DOI QR코드

DOI QR Code

The Design of Authentication Model based on Symmetric Key Encryption for Improving Network Availability in Cloud Environment

클라우드 환경에서 네트워크 가용성 개선을 위한 대칭키 암호화 기반 인증 모델 설계

  • Received : 2019.10.05
  • Accepted : 2019.12.30
  • Published : 2019.12.31

Abstract

Network-based sharing of information has evolved into a cloud service environment today, increasing its number of users rapidly, but has become a major target for network-based illegal attackers.. In addition, IP spoofing among attackers' various attack techniques generally involves resource exhaustion attacks. Therefore, fast detection and response techniques are required. The existing detection method for IP spoofing attack performs the final authentication process according to the analysis and matching of traceback information of the client who attempted the connection request. However, the simple comparison method of traceback information may require excessive OTP due to frequent false positives in an environment requiring service transparency. In this paper, symmetric key cryptography based on traceback information is used as mutual authentication information to improve this problem. That is, after generating a traceback-based encryption key, mutual authentication is possible by performing a normal decryption process. In addition, this process could improve the overhead caused by false positives.

네트워크를 통한 정보의 공유는 오늘날 클라우드 서비스 환경으로 발전하여 그 이용자수를 빠르게 증가시키고 있지만 네트워크를 기반으로 하는 불법적인 공격자들의 주요 표적이 되고 있다. 아울러 공격자들의 다양한 공격 기법 중 IP 스푸핑은 그 공격 특성상 일반적으로 자원고갈 공격을 수반하기 때문에 이에 대한 빠른 탐지와 대응 기법이 요구 된다. IP 스푸핑 공격에 대한 기존의 탐지 방식은 연결 요청을 시도한 클라이언트의 트레이스 백 정보 분석과 그 일치 여부에 따라 최종적인 인증과정을 수행 한다. 그렇지만 트레이스 백 정보의 단순 비교 방식은 서비스 투명성을 요구하는 환경에서 빈번한 False Positive로 인하여 과도한 OTP 발생을 요구할 수 있다. 본 논문에서는 이러한 문제를 개선하기 위해 트레이스 백 정보 기반의 대칭키 암호화 기법을 적용하여 상호 인증 정보로 사용하고 있다. 즉, 트레이스 백 기반의 암호화 키를 생성한 후 정상적인 복호화 과정의 수행 여부로 상호 인증이 가능하도록 하였다. 아울러 이러한 과정을 통하여 False Positive에 의한 오버헤드도 개선할 수 있었다.

Keywords

References

  1. Zargar, S.T.,Joshi, J.and Tipper, D. 2013. A surver of defense mechanisms against distributed denial of service DDoS flooding attacks, Communications Survers & Tutorials, IEEE, 15(4) : 2046-2069 https://doi.org/10.1109/SURV.2013.031413.00127
  2. H-D. Lee, H-T. Ha, H-C Baek, C-G. Kim, and S-B. Kim, Efficient detction and defence model against IP spoofing attack through cooperation of trusted hosts, Journal of the Korea Institute of Information and Communication Engineering, Vol. 24, No. 12, pp. 2649-2656, 2012.
  3. R-W. Huang, X-L. Gui, S. Yu, and W. Zhuang, Privacy-Preserving Computable Encryption Scheme of Cloud Computing, Chinese Journal of Computers, Vol. 34, No. 12, pp. 2391-2402, 2011. https://doi.org/10.3724/SP.J.1016.2011.02391
  4. Y, H. Jung, "A Study of the Android OS based touch macro detection method", Korea Univ., 2016.
  5. Telecommunication Technology Association 2008. Botnat trend and respond technology present, TTA Journal, 118 (Special Report) : 58-65.
  6. W. I. Kim, S. H. Yoo, Y. C. Jang and C.H. Lee, "A Design and Implementation of Abnormal Permission-Flow Detecting Security Module", J. of Korean Institute of Next Generation Computing, Vol.10, No. 2, pp 66-74, 2014.
  7. J.z. Li, and X.M. Liu An important aspect of big data : Data usability, School of Computer Science and Technology, Harbin Institute of Technology, Harbin 150001, pp. 1147-1162, 2013.
  8. D. Pansa and T. Chomsiri, Architecture and Protocols for Secure LAN by Using a Software-level Certificate and Cancellation of ARP Protocol, Third 2008 International Conference on Convergence and Hybrid Information Technology, pp. 21-26, 2008.
  9. Shin, Y. H. Lim, G. H and Im, E. G. 2009. A Research on the possibility of ARP spoofing attack in SCADA System Based on TCP/IP environment. Convergence security journal, 9(3) : 9-17.
  10. D.-S. Choi, D.-H. Oh, J.-S. Park, J.-C. Ha, An Improved Round Reduction Attack on Triple DES Using Fault Inj-ection in Loop Statement, Journal of The Korea Institute of Information Security & Cryptology, Vol. 22, No. 4. pp 709-717, 2012.
  11. M-H Kim, H-C Beak, S-W Hong and J-H Park, 2015. An Encrypted Service Data Model for Using Illegal Applications of the Government Civil Affairs Service under Big Data Environments, Convergence security journal, Vol. 15No. 7, pp. 31-38, 2015.
  12. C. H, An, H. C. Baek, Y. G. Seo, W. C. Jeong, and S. B. Kim. "Designing Mutual Cooperation Security Model for IP Spoofing Attacks about Medical Cluster Basis Big Data Environment", Convergence security journal, Vol. 16, No. 7, pp. 21-29, 2016.
  13. Y-J Baek, S-W Hong, J-H Park, G-W Gang, S-B Kim, "A Macro Attacks Detection Model Based on Trace Back Information", Convergence security journal, Vol. 18, No. 5, pp. 113-120, 2018.
  14. Y. T. Mu, H. C. Baek, J. Y. Choi, W. C. Jeong, and S. B. Kim, "A Proposal of a Defence Model for the Abnormal Data Collection using Trace Back Information in Big Data Environments", Journal of the Korea Institute of Information and Communication Engineering, Vol. 10, No. 2, 2015.
  15. C. H. An, "Medical treatment cluster composition and security model design of regional public hospitals in Korea for telemedicine", Gyengsang Univ., 2016.