• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2022.10a
• /
• pp.331-332
• /
• 2022

The previously used locking device is a PIN method and has a problem in that the password is exposed by malicious users. In other words, if attackers looks at lock passwords from the side, correct passwords are known. In this paper, we aim to solve these security problems in lock devices resistant to shoulder surfing attacks. The proposed encryption approach is designed so that attackers cannot know lock passwords. To this end, we use a hidden password method instead of directly entering a PIN-type password to prevent the correct password from being exposed to an attacker even if someone steals the lock password.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.18 no.4
• /
• pp.867-875
• /
• 2014

Rapid development of internet service is enabling internet banking services in anywhere and anytime. However, service access through internet can be exposed to adversary easily. To prevent, current service providers execute authentication process with user's identification and password. However, majority of users use short and simple password and do not periodically change their password. As a result of this, user's password could be exposed to attacker's brute force attack. In this paper, we presented enhanced password system which guarantee higher security even though users do not change their current password. The method uses additional secret information to replace real password periodically without replacement of real password.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2003.07a
• /
• pp.303-306
• /
• 2003

본 논문은 비밀번호 인증의 신뢰성 강화에 관한 연구로서 비밀번호 인증의 취약성과 공격방식을 살펴보고 이에 대한 신뢰성 강화 방안을 제시한다. 본 논문은 비밀번호 인증 처리에 있어서 사용자와 시스템간의 상호인증 방법을 제시하여 사용자가 알아차리지 못하는 사이에 중요 정보가 유출되는 것을 방지하며, 커널 수준에서 접근제어 기능을 제공하여 트로이 목마 유형의 공격으로부터 인증 처리 프로세스를 보호함으로서 기존의 비밀번호 인증 처리의 신뢰성을 향상하였다. 본 논문은 비밀번호 인증의 신뢰성을 강화하기 위해 비밀번호 자체의 보호를 강조하던 기존의 연구들과 달리 인증 처리 프로세스를 보호할 수 있는 메커니즘을 제안한다. 또한, 실험을 통한 검증을 이용하여 연구 결과의 정당성을 뒷받침하였다.

• Journal of the Korea Convergence Society
• /
• v.8 no.6
• /
• pp.37-44
• /
• 2017

Mobile devices provide various services through payment and authentication by inputting important information such as passwords on the screen with the virtual keypads. In order to infer the password inputted by the user, the attacker captures the user's touch location information. The attacker is able to infer the password by using the location information or to obtain password information by peeping with Google Glass or Shoulder Surfing Attack. As existing secure keypads place the same letters in a set order except for few keys, considering handy input, they are vulnerable to attacks from Google Glass and Shoulder Surfing Attack. Secure keypads are able to improve security by rearranging various shapes and locations. In this paper, we propose secure keypads that generates 13 different shapes and sizes of Tetris and arranges keypads to be attached one another. Since the keypad arranges different shapes and sizes like the game, Tetris, for the virtual keypad to be different, it is difficult to infer the inputted password because of changes in size even though the attacker knows the touch location information.

• Proceedings of the KAIS Fall Conference
• /
• 2010.05a
• /
• pp.397-399
• /
• 2010

본 논문에서는 사용자의 원천 비밀정보의 직접적인 유출을 근본적으로 방지하고자, 사용자 스스로가 원천 비밀정보를 이용해 일회성의 가상 비밀정보를 생성, 키보드입력 및 화면 훔쳐보기와 리플레이 공격, 그리고 피싱 등의 공격으로부터 안전성을 보장할 수 있는 가상 비밀번호 입력 시스템을 제안한다.

• The Journal of Society for e-Business Studies
• /
• v.16 no.4
• /
• pp.1-16
• /
• 2011

A digital certificate mandated by the Electronic Signature Act has become familiar in our daily lives as 95% of the economically active population hold certificates. Due to upgrades to 256 bit level security that have become effective recently, the security and reliability of digital certificates are expected to increase. Digital certificates based on Public Key Infrastructure (PKI) have been known as "no big problem," but the possibility of password exposure in cases of leaked digital certificates still exists. To minimize this vulnerability, various existing studies have introduced alternative password methods, expansion of certificate storage media, and multiple certification methods. These methods perform enhanced functions but also have limitations including the fact that the secureness of passwords is not guaranteed. This study suggests an alternative method for enhancing the level of password secureness as a way to improve password security. This new method improves security management and enhances the convenience of using digital technologies. The results may be used for developing digital certificate related security technologies and research in the future.

• The KIPS Transactions:PartD
• /
• v.17D no.2
• /
• pp.167-174
• /
• 2010

When entering the PIN(personal identification number), the greatest security threat is shoulder surfing attack. Shoulder surfing attack is watching the PIN being entered from over the shoulder to obtain the number, and it is the most common and at the same time the most powerful security threat of stealing the PIN. In this paper, a psychology based PINpad technology referred to as DAS(Dynamic Authentication System) that safeguards from shoulder surfing attack was proposed. Also, safety of the proposed DAS from shoulder surfing attack was tested and verified through intuitive viewpoint, shoulder surfing test, and theoretical analysis. Then, a PINpad with an internal DAS that was certified for its safety from shoulder surfing attack was designed and produced. Because the designed PINpad significantly decreases the chances for shoulder surfing attackers being able to steal the PIN when compared to the ordinary PINpad, it was determined to be suitable for use at ATM(automated teller machine)s operated by banks and therefore has been introduced and is being used by many financial institutions.

• The KIPS Transactions:PartC
• /
• v.18C no.2
• /
• pp.71-78
• /
• 2011

Financial accidents such as password exposure of credit cards or bankbooks occur often when a password is inputted to ATM/CD(Automated Teller Machines and Cash Dispenser), so particular attention is required when inputting a password. This study suggested a method to input a password safely to prevent stealing a glance at a password in case of the use of ATM/CD. The method is that users input a password when numbers are randomly displayed and disappear not to notice the password even though someone is next to or behind the users. As methods to input a password safely, the study verified safety by dividing the methods into a test of shoulder surfing, an intuitive perspective, and a theoretical analysis. In addition, the result of implementation to apply the method to ATM/CD shows that a percentage of acquiring a password from the attack of shoulder surfing is found to be lower than an existing method, so password exposure can be prevented.

• Journal of Convergence for Information Technology
• /
• v.12 no.3
• /
• pp.38-45
• /
• 2022

Due to the development of fintech technology, financial transactions using smart phones are being activated. The password for user authentication during financial transactions is entered through the virtual keypad displayed on the screen of the smart phone. When the password is entered, the attacker can find out the password by capturing it with a high-resolution camera or spying over the shoulder. A virtual keypad with security applied to prevent such an attack is difficult to input on a small touch-screen, and there is still a vulnerability in peeping attacks. In this paper, the entire keypad is divided into several groups and displayed on a small screen, touching the group to which the character to be input belongs, and then touching the corresponding character within the group. The proposed method selects the group to which the character to be input belongs, and displays the keypad in the group on a small screen with no more than 10 keypads, so that the size of the keypad can be enlarged more than twice compared to the existing method, and the location is randomly placed, hence location of the touch attacks can be blocked.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2014.04a
• /
• pp.464-466
• /
• 2014

비밀번호를 비기술적인 방법으로 해킹 중 어깨넘어 훔쳐보기 공격은 사회공학적인 공격기법으로서 많은 보안 메커니즘의 등장에도 불구하고 원천적인 차단이 어려운 공격이다. 특히 현금자동입출기기는 개방적인 공간에 설치되어있어 어깨넘어 훔쳐보기 공격에 취약하다. 본 논문에서는 사용자가 금융서비스를 받고자 할 때, 현금자동입출기기, 스마트폰, 사용자 사이의 안전한 신뢰관계를 구축하고 비밀번호와 지문인식을 이용한 안전한 이중 사용자 인증 기법을 제안한다. 제안하는 기법은 어깨넘어 훔쳐보기 공격의 용이성 및 재현 가능성을 제한하여 안전한 금융서비스가 가능하도록 한다.