Browse > Article
http://dx.doi.org/10.5392/JKCA.2018.18.09.141

App-based 2-channel User Authentication Scheme for Multiple Application Systems  

Song, Tae-Gi (배재대학교 사이버보안학과)
Jo, In-June (배재대학교 사이버보안학과)
Publication Information
The Journal of the Korea Contents Association / v.18, no.9, 2018 , pp. 141-148 More about this Journal
Abstract
Currently, the user authentication technology used by users to access multiple applications within an organization is being applied with ID/PW-based SSO technology. These user authentication methods have the fundamental disadvantages of ID/PW and SSO. This means that security vulnerabilities in ID/PW can lead to periodic changes in PWs and limits on the number of incorrect PW inputs, and SSO adds high cost of the SSO server, which centrally stores the authentication information, etc. There is also a fundamental vulnerability that allows others to freely use other people's applications when they leave the portal application screen with SSO. In this paper, we proposed an app-based 2-channel authentication scheme to fundamentally eliminate problems with existing ID/PW-based SSO user authentication technologies. To this end, it distributed centralized user authentication information that is stored on SSO server to each individual's smartphone. In addition, when users access a particular application, they are required to be authenticated through their own smartphone apps.
Keywords
Identification and Authentication; Smart Device; SSO; Authentication System;
Citations & Related Records
연도 인용수 순위
  • Reference
1 ISO/IEC 7816-3 (2006): "Identification cards - Integrated circuit(s) cards with contacts, part3 : Cards with contacts - Electrical interface and transmission protocols."
2 ISO/IEC 7816-12 (2005): "Identification cards - Integrated circuit(s) cards with contacts, part12 : Cards with contacts - USB electrical interface and operating procedures."
3 java cipher(http://docs.oracle.com/javase/8/docs/api/crypto/chiper.html)
4 FIPS Pub. 197: Specification for the AES, Nov. 2001, availableat:http ://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
5 이상민, "최근 인증기술 관련 현황," 한국IT서비스산업협회, 2012.
6 google android, (http://www.android.com).
7 N. Haller, C. Metz, P. Nesser, and M. Staraw, "A One-Time Password System" RFC 2289, IETF, 1998.
8 사희석, 최중섭, 주필환, "윈도우 악성코드 분류방법론 설계," 정보보호학회논문지, 제19권, 제2호, 2009(4).
9 S. Gastellier-Prevost and M. Laurent, "Defeating pharming attacks at the client-side," 2011 5th International Conference on Network and System security, IEEE. pp.33-40, Sept. 2011.
10 김영수, 나중찬, 손승원, "패스워드 인증 프로토콜 동향," 전자통신동향분석, 제16권, 제6호, 2001(12).
11 ISO/IEC 7816-1 (1998): "Identification cards - Integrated circuit(s) cards with contacts, part1 : Physical characteristics."