• Journal of the Korea Society of Computer and Information
• /
• v.16 no.3
• /
• pp.251-260
• /
• 2011

In this paper, we proposed a scheme that it safely exchanges encrypted keys without Trust Third Party (TTP) and Pre-distributing keys in multi-hop clustering sensor networks. Existing research assume that it exists a TTP or already it was pre-distributed a encrypted key between nodes. However, existing methods are not sufficient for USN environment without infrastructure. Some existing studies using a random number Diffie-Hellman algorithm to solve the problem. but the method was vulnerable to Replay and Man-in-the-middle attack from the malicious nodes. Therefore, authentication problem between nodes is solved by adding a ��TESLA. In this paper, we propose a modified Diffie-Hellman algorithm that it is safe, lightweight, and robust pair-wise agreement algorithm by adding One Time Password (OTP) with timestamp. Lastly, authentication, confidentiality, integrity, non-impersonation, backward secrecy, and forward secrecy to verify that it is safe.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2006.06a
• /
• pp.171-175
• /
• 2006

Diffie-Hellman기반 키 합의 프로토콜들은 비교적 고비용의 연산인 지수연산으로 인해, 유선 네트워크 환경에 비해 저전력이고 컴퓨팅 자원이 제한되어 있는 무선 네트워크 환경에서는 비효율적이고 구현하기 어려운 문제가 있다. 이에 Yang등은 대리서버(Proxy Server)를 이용하여 Diffie-Hellman방식을 적용하면서도 단말 무선 네트워크 사용자의 지수연산부담을 감소시키는 효율적인 키 합의 프로토콜(이하 SEKAP)을 제안하였다. 그러나 SEKAP는 재전송공격(Replay Attack), 알려지지 않은 키 공유 공격(Unknown Key Share Attack), 그리고 키 노출로 인한 위장공격(Key Compromised Impersonation Attack) 등에 취약하며 전방향 안전성(Forward Secrecy)을 제공하지 못한다. 본 논문에서는 SEKAP가 위 공격들에 대해 취약함을 보이고, 세션키의 상호인증을 추가한 개선된 프로토콜을 제안한다.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.12 no.12
• /
• pp.5895-5901
• /
• 2011

This paper shows that a scheme provided by An[7] is not enough to satisfy security requirements for a user certification using a password-based smart card. In order to compensate this weakness, this study provides an improved user scheme with a hash function and ElGamal signature. This new scheme has some advantages protecting password guessing attack, masquerade, and replay attack as well as providing forward secrecy. Compared to An's certification scheme, this scheme suggests that the effect of computational complexity is similar but the efficiency of safety is better.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.14 no.1
• /
• pp.147-153
• /
• 2014

The numerous improved schemes of remote user authentication based on password have been proposed in order to overcome the security weakness in user authentication process. Recently, some of biometric-based user authentication schemes to use personal biometric information have been introduced and they have shown the relatively higher security and the enhanced convenience as compared to traditional password-based schemes. These days wireless sensor network is a fundamental technology in face of the ubiquitous era. The wireless sensor networks to collect and process the data from sensor nodes in increasing high-tech applications require important security issues to prevent the data access from the unauthorized person. Accordingly, the research to apply to the user authentication to the wireless sensor networks has been under the progress. In 2010, Yuan et al. proposed a biometric-based user authentication scheme to be applicable for wireless sensor networks. Yuan et al. claimed that their scheme is effectively secure against the various security flaws including the stolen verifier attack. In this paper, author will prove that Yuan et al.'s scheme is still vulnerable to the password guessing attack, user impersonation attack and the replay attack, by analyzing their security weakness.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.3 no.4
• /
• pp.376-384
• /
• 2009

In this article, we demonstrate that the asymmetric key-based architecture for securing wireless sensor networks recently introduced by Haque et al. is insecure under impersonation attack, since it does not provide authentication semantics. In addition, we show that, for the scheme to work correctly, the resulting key distribution construction should be symmetric and group-wise.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.13 no.1
• /
• pp.69-78
• /
• 2017

As the smartphone-based devices are diffused and developed rapidly, they provide the convenience to the users. The abovementioned sentence technologies are being used not only in the existing sensor and wireless network technology but also in the application services of the diverse fields application services such as smart appliance, smart car, smart health care, etc. and the new fusion paradigm from the industry is presented by undertaking the researches in diverse area by the enterprises and research institutions. However, the smart environment exposes its weaknesses in the mobile terminal area, existing wireless network and IT security area. In addition, due to new and variant ways of attack, not only the critical information are disclosed However also the financial damages occur. This paper proposed the protocol to perform the smartphone-based safe device monitoring and safe communication. The proposed protocol designed the management procedure of registration, identification, communication protocol and device update management protocol and the safety against the attack techniques such as the an-in-the-middle-attack, impersonation attack, credential threat, information leaks and privacy invasion was analyzed. It was observed that the proposed protocol showed the performance improved by approximately 52% in the communication process than the existing system.

• Journal of KIISE:Computer Systems and Theory
• /
• v.36 no.4
• /
• pp.304-310
• /
• 2009

Due to widely use of internet, a lot of users frequently access into remote server in distributed computing environment. However, transmitting the information using vulnerable channel without authentication security system can be exposed to replay attack, offline password attack, and impersonation attack. According to this possibility, there is research about authentication protocol to prevent these hostile attacks using smart card. In this paper, we analyze vulnerability of user authentication system based on password and propose modified user authentication system.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2003.11c
• /
• pp.1759-1762
• /
• 2003

최근 키 분배 프로토콜과는 다르게 하드웨어에 암호키를 저장하여 사용하는 것과 달리, 사용자가 기억할 수 있는 길이의 패스워드(password)를 사용해 서버와의 인증과 키 교환을 동시에 수행하는 패스워드 기반 키 분배 프로토콜이 제안되고 있다. 본 논문에서는 이러한 패스워드 기반의 키 분배 프로토콜 중 BPKA(Balanced Password-authenticated Key Agreement)에 속하는 DH-EKE(Diffie-Hellman Encrypted Key Exchange), PAK(Password-Authenticated Key exchange), SPEKE(Simple Password Exponential Key Exchange) 프로토콜을 비교 분석하고, 이를 바탕으로 기존의 BPKA 프로토콜에 비해 적은 연산량을 가지면서 사용자와 서버가 각기 다른 정보를 갖는 패스워드-검증자 기반 프로토콜을 제안한다. 본 논문에서 제안하는 패스워드 기반 키 분배 프로토콜의 안전성 분석을 위해 Active Impersonation 과 Forward Secrecy, Off-line dictionary attack, Man-in-the -middle Attack 등의 공격모델을 적용하였다.

• Journal of Digital Convergence
• /
• v.15 no.10
• /
• pp.253-260
• /
• 2017

Authenticated key agreement in multi-server environments is one of very important security issues because only authorized user needs to access their data and services. To support this issue, numerous schemes have been proposed over recent years. Recently, Shin showed the security weaknesses in the previous scheme and proposed an improved scheme called SIAKAS to solve them. Unfortunately, this paper shows that SIAKAS is still weak against application server impersonation attack and could be traceable to attackers. To solve the problems in SIAKAS, we propose an untraceable authenticated key agreement scheme, denoted by UAKAS. UAKAS efficiently solves security and privacy issues in SIAKAS and the related schemes and could reduce the operation overhead at least 12% compared to them.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.21 no.2
• /
• pp.322-332
• /
• 2017

Wireless Body Area Networks is an environment that provides an appropriate service remotely by collecting user's biometric information. With the growing importance of sensor, WBAN also attracts extensive attention. Since WBAN is representatively used in the medical field, it can be directly related to the patient's life. Hence security is very important in WBAN. Mutual authentication between the client and the application provider is essential. And efficiency is also important because a used device is limited to computation cost. In this reason, ID-based anonymous authentication scheme in WBAN has been intensively studied. We show that the recent research result of Wu et al. which is about the ID-based anonymous authentication scheme is vulnerable to impersonation attack. And we propose a new ID-based anonymous authentication scheme that is secure against the attacks discovered in the existing schemes. Compared to the existing schemes, the computation cost of our scheme is improved by 30.6% and 7.3%.