利用智慧卡做網路使用者認證之研究

Study of remote user authentication using smart cards

劉昭聖(Chao-Sheng Liu)

指導教授 ： 洪文斌

淡江大學/工學院/資訊工程學系碩士班/碩士(2012年)

https://doi.org/10.6846/TKU.2012.00648

摘要

智慧卡又稱IC卡、晶片卡，是1968年德國科學家 Jurgen Dethloff 和 Helmut Grotrupp 將積體電路加入了身分識別卡所發明，並在同年期間獲得了專利。
1975年，法國公司CII-Honeywell Bull 生產出第一張類似信用卡的ID卡。同年的3月17號，法國科學家Roland Moreno 獲得了IC卡在法國的專利。
1976 年法國布爾電腦公司首先製成IC卡產品，並開始應用在各個領域，像是電子錢包、IC 金融卡、信用卡、悠遊卡、健保IC卡、自然人憑證等等各領域上的運用。
由於智慧卡的資料是在網路上傳遞，相對的也面臨了一些問題，例如在傳送資料的管道不安全，很容易會被有心人士監控或是攔截而竊取使用者的資料或是進行一些攻擊，像是重送攻擊、冒充攻擊、中間攻擊等方面的網路攻擊。甚至智慧卡裡面的資料會被有心人士存取出來而進行攻擊造成不安全的情形。雖然隨後很多學者提出改進的方法，隨後而被其他學者發現弱點並且加以改進，但是改進後的方法還是不安全。
所以我們提供一個方法改進其他學者方法的弱點，並假設智慧卡的內容會被有心人士存取出來的情形下，還能抵抗各種的網路攻擊。

關鍵字

智慧卡 ； 密碼分析 ； 認證 ； 會議金鑰 ； 動態 ID

並列摘要

Smart card, also called IC card or chip card, was first invented by the German scientists Jurgen Dethloff and Helmut Grotrupp, who added the identity card with integrated circuits and obtained a patent in the same year.
In 1975, the French company CII-Honeywell Bull produced the first credit card that was like ID card. In the same year, French scientists Roland Moreno obtained the patent of IC card in French.
In 1976, the French computer company Bull produced the products of IC card first and began to apply in various areas, just like E-purse, IC debit card, credit card, easy card, national health insurance IC card, natural person's evidence and so on.
Since the data of smart card will transmit over the Internet, there are some problems to cope with. For example, the transmission of data channels is unsafe; it is easy to be monitored or intercepted the user’s data by the attacker or to perform some of the Internet attacks, like replay attack, masquerade attack, man-in-the-middle attack, and so on. Furthermore, the data stored in smart card can be retrieved by the attacker to launch other attacks, resulting unsafe transactions. Although many scholars proposed their method to improve the security of authentication schemes, there are some weaknesses found by other scholars. Hence, improvements of security of authentication schemes become an endless cycle.
In this thesis, we propose an authentication scheme to improve other methods proposed by other scholars. We assume that the data stored in smart card can be obtained by the attacker, and our scheme can resist various attacks.

並列關鍵字

smart card ； cryptanalysis ； authentication ； session key ； dynamic ID

參考文獻

[1] C.T. Li and M.S. Hwang, “An efficient biometrics-based remote user authentication scheme using smart cards,” Journal of Network and Computer Applications, vol. 33, pp. 1–5, 2010.

[2] A.K. Das, “Analysis and improvement on an efficient biometric- based remote user authentication scheme using smart cards,” Information Security, vol. 5, no. 3, pp. 145–151, 2011.

[3] X. Li, J.W. Niu, J. Ma, W.D. Wang, and C.L. Liu, “Cryptanalysis and improvement of a biometrics-based remote user authentication scheme using smart cards,” Journal of Network and Computer Applications, vol. 34, pp. 73–79, 2011.

[4] M.L. Das, A. Saxena, and V.P. Gulati, “A dynamic ID-based remote user authentication scheme,” IEEE Transactions on Consumer Electronics, vol. 50, no. 2, pp. 629–641, 2004.

[5] H.Y. Chien and C.H. Chen, “A remote authentication scheme preserving user anonymity,” Proceedings of the 19th International Conference on Advanced Information Networking and Applications, pp. 245–248, 2005.