Earticle

This study analyzed the security architecture of an RFID authentication protocol using Elliptic Curve Cryptography (ECC), identified potential vulnerabilities, and proposed improvement measures. Our study enhanced security by introducing random number combination-based signature verification, session-independent key derivation, dual hash binding, and an authentication delay mitigation structure. Simulation results showed the proposed model achieved 100% replay detection rate, kept authentication delay within 12%, and improved computational complexity by approximately 18%.

This study critically analyzed a lightweight ECC-based three-factor authentication protocol designed for IoT-enabled e-Health cloud systems. Through adversarial modeling and formal verification, three core vulnerabilities were identified: static identity inference via XOR-cancellation across sessions, ephemeral key reuse leading to session key replay, and insufficient biometric template binding enabling cross-system correlation. Countermeasures proposed include dual-nonce ephemeral key diversification, salted fuzzy extractor-based biometric binding, dual-ephemeral Diffie–Hellman key exchange for forward secrecy, and a permissioned blockchain audit layer. Simulation results on Raspberry Pi 4 and Intel i5 demonstrate 100% replay detection, per-session forward secrecy, eliminated biometric linkability, and end-to-end latency increase within 6.7%, confirming suitability for resource-constrained IoT healthcare deployments.

IoT에서 무선 센서 네트워크는 데이터를 실시간으로 수집하고 전송하는 중요한 역할을 한다. 무 선 센서 네트워크는 소형의 센서 노드들이 무선 통신을 통해 상호 연결되어 데이터를 수집하고 전송하 는 형태의 네트워크이다. 이러한 무선 센서 네트워크는 센서 노드를 주로 응용 환경에 배치하고, 자율 적으로 네트워크를 형성한 후, 센서 노드로부터 얻은 물리적 정보들을 무선으로 수집하여 감시, 제어 등의 용도로 활용하는 기술이다. 하지만 센서 노드는 무선 통신을 사용하기 때문에 공격자가 도청, 중 간자 공격 등을 사용해서 센서 노드에서 데이터를 가져갈 수 있다. 따라서 무선 센서 네트워크의 사용 자 인증 및 키 합의 프로토콜은 중요한 연구 분야이다. 본 논문에서는 Tyagi 등이 제안한 무선 센서 네 트워크의 취약점을 보완한 인증 방식을 제안하고, 이에 대한 보안 분석을 한 결과 Stolen smart card attack, Offline password guessing attack, Identity guessing attack, Insider attack, User forgery attack 등 여러 공격에 안전하고, 제안한 프로토콜은 계산 비용, 통신 비용 측면에서도 효율적이다.

In IoT, Wireless Sensor Networks (WSNs) play a crucial role in the real-time collection and transmission of data. A wireless sensor network is a network in which small sensor nodes are interconnected through wireless communication to collect and transmit data. This wireless sensor network is a technology primarily deployed by situating sensor nodes in various application environments. After autonomously forming a network, it collects physical information wirelessly from sensor nodes and utilizes it for purposes such as monitoring and control. However, since sensor nodes use wireless communication, attackers can potentially eavesdrop on or intercept data from sensor nodes using methods such as man-in-the-middle attacks. Therefore, user authentication and key agreement protocols in wireless sensor networks stand out as crucial areas of research. In this paper, we propose an authentication method that addresses vulnerabilities identified by Tyagi et al. in wireless sensor networks. The security analysis results demonstrate that the proposed protocol is resilient against various attacks, including stolen smart card attack, offline password guessing attack, identity guessing attack, insider attack, and user forgery attack. Furthermore, the proposed protocol proves to be efficient in terms of computational and communication costs.

최근 센서를 이용한 장치들의 사용은 증가추세이다. 이런 센서 장치들은 이종무선 센서네트워크 환경에서 최신 기술 들과 연관 지어 폭발적으로 증가하고 있다. 이런 환경에서 센서디바이스의 사용은 우리에게 편리함을 제공하기는 하나 여러 형태의 보안위협이 도사리고 있는 실정이다. 무선선서네트워크를 이용하여 원격으로 접속하여 제공받는 서비스에 존재하는 보안위협 중 대부분은 전송되는 정보의 유출과 사용자, 센서, 게이트웨이 사이의 인증에 대한 손실이 대부분이 다. 2019년 Chen 등이 이종무선 센서 네트워크에 안전한 사용자 인증 프로토콜을 제안하였다. 그러나 Ryu 등이 제안한 논문에서 그들이 제안 프로토콜은 password guessing attack과 session key attack에 취약하다는 것을 주장하였다. 본 논문은 이전에 제안된 논문의 취약점을 개선하여 더욱 안전하고 효율적인 사용자 인증 프로토콜을 제안하였다.

Recently, the use of sensor devices is gradually increasing. As various sensor device emerge and the related technologies advance, there has been a dramatic increase in the interest in heterogeneous wireless sensor networks (WSNs). While sensor device provide us many valuable benefits, automatically and remotely supported services offered and accessed remotely through WSNs also exposes us to many different types of security threats. Most security threats were just related to information leakage and the loss of authentication among the involved parties: users, sensors and gateways. An user authentication protocol for wireless sensor networks is designed to restrict access to the sensor data only to user. In 2019, Chen et al. proposed an efficient user authentication protocol. However, Ryu et al. show that it’s scheme still unstable and inefficient. It cannot resist offline password guessing attack and session key attack. In this paper, we propose an improved protocol to overcome these security weaknesses by storing secret data in device. In addition, security properties like session-key security, perfect forward secrecy, known-key security and resistance against offline password attacks are implied by our protocol.

인터넷을 통한 통신환경은 연결 가능한 사물들 간에 효율적인 통신을 제공한다. 이런 환경에서의 정보통신은 우리에게 편 리함을 제공하기는 하나 여러 형태의 보안위협이 도사리고 있는 실정이다. 인터넷을 이용하여 원격으로 접속하여 제공받는 서 비스에 존재하는 보안위협 중 대부분은 전송되는 정보의 유출과 클라이언트 서버 간 인증에 대한 손실이다. 2016년 Ahmed 등이 스마트카드를 이용한 안전한 경량급 사용자 인증 스킴을 제안하였다. 그러나 Kang등이 제안한 논문에서 그들이 제안 프 로토콜은 identity guessing attack에 취약하고 session key confirmation을 달성할 수 없다는 것을 주장하였다. 본 논문 은 Ahmed 등이 제안한 논문의 취약점을 개선하여 더욱 안전하고 효율적인 경량급 사용자 인증 스킴을 제안하였다.

The environment of the Internet provides an efficient communication of the things which are connected. While internet and online service provide us many valuable benefits, online services offered and accessed remotely through internet also exposes us to many different types of security threats. Most security threats were just related to information leakage and the loss of authentication on client-server environment. In 2016, Ahmed et al. proposed an efficient lightweight remote user authentication protocol. However, Kang et al. show that it’s scheme still unstable and inefficient. It cannot resist offline identity guessing attack and cannot provide session key confirmation property. Moreover, there is some risk of biometric information’s recognition error. In this paper, we propose an improved scheme to overcome these security weaknesses by storing secret data in device. In addition, our proposed scheme should provide not only security, but also efficiency since we only use hash function and XOR operation.

In this paper, a new algorithm is proposed using the technique of Cascaded Encryption (CE) for authentication of small handheld and Portable Communication Systems (PCSs). In the proposed method an 8-bit session key Ks is sent to the Mobile Station (MS) from the Authentication Center (AuC) as soon as the MS is switched on in the GSM network. The MS computes a cipher key for authentication KCA using the Recursive Positional Module-2 Substitution (RPMS) cryptographic technique. The technique of Cascaded Encryption (CE) considers the 128-bit International Mobile Subscribers’ Identification (IMSI) i.e. Ki as a stream. This stream is then divided into 16 groups each of which contains 8 bits. These groups are represented as G0 to G15. The corresponding bits of each group are put through repetitive Exclusive OR (XOR) operation with the adjacent bit until it generates a single bit number. Hence each group forms a triangular bit pattern. From these triangular bit patterns, the target block T is formed which consists of 16 bits, t0 to t15, which are generated from the groups G0 to G15. Further T is divided into two sub-blocks T0 and T1 consisting of bits t0...t7 and t8...t15 respectively. The bits of the blocks T0 and T1 are put through XOR operation with the corresponding bits of the session key Ks in two different steps to obtain C0 and C1 respectively. The bitstreams C0 and C1 are concatenated to form the 16 bits intermediate key Kim. Kim is put through the mechanism of the Rotor Machine where the direction of the bits depends on the cipher key for authentication KCA. The Rotor Machine generates the 16-bit SRES. Authentication Center (AuC) computes the SRES independently in a similar method and sends SRES and Ks to Home Location Register (HLR). HLR compares SRES obtained from AuC with SRES obtained from MS to confirm its identity.

패스워드 인증 체계 (PAS)는 개방형 네트워크에서 안전한 통신을 보장하는데 사용되는 가장 일반적인 메커니즘이다. 인수 분해와 이산 로그 등의 수학적 기반의 암호 인증 체계가 제안되고 강력한 보안 기능을 제공하였으나, 암호를 구성하는데 필요 한 계산 및 메시지 전송 비용이 높다는 단점을 가지고 있었다. Fairuz et al.은 스마트 카드 체계를 이용한 세션 키 동의와 관 련하여 인수분해 및 이산 로그 문제를 기반으로 한 개선된 암호 인증 프로토콜을 제안했다. 하지만 본 논문에서는 취약성 분 석을 통하여, Fairuz et al.의 프로토콜이 Privileged Insider Attack, Lack of Perfect Forward Secrecy, Lack of User Anonymity, DoS Attack, Off-line Password Guessing Attack에 관한 보안 취약점을 가지고 있다는 것을 확인하였다.

Password authentication schemes (PAS) are the most common mechanisms used to ensure secure communication in open networks. Mathematical-based cryptographic authentication schemes such as factorization and discrete logarithms have been proposed and provided strong security features, but they have the disadvantage of high computational and message transmission costs required to construct passwords. Fairuz et al. therefore argued for an improved cryptographic authentication scheme based on two difficult fixed issues related to session key consent using the smart card scheme. However, in this paper, we have made clear through security analysis that Fairuz et al.'s protocol has security holes for Privileged Insider Attack, Lack of Perfect Forward Secrecy, Lack of User Anonymity, DoS Attack, Off-line Password Guessing Attack.

스마트폰과 같은 디바이스를 이용한 모바일 지급결제 시스템에서는 이동성을 제공하는 편리함은 있지만 전송 정보에 대한 기밀성 유지나 거래 사실에 대한 부인봉쇄와 같은 정보보호 기능이 필수적 으로 요구된다. 본 논문에서는 기존의 지급결제 시스템을 안전성과 구현 효율성면에서 분석한 후 스 마트카드에 기반한 모바일 지불결제 프로토콜을 제안하였다. 제안 방식은 구매자와 스마트카드 발행 자(은행)간의 사전 키 공유 기법을 사용함으로써 세션 키 생성이 용이하고 이동 단말 장치의 연산량 이 최소화 되도록 설계하였다.

While the mobile payment system based on mobile device such as smartphone can provide convenience of mobility, it requires cryptographic functions such as confidentiality for transmission information and non-repudiation for transaction process. In this paper, we analyze previous payment protocols in aspect to security and implementation efficiency and propose a mobile payment protocol based on smartcard. The proposed scheme is designed to easily generate a session key and minimize the computational load of the mobile device using the pre-shared key scheme between buyer and smartcard issuer(bank).

In this paper, we improve an efficient and complete remote user authentication scheme and propose an adaptive timestamp-nonce based authentication scheme using portable storage devices. Compared with other smart card-based, timestamp-based and nonce-based schemes, our scheme achieves more functionality. The new importance merits are: An adaptive timestamp-nonce structure is proposed; portable device stores authentication data not only smart card; all transactions through non-secure channel, especially in the registration phase, and batch of portable storage devices is issued. Besides, the basic merits include a dictionary of verification tables is not required to authenticate users, users can choose their password freely, mutual authentication is provided between a user and the re- mote system, the communication cost and the computational cost are very low, a user can update their password after the registration phase, a session key agreed by a user and the remote system is generated in every session and the serious time synchronization problem are solved.

E-Passports are issued to the citizens by many countries with biometric data like face, fingerprint and iris for foolproof identification. A first generation standard for E-Passport was proposed by International Civil Aviation Organisation. Due to security flaws in the proposed one, second generation standards with Extended Access Control mechanism was developed. To improve the security of E-Passport many proposals are being discussed. This paper suggests a new authentication protocol using Customized Elliptic Curve Cryptography to improve the reliability of E-Passport.

In 2013, Li et al. proposed an improved smart card-based remote user password authentication scheme, and claimed that their scheme not only overcomes security weaknesses of the Chen et al.’s scheme but also is a more user friendly scheme compared with other schemes. In this paper, we analyze the security of Li et al.’s authentication scheme and we show that Li et al.’s authentication scheme is still insecure against the various attacks, such as the off-line password guessing attack, the forgery attack, and the session key generation attack etc. Also, we propose an improved scheme that can resist these security drawbacks of Li et al.’s authentication, even if the secret information stored in the smart card is revealed. As a result of security analysis, the improved scheme is relatively more secure against several attacks than other related schemes in terms of the security.

In 2013, Lee-Lie proposed secure smart card based authentication scheme of Zhu’s authentication for TMIS which is secure against the various attacks and efficient password change. In this paper, we discuss the security of Lee-Lie’s smart card-based authentication scheme, and we have shown that Lee-Lie’s authentication scheme is still insecure against the various attacks. Also, we proposed the improved scheme to overcome these security problems of Lee-Lie’s authentication scheme, even if the secret information stored in the smart card is revealed. As a result, we can see that the improved smart card based user authentication scheme for TMIS is secure against the insider attack, the password guessing attack, the user impersonation attack, the server masquerading attack, the session key generation attack and provides mutual authentication between the user and the telecare system.

This paper proposes a DTSA(Detection Technique against a Sybil Attack) protocol so that it can provide vehicles with the secure information for the road situation and the traffic flow among vehicles and by detecting a Sybil attack. This DTSA uses SKC(Session Key based Certificate) to verify the IDs among vehicles, which generates a vehicle’s anonymous ID, a session key, the expiration date and a local server’s certificate for the detection of a Sybil attack. In conclusion, this DTSA reduces not only the detection time against a Sybil attack but also the verification time for ID by using a hash function and an XOR operation. Besides, a drivers’ privacy can be protected by using an anonymous ID. This DTSA helps drivers drive safely with the reliable information of VANET and reduce traffic accidents.

Password-based authentication schemes have been widely adopted to protect resources from unauthorized access. In 2008, Chang-Lee proposed a friendly password-based mutual authentication scheme to avoid the security weaknesses of Wu-Chieu’s scheme. In this paper, we demonstrate that Chang-Lee’s scheme is vulnerable to user impersonation attack, server masquerading attack, password guessing attack, and insider attack. Also, we propose an improved scheme to overcome the security weaknesses of Chang-Lee’s scheme, even if secret information stored in the smart card is revealed. As a result of security analysis, we prove that the proposed scheme is secure for the various attacks and provides session key agreement.

Recently, many biometrics-based user authentication schemes for telecare medicine information systems (TMIS) have been proposed to improve the security problems in user authentication system. In 2014, Mishra et al. proposed an improvement of Awasthi-Srivastava’s biometric based authentication for TMIS which is secure against the various attacks and provide mutual authentication, efficient password change. In this paper, we discuss the security of Mishra et al.’s authentication scheme, and we have shown that Mishra et al.’s authentication scheme is still insecure against the various attacks. Also, we proposed the improved scheme to remove these security problems of Mishra et al.’s authentication scheme, even if the secret information stored in the smart card is revealed. As a result, we can see that the improved biometric based authentication scheme is secure against the insider attack, the password guessing attack, the user impersonation attack, the server masquerading attack and provides mutual authentication between the user and the telecare system.

최근 들어 320Mbps의 속도를 지원하는 IEEE 802.11n표준의 등장으로 인해 기업의 사무실, 대학캠퍼스, 산업용 창고 등 다양한 분야에서 광범위하게 IEEE 802.11 기반의 무선랜 사용이 증가하고 있다. 그러나 IEEE 802.11에서 제안하고 있는 사용자 인증과 세션 키 도출 방식은 사용자의 이동이 빈번한 무선랜 환경에서 안전하고 빠른 핸드오프를 지원하기에는 많은 문제점을 내포하고 있다. 본 논문은 이러한 문제점들을 해결하기 위해 난수집합과 PMK Caching기능을 이용한 4-Way 핸드쉐이크 프로토콜보다 안전하고 효율적인 2-Way 핸드쉐이크 프로토콜을 제안한다.

Recently, with an advent of IEEE 802.11n standard to support maximum speed of 320Mbps, use of WLAN based on IEEE 802.11 is increasing in the various fields including offices of the enterprise, campus of the colleges and warehouse for industry. However, both user authentication and session key derivation method presented in IEEE 802.11 have many problems in supporting secure and fast handoff in the WLAN environment where users move frequently. In this paper, that a new 2-Way Handshake protocol in proposed which is more secure and efficient than the 4-Way Handshake protocol using a random number set and PMK Caching in the IEEE 802.11i to solve the security problems.

Currently, there are many subscriber access networks: PSTN, ADSL, Cellular Network, IMT200 and so on. To these service providers that provide above network service, it is important that they authenticate and authorize legal subscribers and account for their usage. At present, There exist the several protocols that Support AAA(Authentication, Authorization and Accounting) service : RADIUS, Diameter, TACACS+. Nowadays, RADIUS has used for AAA service widely. It has been extended to support other access network environment. So, we extend RADIUS to support environment of Mobile IPv6. Mobile IPv6 uses IPsec as a security mechanism, basically. But, IPsec is a heavy security technology for small, portable, mobile device. Especially, it is serious at IKE, the subset of IPsec. IKE is a key distribution protocol that distributes the key to the endpoints of IPsec. In t:lis paper, we extend RADIUS to support environment of Mobile IPv6 and simplify the IKE phase of IPsec by AAA system distributing the keys by using its security communication channel. Namely, we propose the key distribution method for IPsec SA establishment between mobile node and home agent. The suggested method was anticipated to be effective at low-power, low computing deyice. Finally, end users feel the faster authentication.

Mobile IP Low Latency Handoffs［1］는 Mobile IP 등록 요청 절차를 처리하는데 있어서 단말의 지연 때문에 생기는 블록킹 시간을 최소화 시켜 실시간 서비스를 가능하게 해 준다. 그러나 인증, 권한 검증, 과금을 지원하는 AAA 기반의 Mobile IP 망에서는 매 지역 등록이 일어날 때마다 새로운 세션 및 세션 키가 필요하며, 이를 위해 홈 망까지 등록 절차가 수행되어야 한다. 이로 인해, 이동 노드 재인증 절차와 방문 망에서 홈 망까지의 트랜잭션으로 인한 통신 지연이 발생한다. 이러한 지연을 줄이기 위해서 본 논문에서는 홈 망의 AAA 서버가 관여되지 않고, 이전에 할당된 세션 키를 재 사용하여 Low Latency Handoffs를 수행하는 기법을 제안한다. 이 기법에서는 이전 방문 에이전트와 새로운 방문 에이전트간 세션 키를 교환하는 단계에서 발생하는 보안 취약성을 해결할 수가 있으며 홈 망까지 트랜잭션이 필요 없고, 세션 키의 기밀성이 제공되므로 이동 노드가 빠르고 안전하게 핸드오프를 수행할 수 있다.

본 논문에서는 VANET 환경에서 차량과 인프라간의 신뢰성 있는 통신을 제공하기 위한 V2I간의 세션 키 교환 기법을 제안한다. 기존의 VANET에서는 V2I간의 안전한 통신을 위해 IEEE 802.11i와 PKI 기반의 보안 메커니즘을 사용하고 있다. 그러나 차량의 고속 이동과 네트워크 환경이 자주 변하는 특성을 가진 VANET에서 짧은 시간에 IEEE 802.11i 또는 PKI 방식을 이용한 V2I 세션 키 교환은 어려움이 있다. 제안하는 기법에서는 빠르게 움직이는 차량과 인프라간의 세션키 교환을 위해 LR (Local Router)을 새롭게 정의하였으며, LR과 OBU 사이의 랜덤 값에 기반 한 XOR 연산을 통해 새로운 세션키를 빠르게 생성하고 교환할 수 있게 하였다. 때문에 제안하는 기법은 VANET 환경에서 AAA 서버 도움 없이도 빠르게 세션키를 교환할 수 있는 이점이 있다.

This paper proposes a session key exchange scheme for providing secure communication between Vehicles and Infrastructure in VANET. In the current VANET environment, IEEE 802.11i or PKI based mechanism is used to provide secure communication between V2I. However, since the vehicles and the frequent changes of network topology, VANET nodes have some difficulties to exchange the session key using IEEE 802.11i or PKI method. In the proposed scheme, Local Router is newly defined for exchanging the session key between moving vehicles and infrastructure. A session key is generated by XOR operation based on the random values between Local Router and OBU. As a result, the proposed scheme has a noticeable advantage on the fastness of key exchange by exchanging session keys between LR and OBU.

이동 애드혹 네트워크는 무선채널을 통해 데이타가 전송되고 중앙의 관리기관이 존재하지 않으므로 가용자원이 빈약하고 여러 가지 보안위협에 노출되어 있다 따라서 임의의 두 노드간에 안전한 통신을 수행하기 위해서는 안전하고 통신부하가 작은 세션 키 설정 방법이 요구된다. 그러나 애드혹 네트워크를 위한 기존의 키 설정 방법들은 모든 노드들에게 동일한 그룹 키를 분배하거나 효율적인 공개키 관리를 위한 방법들에 집중되어 왔다. 본 논문에서는 각 노드들간에 안전하게 그리고 작은 부하로 세션 키를 설정하는 방법이 제안된다. 제안하는 방법은 비밀 분산기법과 Diffie-Hellman 키 교환 방법을 이용한다. 클러스터내의 안전한 통신을 위해, 각 노드들은 클러스터내에서는 부분 비밀키를 사용하여 인증을 수행한 후에 자신의 클러스터 헤드와 세션 키를 생성한다. 또한 다른 클러스터간의 안전한 통신을 위해서 각 노드들은 상대방 노드의 공개키와 Diffie-Hellman 키 교환 방법을 이용하여 세션 키를 설정한다. 제안하는 방법은 실험을 통하여 클러스터 헤드 인중기반의 방법(1)에 비해 우수하다는 것을 입증하였다.

Mobile Ad-Hoc network tends to expose scarce computing resources and various security threats because all traffics are carried in air along with no central management authority. To provide secure communication and save communication overhead, a scheme is inevitable to serurely establish session keys. However, most of key establishment methods for Ad-Hoc network focus on the distribution of a group key to all hosts and/or the efficient public key management. In this paper, a secure and efficient scheme is proposed to establish a session key between two Ad-Hoc nodes. The proposed scheme makes use of the secret sharing mechanism and the Diffie-Hellman key exchange method. For secure intra-cluster communication, each member node establishes session keys with its clusterhead, after mutual authentication using the secret shares. For inter-cluster communication, each node establishes session keys with its correspondent node using the public key and Diffie-Hellman key exchange method. The simulation results prove that the proposed scheme is more secure and efficient than that of the Clusterhead Authentication Based Method(1).