• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.5
• /
• pp.181-195
• /
• 2011

There's a controversy about an invasion of privacy which includes a leakage of private information and linking of user's behavior on internet. Although many solutions for this problem are proposed, we think anonymous authentication, authorization, and payment mechanism is the best solution for this problem. In this paper, we propose an effective anonymity-based method that achieves not only authentication but also authorization. Our proposed method uses anonymous qualification certificate and group signature method as an underlying primitive, and combines anonymous authentication and qualification information. An eligible user is legitimately issued a group member key pair through key issuing process and issued some qualification certificates anonymously, and then, he can take the safe and convenience web service which supplies anonymous authentication and authorization. The qualification certificate can be expanded according to application environment and it can be used as payment token.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.13 no.12
• /
• pp.6071-6080
• /
• 2012

Regarding the official authentication method which is a strong encrypt method for financial transactions, there has recently been a concern for the problem of storage. As a solution for such problems, this study provides the anonymous authentication method based on the smart card used for such a purpose by utilizing the pseudo ID replacing the user's personal data. Such an anonymous authentication method makes it possible to prevent any inside leakage, intermediary attack, limited re-transmission attack, service-denying attack, directional safety attack and secret inspector attack in regard to the user's personal data. As a result, there would be no concern for the leakage of any personal data. In comparative analysis, after executing the comparison and analysis process through the experiment for the authentication process by using the previously-used smart card, the new one has shown about 10% a high level of efficiency for the encrypt and decrypt process together with excellent features in terms of flexibility in regard to the user's anonymity and tracking ability.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.13 no.9
• /
• pp.4214-4223
• /
• 2012

The argument related to the use of real and anonymous names on the Internet bulletin board has recently become a main issue. When using real names, it is possible to violate free discussion and privacy. Also, when using anonymous names, it is possible to have the reverse function of the Internet in regard to the use of malicious replies or the distribution of false ideas. Therefore, this paper has made it possible to prevent the spread of the user's personal information and execute the single log-in process by using the XML-token method which is one of the SSO technologies. Also, by issuing virtual IDs and forming the path when establishing tokens, the anonymous bulletin board which provides anonymity with a conditional tracing process has been suggested. After analyzing the performance of visitor numbers at authentication time, the anonymous bulletin board based on the group signature method showed the average response rate of 0.72 seconds, 0.18 seconds, which was suggested scheme. In the authentication time 4-5 times faster response speed, respectively. Also, since the suggested system does not have to provide a single authentication process or make the user provide his or her signature, the level of user's convenience seems to be much higher. Such a result shows that the system suggested on the anonymous bulletin board has a more appropriate level of user's convenience.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.6 no.1
• /
• pp.115-129
• /
• 2010

As the fixed mobile communication tools using the internet are developed, the off-line services are serviced through on-line on the internet. our society is divided into the real world and the cyber world. In the cyber world, the authentication to the user is absolutely required. The authentication is divided into the real-name authentication and the anonymous authentication by the kind of the internet service provider. There are some ISPs needed the real-name authentication and there are others ISPs needed the anonymity authentication. The research about the anonymity authentication is steadily established to these days. In this paper, we analyze the problem about blind signature, group signature, ring signature, and traceable signature. And we propose a method of anonymity authentication using the public certificate. In the proposal, the anonymity certificate have the new structure and management. Certificate Authority issues several anonymity certificates to a user through the real-name authentication. Several anonymity certificates give non-linked and non-traceability to the attacker.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.17 no.10
• /
• pp.2309-2315
• /
• 2013

VANET(Vehicular Ad-hoc Network) is getting attention as an application to improve driver safety through inter-vehicle communication. For activation of VANET, privacy-preserving mutual authentication has to be guaranteed. In previous works, authors proposed various group-based authentication protocols. However, risks on ID exposure due to repeated use of group key and RSU(Road Side Unit) DoS attack were not considered. In this paper, we propose a probabilistic approach for robust anonymous authentication protocol. We evaluated our proposed method in a sets of criteria in VANET and verified it is an efficient solution for enhancing privacy.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.11 no.7
• /
• pp.3720-3746
• /
• 2017

At present, numerous hospitals and medical institutes have implemented Telecare Medicine Information Systems (TMIS) with authentication protocols to enable secure, efficient electronic transactions for e-medicine. Numerous studies have investigated the use of authentication protocols to construct efficient, robust health care services, and recently, Liu et al. presented an authenticated key agreement mechanism for TMIS. They argued that their mechanism can prevent various types of attacks and preserve a secure environment. However, we discovered that Liu et al.'s mechanism presents some vulnerabilities. First, their mechanism uses an improper identification process for user biometrics; second, the mechanism is not guaranteed to protect against server spoofing attacks; third, there is no session key verification process in the authentication process. As such, we describe how the above-mentioned attacks operate and suggest an upgraded security mechanism for TMIS. We analyze the security and performance of our method to show that it improves security relative to comparable schemes and also operates in an efficient manner.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.29 no.7C
• /
• pp.997-1006
• /
• 2004

The rapid expansion of the Internet has provided users with a diverse range of services. Most Internet users create many different IDs and passwords to subscribe to various Internet services. Thus, the SSO system has been proposed to supplement vulnerable security that may arise from inefficient management system where administrators and users manage a number of ms. The SSO system can provide heightened efficiency and security to users and administrators. Recently commercialized SSO systems integrate a single agent with the broker authentication model. However, this hybrid authentication system cannot resolve problems such as those involving user pre-registration and anonymous users. It likewise cannot provide non-repudiation service between joining objects. Consequently, the hybrid system causes considerable security vulnerability. Since it cannot provide security service for the agent itself, the user's private information and SSO system may have significant security vulnerability. This paper proposed an authentication model that integrates a broker authentication model, out of various authentication models of the SSO system, with a multi-agent system. The proposed method adopts a secure multi-agent system that supplements the security vulnerability of an agent applied to the existing hybrid authentication system. The method proposes an SSO authentication model that satisfies various security requirements not provided by existing broker authentication models and hybrid authentication systems.