paradoxical identity-based signature scheme resulting from zero knowledge," CRYPTO'88, LNCS 403, pp. 216-231, Aug. 1989
  11. M. Bellare, C. Namprempre, G. Neven, "Security proofs for identity-based identification and signature schemes," Journal of Cryptology, 22(1), pp. 1-61, Jan. 2009 https://doi.org/10.1007/s00145-008-9028-8
  12. D. Galindo, F. D. Garcia, "A Schnorr-like lightweight identity-based signature scheme," AFRICACRYPT'09, LNCS 5580, pp. 135-148, Jan. 2009
  13. H. Krawczyk, H. Wee, "The OPTLS protocol and TLS 1.3," EuroS&P'16, IEEE, Mar. 2016