利用動態識別號之驗證方法的研究

Research on Dynamic-ID-based Authentication Schemes

張洪錦(Hung-Chin Chang)

指導教授 ： 張雅芬

共同指導教授 ： 黃慧鳳(Hui-Feng Huang)

國立臺中科技大學/資訊學群/資訊科技與應用研究所/碩士(2010年)

https://doi.org/10.6826/NUTC.2010.00048

摘要

隨著電腦網路技術快速發展，有越來越多的人透過網路處理事務。為了確保使用者的安全性，通行碼驗證的技術已被廣泛的應用在遠端使用者驗證機制上，此方法是最簡單且方便的允許合法使用者登入遠端伺服器。之後隨著時代的進步，使用者漸漸注意到自己在網路上的隱私問題。在2004年，Das等人提出動態識別號驗證技術，其方法不但讓使用者可以具有匿名隱私的保護並且防護網路上所帶來的不法攻擊。然而，在2009年，Wang等人提出對Das等人的動態識別號驗證技術改進，並聲稱他們的方法是最有效和安全的。在仔細的分析下，我們發現Wang 等人的方法無法抵擋偽裝使用者攻擊且使用者的行為可以被追蹤以及密碼更改時沒有被驗證的問題。在本研究中，我們明確的對Wang等人的方法進行弱點分析並提出改進的方法達到真正匿名隱私的保護。

關鍵字

動態識別號 ； 通行碼 ； 偽裝攻擊 ； 驗證 ； 追蹤 ； 隱私

並列摘要

With rapid growth of network technologies, more and more people tend to handle tasks via networks. In order to ensure that users are legitimate, the Password authentications are widely applied on remote user authentication, the scheme is the simplest and the most convenient authentication mechanism that allows a legal user to login the remote system. With the age of advance, people gradually concern about their privacy problems in network. In 2004, Das et al. proposed a dynamic ID-based remote user authentication scheme. However, Wang et al. proposed a new dynamic ID-based remote user authentication scheme which is an improvement of Das et al.’s scheme. They claimed their scheme is efficient and secure. After thorough analyses, we find Wang et al.’s scheme suffers from masquerade attacks and traceability of users. In this thesis, we have demonstrated how to mount masquerade attacks on Wang et al.’s proposed scheme and proposed a secure dynamic-identity-based remote user authentication scheme to protect privacy.

並列關鍵字

Dynamic ID ； Password ； Masquerade Attack ； Authentication ； Traceability ； Privacy

參考文獻

[1] M. S. Hwang and L. H. Li, “A new remote user authentication scheme using smart cards,” IEEE Transactions on Consumer Electronics, Vol. 46, No. 1, pp. 28-30, 2000.

[2] L. H. Li, I. C. Lin, and M. S. Hwang, “A remote password authentication scheme for multi-server architecture using neural networks,” IEEE Transactions on Neural Networks, Vol. 12, No. 6, pp. 1498-1504, 2001.

[3] Y. J. Wang and J. H. Li, “Security improvement on a timestamp-based password authentication scheme,” IEEE Transactions on Consumer Electronics, Vol. 50, No. 2, pp. 580-582, 2004.

[4] Y. F. Chang, C. C. Chang, and Y. L. Liu, “Password authentication without the server public key,” IEICE Transactions on Communications, Vol. E87-B, No. 10, pp. 3088-3091, October 2004.

[5] Y. F. Chang, C. C. Chang, and C. L. Kao, “An improvement on a deniable authentication protocol,” ACM Operating Systems Review, Vol. 38, No. 3, pp. 64-74, July 2004.