• Journal of KIISE:Computer Systems and Theory
• /
• v.35 no.7
• /
• pp.332-339
• /
• 2008

Radio Frequency Identification (RFID) technology is an important part of infrastructures in ubiquitous computing. Although all products using tags is a target of these services, these products also are a target of attacking on user privacy and services using authentication problem between user and merchant, unfortunately. Presently, it is very important about security mechanism of RFID system and in this paper, we analyze the security protocol among many kinds of mechanisms to solve privacy and authentication problem using formal verification and propose a modified novel protocol. In addition, the possibility of practical implementation for proposed protocol will be discussed.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2009.04a
• /
• pp.1459-1462
• /
• 2009

최근 Yang과 An은 기존의 RFID 인증 메커니즘들이 가지고 있는 프라이버시 침해 문제를 분석하고 보다 안전하고 효율적인 사용자의 프라이버시를 보호할 수 있는 RFID(YA-RFID) 인증 프로토콜을 제안하였다. 그들은 제안한 YA-RFID 인증 프로토콜이 공격자의 재전송 공격, 스푸핑 공격, 그리고 위치 트래킹 공격에 대해 안전하다고 주장하였다. 하지만 본 논문에서는 그들의 주장과는 달리 YA-RFID 프로토콜이 여전히 위치 트래킹 공격에 취약함을 증명하며, 더 나아가 동일한 연산 효율성을 보장하며 위치 트래킹 공격을 막을 수 있는 간단히 개선된 일회성 난수와 안전한 일방향 해쉬 함수 기반의 RFID 인증 프로토콜을 제안한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2007.05a
• /
• pp.1064-1065
• /
• 2007

본 연구는 모바일 디바이스가 홈 인증 서버로부터 인증을 받고 난 후에 외부 네트워크로 이동하더라도 홈 인증 서버로부터 발급받은 티켓을 이용하여 홈 인증 서버로 접근 하지 않고 외부 네트워크에서의 인증을 제공하여 서비스를 받을 수 있게 한다. 본 방식은 ID기반 티켓을 사용함으로써 정당한 사용자만이 서비스를 제공받을 수 있고 교환되는 메시지 및 지연을 줄이며 지속적인 서비스를 제공받을 수 있어 안전성과 효율성을 높일 수 있다

• The KIPS Transactions:PartC
• /
• v.17C no.4
• /
• pp.361-370
• /
• 2010

OTP(One Time Password) is a user authentication using secure mechanism to authenticate each other in a way to generate a password, an attacker could intercept the password to masquerade as legitimate users is a way to prevent attacks. The OTP can be implemented as H/W or S/W. Token and card type OTP, implemented as H/W, is difficult to popularize because of having problem with deployment and usability. As a way to replace it implemented as S/W on Mobile or PC is introduced. However, S/W products can be target of malicious attacks if S/W products have vulnerability of implementation. In fact, FSA said the OTP implemented on a mobile have vulnerability of implementation. However, the OTP implemented on a PC have no case about analysis of vulnerability. So, in this paper derive security review and vulnerabilities analysis of implemented on a PC.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2021.11a
• /
• pp.359-362
• /
• 2021

자기 주권 신원 증명 기술인 DID가 강력한 인증 수단으로 떠오르고 있다. 이런 DID 기술을 사용한 DIDComm은 중앙을 거치지 않는, 사용자끼리의 통신(P2P)을 가능하게 만들어 주며, 이는 강력한 보안을 제공해 준다. 본 글은 DIDComm 기술을 활용한 P2P 메신저에 대해 작성하였다. 이를 활용한 메신저는 사용자 간의 높은 보안을 가진 통신을 제공해 줄 수 있으며 앞으로의 인터넷 시대, 메타버스 시대에서 주목할 만한 기술이다.

• Convergence Security Journal
• /
• v.8 no.1
• /
• pp.35-42
• /
• 2008

While an information system and administration for an application that a user contacts with raise a head by an important problem, a system approach and methodology for administration are mentioned. Authentication technology of various configuration is used, but non-efficiency by complicated authentication administration and operation inappropriate use are for a successful expansion of various and new business of wire/wireless environment. In addition, under the mobile computer environment with different authentic method each other, it is difficult at all to expect flexible and continuous service. Under the ubiquitous computing environment, It is very important thing plan to research and develop compatibility and the side of variance authentication plan that preservation characteristics are helped. Hereby, This paper look around an requirement items and authority mechanism for the administration and the operation mechanism of the distributed authentication considering expansion possibility of the ubiquitous computing environment not only fixed computing environment but also mobile computing. In future, we expect it by can guide positive participation about distributed authentication technique of the genuine ubiquitous environment.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.43 no.11 s.353
• /
• pp.159-167
• /
• 2006

IEEE 802.11i standard specifies full authentication and preauthentication for secure handoff in 802.11 wireless LAN (WLAN). However, the full authentication is too slow to provide seamless services for handoff users, and preauthentication may fail in highly populated WLAN where it is highly probable that the cache entry of a preauthenticated user is evicted by other users before handoff. In this paper, we propose a fast and secure handoff scheme by reducing authentication and key management delay in the handoff process. When a user handoffs, security context established between the user and the previous access point (AP) is forwarded from the previous AP to the current AP, and the session key is reused before the handoff session terminates. The freshness of session key is maintained by regenerating session keys after handoff session is terminated. The proposed scheme can achieve considerable reduction in handoff delay with providing the same security level as 802.1X authentication by letting an AP authenticate a handoff user before making an robust security network association (RSNA) with it.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.6
• /
• pp.67-75
• /
• 2003

The development of mobile phone is growing fast in the all over the world. Besides the basic voice communication, many multimedia services and global roaming service are capable in the 3rd generation mobile telecommunication. Because mobile phone has been the essential tool to communicate, the protection of privacy and the safe transmission are critical ones. In synchronous, asynchronous mode IMT2000 service, the mechanism of mutual authentication and generation of cipher key and integrity key are implemented in smart card chip called UIM, USIM. In this paper, we describe the authentication mechanism of 3GPP and 3CPP2 and its implementation results. Then, we specify a few problems which are not defined in standard.

• Journal of KIISE
• /
• v.42 no.1
• /
• pp.23-32
• /
• 2015

In the Android market, a large portion of the market share consists of third party applications, but not much research has been performed in this respect. Of these applications, mobile Voice Over IP (VoIP) applications are one of the types of applications that are used the most. In this paper, we focus on user authentication methods for three representative applications of the Google Voice service, which is a famous mobile VoIP application. Then, with respect to the Android file system, we developed a method to store and to send user information for authentication. Finally, we demonstrate a vulnerability in the mechanism and propose an improved mechanism for user authentication by using hash chaining and an elliptic curve Diffie-Hellman key exchange.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.42 no.11
• /
• pp.27-34
• /
• 2005

Mobile Ad Hoc Networks (MANETs) are self-organized networks that do not rely in their operation on wired infrastructure. As in any networking technology, security is an essential element in MANET as well, for proliferation of this type of networks. But supporting secure communication in MANETs proved to be a significant challenge, mainly due to the fact that the set of nodes in the network can change frequently and rapidly and due to the lack of access to the wired infrastructure. In particular, the trust model and the authentication protocols, which were developed for wired and infrastructure-based networks, cannot be used in MANETs. In this paper, we address the problem of efficient authentication of distributed mobile users in geographically large networks. In particular, we propose a new authentication scheme for this case of MANETs. The proposed scheme exploits Randomized Groups to efficiently share authentication information among nodes that together implement the function of a distributive Certification Authority (CA). We then evaluate the performance of authentication using Randomized Groups.