• 디지털산업정보학회논문지
• /
• 제10권1호
• /
• pp.81-87
• /
• 2014

Password-based authentication using smart card provides two factor authentications, namely a successful login requires the client to have a valid smart card and a correct password. While it provides stronger security guarantees than only password authentication, it could also fail if both authentication factors are compromised ((1) the user's smart card was stolen and (2) the user's password was exposed). In this case, there is no way to prevent the adversary from impersonating the user. Now, the new technology of biometrics is becoming a popular method for designing a more secure authentication scheme. In terms of physiological and behavior human characteristics, biometric information is used as a form of authentication factor. Biometric information, such as fingerprints, faces, voice, irises, hand geometry, and palmprints can be used to verify their identities. In this article, we review the biometric-based authentication scheme by Cheng et al. and provide a security analysis on the scheme. Our analysis shows that Cheng et al.'s scheme does not guarantee any kind of authentication, either server-to-user authentication or user-to-server authentication. The contribution of the current work is to demonstrate these by mounting two attacks, a server impersonation attack and a user impersonation attack, on Cheng et al.'s scheme. In addition, we propose the enhanced authentication scheme that eliminates the security vulnerabilities of Cheng et al.'s scheme.

• 디지털산업정보학회논문지
• /
• 제11권1호
• /
• pp.59-67
• /
• 2015

A novel authentication mechanism is biometric authentication where users are identified by their measurable human characteristics, such as fingerprint, voiceprint, and iris scan. The technology of biometrics is becoming a popular method for engineers to design a more secure user authentication scheme. In terms of physiological and behavioral human characteristics, biometrics is used as a form of identity access management and access control, and it services to identity individuals in groups that are under surveillance. In this article, we review the biometric-based authentication protocol by Althobati et al. and provide a security analysis on the scheme. Our analysis shows that Althobati et al.'s scheme does not guarantee server-to-user authentication. The contribution of the current work is to demonstrate this by mounting threat of data integrity and bypassing the gateway node on Althobati et al.'s scheme. In addition, we analysis the security vulnerabilities of Althobati et al.'s protocol.

• International Journal of Internet, Broadcasting and Communication
• /
• 제8권3호
• /
• pp.41-49
• /
• 2016

Recently, many biometrics-based user authentication schemes for telecare medicine information systems (TMIS) have been proposed to improve the security problems in user authentication system. In 2014, Mishra et al. proposed an improvement of Awasthi-Srivastava's biometric based authentication for TMIS which is secure against the various attacks and provide mutual authentication, efficient password change. In this paper, we discuss the security of Mishra et al.'s authentication scheme, and we have shown that Mishra et al.'s authentication scheme is still insecure against the various attacks. Also, we proposed the improved scheme to remove these security problems of Mishra et al.'s authentication scheme, even if the secret information stored in the smart card is revealed. As a result, we can see that the improved biometric based authentication scheme is secure against the insider attack, the password guessing attack, the user impersonation attack, the server masquerading attack and provides mutual authentication between the user and the telecare system.

• 한국멀티미디어학회논문지
• /
• 제10권12호
• /
• pp.1655-1662
• /
• 2007

Although the PKl-based user authentication solution has been widely used, the security of it can be deteriorated by a simple password. This is because a long and random private key may be protected by a short and easy-to-remember password. To handle this problem, many biometric-based user authentication solutions have been proposed. However, protecting biometric data is another research issue because the compromise of the biometric data will be permanent. In this paper, we present an implementation to improve the security of the typical PKI-based authentication by protecting the private key with a fingerprint. Compared to the unilateral authentication provided by the typical biometric-based authentication, the proposed solution can provide the mutual authentication. In addition to the increased security, this solution can alleviate the privacy issue of the fingerprint data by conglomerating the fingerprint data with the private key and storing the conglomerated data in a user-carry device such as a smart card. With a 32-bit ARM7-based smart card and a Pentium 4 PC, the proposed fingerprint-based PKI authentication can be executed within 1.3second.

• 한국통신학회논문지
• /
• 제40권1호
• /
• pp.132-141
• /
• 2015

기존의 단일 생체인증 방법들은 인식과 식별이 주 용도이며 서비스 용도별 실시간 개인 인증보안은 취약하다. 이에 다중 생체인식기반의 실시간 입증 및 인증 기술을 통해 보안성능을 향상시키는 방법의 연구와 개발이 필수적이다. 본 논문은 생체인식기술의 다중 생체인식 파라미터를 조합하여 인증하는 선진 기술 및 특허동향 분석을 통해 국내 기술개발 전략과 과제를 제시하는데 중점을 둔다.

• Journal of Information Technology Applications and Management
• /
• 제27권2호
• /
• pp.1-21
• /
• 2020

The purpose of this study is to investigate the behavioral factors affecting the security attitude and intention to use biometrics password based on the protection motivation theory. This study also investigates security awareness training to understand trust, privacy, and security vulnerability regarding biometric authentication password. This empirical analysis reveals security awareness training boosts the protection motivational factors that affect on the behavior and intention of using biometric authentication passwords. This study also indicates that biometric authentication passwords can be used when the overall belief in a biometric system is present. After all, security awareness training enhances the belief of biometric passwords and increase the motivation to protect security threats. The study will provide insights into protecting security vulnerability with security awareness training.

• 한국융합학회논문지
• /
• 제7권1호
• /
• pp.49-55
• /
• 2016

대리 인증은 제 3자에게 자신의 인증 정보를 제공하여 본인 대신 인증을 받도록 하는 것으로, 패스워드와 같이 내가 기억하는 것에 기반을 둔 인증 방법은 이러한 공격에 취약하다. 바이오메트릭 인증은 사람마다 고유한 바이오메트릭 데이터를 이용하기 때문에 대리 인증의 위험을 최소화할 수 있다. 그룹 인증은 그룹 멤버들이 해당 그룹에 속해 있음을 증명하는 것이다. 전자투표, 모바일 회의와 같이 멤버의 수가 동적으로 변하는 응용에서는 그룹 상태의 변화를 실시간으로 반영하는 새로운 인증 기법이 필요하다. 본 논문에서는 바이오메트릭 인증 기반의 동적 그룹 서명 기법을 제안한다. 제안한 기법은 바이오메트릭 키 생성, 그룹 공통키 생성, 그룹 서명 생성, 그룹 서명 검증 그리고 멤버 업데이트 프로토콜로 구성된다. 제안한 멤버 업데이트 프로토콜은 기존 멤버의 공모 공격으로부터 안전하고 그룹 상태를 실시간으로 반영한다.

• Journal of Multimedia Information System
• /
• 제3권2호
• /
• pp.13-20
• /
• 2016

Biometric authentication for account-based mobile payment continues to gain attention because of improvements on sensors that can collect biometric information. We propose an enhanced method for mobile payment security based on biometric authentication. In this mobile payment system, the communication between the user and the relying party is based on public key infrastructure. This method secures both the key and the biometric template in the user side using fuzzy vault biometric cryptosystems, which is based on non-random chaff point generator. In this paper, we consider an important process for the common fuzzy vault system, that is, the feature extraction method. We evaluate various feature extraction methods to enhance the accurate performance of the system.

• 정보보호학회논문지
• /
• 제26권1호
• /
• pp.69-79
• /
• 2016

생체 정보를 이용한 사용자 인증은 사용자가 어떠한 정보도 소유하거나 기억할 필요가 없으므로 사용자 측면에서 매우 편리하다. 그러나 생체 정보는 한번 노출되면 영구적으로 사용할 수 없기 때문에 인증 수행 시 생체 정보의 프라이버시 보호가 필수적이다. 또한 생체 정보는 본질적으로 노이즈가 있기 때문에 인증 수행 시 적절한 오차 범위 이내에서 이를 처리할 수 있어야 한다. 최근 퍼지 추출기(fuzzy extractor)를 이용한 생체 정보 기반 인증 프로토콜에 대한 연구가 활발히 진행되고 있으나, 사용자가 헬퍼 데이터(helper data)를 추가적으로 기억해야 하는 문제점이 존재한다. 본 논문에서는 함수 암호 중 하나인 HV-KEM(Hidden Vector Key Encapsulation Mechanism)을 이용하여 사용자가 어떠한 정보도 소유하거나 기억할 필요 없는 생체 정보 기반 인증 프로토콜을 제안한다. 또한, 인증 프로토콜 설계를 위한 HV-KEM의 보안 요구사항을 정립하고 제안하는 인증 프로토콜을 정확성/안전성/효율성 측면에서 분석한다.

• International Journal of Computer Science & Network Security
• /
• 제21권11호
• /
• pp.321-327
• /
• 2021

Mobile devices have recently developed to be an integral part of humans' daily lives because they meet business and personal needs. It is challenging to design a feasible and effective user authentication method for mobile devices because security issues and data privacy threats have significantly increased. Biometric approaches are more effective than traditional authentication methods. Therefore, this paper aims to analyze the existing biometric user authentication methods on mobile platforms, particularly those that use face recognition, to demonstrate the methods' feasibility and challenges. Next, this paper evaluates the methods according to seven characteristics: universality, uniqueness, permanence, collectability, performance, acceptability, and circumvention. Last, this paper suggests that solely using the method of biometric authentication is not enough to identify whether users are authentic based on biometric traits.