• Journal of Digital Convergence
• /
• v.10 no.2
• /
• pp.183-191
• /
• 2012

This study proposes dual certification model using both what users know and what users own. In detail, this mobile OTP generation model is made up of mobile OTP generation and extraction algorithm satisfying the conditions for reviewing mobile OTP implementation. In order to improve the security of the existing OTP-based systems, the suggested method utilizes user's ID and random number at the mobile OTP generation stage.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.37 no.6C
• /
• pp.497-501
• /
• 2012

While increasing online services with developing e-businesses, finance, game companies and others have employed OTP(One-Time Password) to overcome vulnerabilities of static passwords. Existing OTP technology has inconvenience that customers always possess reserved token since requiring the token to generate OTP. In order to supplement the issue we propose mobile OTP generated by mobile devices such as smart phones. Our mobile OTP scheme generates OTP by using a non-linear function based on pairing to eject the collision problem of S/Key scheme universally used to design OTP schemes. Our scheme based on a non-linear function over pairing can complements the collision problem and widely applied to finance and various services to increase security level of the services.

• Proceedings of the KAIS Fall Conference
• /
• 2009.05a
• /
• pp.154-157
• /
• 2009

정보통신기술의 발달로 온라인으로 많은 서비스가 이루어지면서 온라인을 통해서 송 수신 되는 정보들의 가치도 높아지고 있다. 현재 전자금융거래의 보안을 향상시키기 위해서 금융기관은 OTP 인증을 사용한다. OTP 인증은 패스워드 기반의 인증기술이며, OTP 토큰을 이용하여 OTP를 생성한다. 이러한 인증은 일방향 해시함수의 충돌성, OTP 토큰에 대한 물리적 공격, OTP 토큰의 전력소모에 따른 동기화 문제를 가지고 있다. 따라서 본 논문에서는 모바일 기기를 이용한 워터마킹 기반 3-Factor OTP 인증을 제안한다. 제안한 인증에서는 OTP를 생성하기 위해 사용자의 생체정보를 사용하며, 서비스 제공자는 사용자의 생체정보에 서버의 비밀정보를 워터마킹 기법을 이용하여 숨긴다. 워터마킹된 생체정보를 사용자의 모바일 기기의 저장하고, 이 정보를 통해 사용자는 생체정보를 인증하고, OTP를 생성한다. 제안한 인증기술은 OTP토큰을 휴대해야 하는 불편 대신에 대부분 성인이 휴대한 휴대폰과 같은 모바일 기기를 통해 OTP를 생성하고 인증을 할 수 있으며, 생체정보를 이용함으로써 다른 사용자가 OTP를 생성할 수 없도록 한다. 이러한 기법은 안전한 인증을 요구하는 모든 온라인 서비스에서 사용될 수 있다.

• Proceedings of the KAIS Fall Conference
• /
• 2008.11a
• /
• pp.17-20
• /
• 2008

최근 정보통신기술이 발달하면서 온라인상에서 다양한 서비스들이 이루어지고 있으며, 그에 대한 해킹 및 다양한 공격 기법들이 생겨나고 있다. 그래서 사용자를 인증하기 위해서 정적인 패스워드가 아닌 동적인 패스워드, 즉 OTP(One-Time Password)를 사용하고 있다. 현재 OTP 토큰을 이용한 OTP 생성알고리즘의 문제점이 제기 되고, 따라서 본 논문은 모바일 기기를 이용한 인증을 통해 그 문제점들을 보완하기로 한다. OTP를 생성할 때 수시로 모바일 기기는 서버와 통신함으로써 절대적인 단방향 생성이 아닌 능동적인 쌍방향 생성을 통해 서로에 대한 신뢰성과 제기된 문제점을 보완하고자 한다. 그리고 OTP 토큰을 사용 시 성능 및 기능의 제한을 모바일 기기를 사용함으로써 극복하고자 한다. 향후에는 모바일 기기를 이용한 3-factor 인증에 대한 연구를 통해 신뢰성을 높이고, 자체인증시스템을 더욱 개선함으로 대중화된 모바일 기기를 이용한 다양한 인증 서비스를 제공하고자 한다.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.38B no.5
• /
• pp.377-384
• /
• 2013

In order to improve the security strength in the password based user authentication, in which the security vulnerability is increased while the same password is repeatedly used, the OTP(One-Time Password) system has been introduced. In the OTP systems, however, the user account information and OTP value may be hacked if the user PC is infected by the malicious codes, because the user types the OTP value, which is generated by the mobile device synchronized with the server, directly onto the user PC. In this paper, we propose a new method, called DTOTP(Dual Transmission OTP), to solve this security problem. The DTOTP system is an improved two-factor authentication method by using the dual transmission, in which the user performs the server authentication by typing the user account and password information onto the PC, and then for the OTP authentication the mobile device scans the QR code displayed on the PC and the OTP value is sent to the server directly. The proposed system provides more improved security strength than that of the existing OTP system, and also can adopt the existing OTP algorithm without any modification. As a result, the proposed system can be safely applied to various security services such like banking, portal, and game services.

• Journal of the Korea Society of Computer and Information
• /
• v.17 no.4
• /
• pp.121-127
• /
• 2012

Biometric technology has been proposed as a new means to replace conventional PIN or password because it is hard to be lost and has the low possibility of illegal use. However, unlike a PIN or password, there is no way to modify the exposure if it is exposed and used illegally. To solve the problems, we propose to apply OTP using biometric information to mobile devices for more secure and adaptable authentication. In this paper, we propose a secure framework for delivering biometric information as mobile OTP to the server (TTP) and compared this paper with existed methods about security and performance.

• Annual Conference of KIPS
• /
• 2011.11a
• /
• pp.762-764
• /
• 2011

스마트폰 보급의 확산으로 모바일 금융 서비스 이용자 수는 증가하고 모바일 금융 보안에 대한 중요성이 증가되고 있는 실정이지만 해마다 다양해지는 금융 공격에 대비하기는 결코 쉽지 않다. 최근 주로 사용되고 있는 금융 보안 인증 방식인 OTP(One-Time Password)는 세션 공격에 대한 보안 대비가 가능하지만 차별화된 OTP 생성 메커니즘을 적용하는 것이 힘든 단점이 있다. 본 연구에서는 이러한 기존 방식의 문제점을 해결하기 위해 확장된 OTP 메커니즘을 이용한 새로운 금융 보안 방식을 제안하고자 한다. 제안 방식은 센서 네트워크를 금융 보안 알고리즘에 적용시킨 위치 기반 동기화 방식의 OTP 생성 메커니즘으로서 다양한 금융 해킹과 공격 기법에 대비가 가능하다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.18 no.2
• /
• pp.21-31
• /
• 2008

Ubiquitous environment is constructed by development of an IT technology, offer environment of many service changed to mobile environment. Also, existed service offered at fixed position like home or company, but according to development of mobile device. user require service as moving. Wibro can offer as user moving using mobile device. As requirement should be included authentication, in case of authentication between UICC and AAA authentication server is offered in Wibro, service is available. However, when UICC requires initial authentication to AAA authentication server, identification information of UICC expose as plaintext, so privacy infringement of mobile device occurs. Therefore, identification information of terminal generate randomly using OTP(One-Time Password) that generated in mobile terminal, and we proposed mechanism of privacy protection. Also, we proposed mechanism that offer secure service to user as offer authentication from OTP framework, and offer OTP combination authentication detailedly.

• The KIPS Transactions:PartC
• /
• v.18C no.5
• /
• pp.327-330
• /
• 2011

After releasing the smart phone equipping the strong computational capability compared to traditional mobil phone, a field of services, which is available on the personal computers, is expanded to smart phone. The development of technology reduces the limited service utilization on time and space but it has a venerability exposing an information to malicious user. Especially we need to more attention when using the financial services which communicate the user's private information. To solve the security problem, OTP(One Time Pad), which uses a private key for a session, is recommended. OTP techniques in smart phone having focused on traditional environments have been proposed and implemented. However, security over mobile environments is more vulnerable to attack and has restriction on resources than traditional system. For this reason, definition of proper conceptual OTP on smart phone is required. In the paper, we present the L-OTP(Location-OTP) protocol, using T-OTP(Time One Time Pad) technique with location information. Proposal generates the OTP using unique location information which is obtained in smart phone.

• Journal of Advanced Navigation Technology
• /
• v.15 no.1
• /
• pp.39-53
• /
• 2011

As the applications within Mobile devices becoming more extensive, the mobile communication security issues of these applications and researches are appearing to be the most important concern. In this paper, we propose new integration OTP framework technique which uses the fingerprint and voice features of biometrics in order to generate Mobile One Time Passwords (OTPs) Token. The fingerprint and voice are considered to be one of the powerful personal authentication factors of biometrics and it can be used for generating variable passwords based on mobile environments for one time use. However, we performed a simulation of homomorphic variability of fingerprint and voice feature points using dendrogram and distribution of fingerprint and voice feature points for proposed password generation method, and verified validation of availability.