• Proceedings of the Korean Information Science Society Conference
• /
• 2004.10a
• /
• pp.445-447
• /
• 2004

네트워크 단위로 이동성을 제공하는 네트워크 이동성(NEtwork Mobility, NEMO)프로토콜에서 방문 네트워크(Visited Network)는 이동네트워크의 홈 네트워크(Home Network)를 통해 이동 네트워크(Mobile Network)를 인증한다. 안전한 인증이 이루어지기 위해서 홈 네트워크의 인증 서버와 이동 네트워크간의 사용할 키가 필요하게 된다. 그러나 두 엔터티간 키 협정을 위해 메시지를 주고받는 것은 서비스 에러나 공격에 취약하고 대역폭이나 밧데리 등이 제한적인 무선 환경에서는 적절하지 않다. 많은 키 결정 알고리즘에서 사용되는 공개 키 기반 알고리즘은 이런 무선 환경에 적절하지 않다. 또한 비밀키 선분배 방식은 인증 서버가 자신이 인증해야할 모든 노드와의 키 쌍을 가지고 있어야 한다는 정에서 확장성 문제를 지닌다. 이런 문제를 해결하기 위해, 본 논문에서는 회귀분석을 이용하여 쉽게 노드가 가지고 있는 키를 계산하고, 비밀키 인증서를 이용하여 간편하고 빠르게 인증을 수행할 수 있는 새로운 키 선분배 및 인증 메커니즘을 제안한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.12 no.4
• /
• pp.67-76
• /
• 2002

Kerberos is designed to provide strong authentication between client and application servers which are working in distributed network environment by using symmetric-key cryptography, and supposed to trust other systems of the realm. In this paper, we design an efficient and strong authentication mechanism by introducing the public/private-key to Kerberos. In the mechanism to make a system more secure, the value of the session key is changed everytime using MAC(message authentication code) algorithm with the long-term key for user-authentication and a random number exchanged through the public key. Also, we employ a mutual authentication method, which is used on challenge-response mechanism based on digital signatures, to improve trust between realms, and present a way of reducing the number of keys by simplifying authentication steps.

• The KIPS Transactions:PartC
• /
• v.11C no.4
• /
• pp.497-508
• /
• 2004

The existing wireless LAN standard IEEE802.11b has many vulnerabilities from security point of view. The authentication mechanisms in IEEE802.11b have many vulnerabilities. As a result to complement the weak of IEEE802.11b authentication, the IEEE802.1x had been developed in the sense of providing strong user authentication with appropriate mechanism. But this mechanism does not perform AP authentication and there are also some weak points. And in confidentiality and message Integrity case, WEP is weak from key stream reuse attack, IV reuse attack and so on. For that reason, in this paper we propose secure wireless LAN system. Our system provides strong user authentication, confidentiality, and message integrity based on existing IEEE802.1x framework and TLS.

• Journal of Internet Computing and Services
• /
• v.10 no.2
• /
• pp.53-63
• /
• 2009

e-Passport system is new type of emigration and immigration control system and it is a research to introduce the e-Passport Authentication Protocol with Improved Efficiency is lively proceeded over the entire world. The e-Passport's chip has a biometric information and personal identification information, Radio Frequency Identification(RFID) technology is used for communication with the Inspection System(IS). However, the feature of the RFID system may bring about various security threats such as eavesdropping, data forgeries, data alternation, cloning, biometric data-leakage. Therefore, in this paper, we analyse the e-Passport system's authentication protocol to protect vulnerability and proposed e-Passport system's authentication protocol reduce computation. Also, we compared their efficiency.

• Journal of the Institute of Electronics Engineers of Korea CI
• /
• v.48 no.2
• /
• pp.86-95
• /
• 2011

Sensor nodes in wireless sensor networks are vulnerable to security than wired network due to using limited hardware performance and wireless communications that network topology changes frequently. Among techniques to enhance the security, the node authentication mechanism is used to defend against data forgery attacks using the ID of the node or to interfere with the routing of the network routing. In this paper, we proposed the AM-E mechanism that makes authentication key by using the energy value of node requesting authentication and performs the communication procedures for data transfer between different nodes. Because the energy value of node is changed depending on time, every time the authentication request is, an authentication key is changed. These features enhance the security of sensor networks and will help to configure the more secure WSN.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2012.07a
• /
• pp.195-197
• /
• 2012

전자서명의 장기검증이란 서명에 사용된 인증서의 유효기간이 지난 오랜 후에 서명을 검증하고자 하는 문제이다. RFC3126에서는 전자서명의 장기검증을 가능하게 하기 위해 타임스탬프기관(TSA)에 대한 신뢰를 바탕으로 전자서명에 타임스탬프(TS)를 부가하여 장기검증포맷으로 변환하여 저장하는 방법을 제시하고 있는데 TSA의 인증서도 유효기간을 가지기 때문에 시간이 지날수록 새로운 TS를 계속 부가해야 한다는 단점이 있다. 한편 과거에 사용했던 인증서 및 CRL등의 인증체계 자체를 보존하고 인증해주기 위한 메커니즘은 인증체계의 연속성을 보장하기 위해 매우 중요하다고 볼 수 있는데, 현재의 공개키기반구조(PKI) 메커니즘에는 특별히 정의되어 있지 않다. 인증체계의 장기검증을 위해 RFC3126[1]의 방법론을 적용하는 것은 여러 가지 측면에서 효율적인 방법이 아니다. 이 논문에서는 인증체계의 과거역사를 보존하고 보증해주기 위한 새로운 방법을 제시하는데, 인증기관이 자신의 인증서를 갱신하는 경우 자신이 운영했던 과거의 인증역사에 대해 봉인을 하고 책임있는 사후서비스를 하도록 하며, 현재의 인증서에 과거역사에 대한 명시적인 인증을 포함하도록 하는 것이다. 이러한 방법은 기존의 인증체계와 함께 이용될 수 있고 인증체계의 연속성을 보장하는데 큰 역할을 하게 되며 전자서명 장기검증에도 유용하게 이용될 수 있음을 보인다.

• Journal of the Korea Computer Industry Society
• /
• v.2 no.12
• /
• pp.1541-1548
• /
• 2001

In this paper, We propose a new Kerberos certification mechanism that improve certification service based on PKINIT that announce in IETF CAT Working Group. Certification between area connected by chain through PKINIT that use X.509 and DS/DNS mutually for service. In order to provide regional services used private key and public key, X.509 of PKINIT is employed on session part and Kerberos's private key on actual authentication part. New mechanism be reduced communication overload doing to simplify certification formality between Client and remote KDC by KDC's certificate use to get ticket in remote sacred ground and remote KDC's reaffirmation process omitted.

• Journal of KIISE:Computer Systems and Theory
• /
• v.36 no.5
• /
• pp.387-395
• /
• 2009

The establishment of security architecture is essential because security vulnerabilities occur such as user's unjustifiable connection for the opened gateway and access to resources without permission in OSGi service platform environment. In this paper, it proposes a authentication technique for an Automatic user authentication which is used the Symmetric Key and the Service bundle authentication to consider the constraints of the hardware in the OSGi service platform environment. Typically, the type of entering a password is used for the user authentication mechanism however OSGi platform environment studies not entering the password but using MAC address and encrypted identifier of the automatic user authentication mechanism because the devices are limited in their input. In this paper, the Symmetric Key is used for bundle authentication mechanism. Therefore operation becomes quick and secure authentication process has been successfully completed by using the time data and a ticket which contains a license. Based on these two different authentication mechanisms, it could eliminate the constraints of resources and improve the convenience of users and administrators. Also it shows an effect from omitting the waiting time to enter a password and reducing operations which need for authentication in the OSGi service platform environment.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.46 no.8
• /
• pp.22-33
• /
• 2009

Mobile Ad Hoc Networks (MANETs) are self-organized networks that do not rely in their operation on wired infrastructure. As in any networking technology, security is an essential element in MANET as well, for proliferation of this type of networks. But supporting secure communication in MANETs proved to be a significant challenge, mainly due to the fact that the set of nodes in the network can change frequently and rapidly and due to the lack of access to the wired infrastructure. In particular, the trust model and the authentication protocols, which were developed for wired and infrastructure-based networks, cannot be used in MANETs. In [1], we addressed the problem of efficient authentication of distributed mobile users in geographically large networks and proposed a new authentication scheme for this case of MANETs. The proposed scheme exploits randomized groups to efficiently share authentication information among nodes that together implement the function of a distributive Certification Authority(CA). In this paper, we analyze numerically the performance of authentication method using randomized groups and compare with the simulation result.

• Journal of the Korea Society of Computer and Information
• /
• v.11 no.3
• /
• pp.57-66
• /
• 2006

In this paper. proposes Multi_Kerberos certification mechanism that improve certification service of based on PKINIT that made public in IETF CAT Working Group. This paper proposed to a certificate other realm because search position of outside realm through DNS and apply X.509 directory certification system, to get public key from DNS server by chain (CertPath) between realms by certification and key exchange way that provide service between realms applying X.509, DS/DNS of based on PKINIT, in order to provide regional services. This paper proposed mechanism that support efficient certification service about cross realm including key management. the path generation and construction of Certificate using Validation Server, and recovery of Session Key. A Design of Multi_Kerberos system that have effects simplify of certification formality that reduce procedures on communication.