- 學位論文
無線環境認證協定具匿名性之研究
On the Study of the Authentication Protocols with Anonymity in Wireless Environment
摘要
由於網際網路的蓬勃發展，且透過網路交易的方式越來越普遍，但也因為網 路交易方式越來越普遍，以及在網路交易上冒名身分和身分竊盜的問題也相對衍 生出來，因此雙方驗證機制的安全性和使用者的匿名性是非常重要的且逐漸受到 重視， 當請求服務者在安全通道上傳送請求訊息，接收者會利用這些訊息去驗 證發送者是否合法，在過去的幾十年，有非常多的雙方驗證安全機制被提出來 。在過去數十年中，有許多驗證使用者的方法已經被提出。在1981年Lamport提 出遠端驗證使用者密碼的方法，此方法對於伺服器來說可以有效率的驗證使用 者身分。另外，有三位學者分別對Lamport提出改進的方法去增進Lamport的安 全性。在2004年，Das等人提出了基於動態ID使用者驗證方法。然而，在Das等 人中有一些安全弱點被Wang等人所指出。第一個弱點是攻擊者可以從一張偷 來的智慧卡及一組任選的密碼就可以成功的完成使用者驗證。第二個弱點是沒 有提供相互驗證的功能。第三個弱點是的註冊階段是在非安全通道下交換私密 訊息。在2009年，Hsiang提出一驗證的方法。然後，在2012年，Hsieh 和Leu 指 出Hsiang存在仿冒攻擊和離線猜密碼攻擊，並且對此提出了改進的方法。在回 顧Hsieh 和Leu之後，我們基於單向雜湊函數的特性去設計了兩個攻擊方法。因 此我們提出一個既能滿足使用者匿名性且可以抵抗外部偽裝攻擊及抵抗內部猜測 攻擊的遠端使用者驗證方法。
並列摘要
With the internet growing up rapidly, the transation through the internet are really common. The security issue are very important, especially the issue of Imperson- ation and issue of ID-thief. For the reason, the two party's authentication scheme with anonymity is very important. A senders sends a message to a recipient on an insecure channel. The recipient must to authenticate the legality of the sender to accept the receive message. In past decades, a lot of schemes have been proposed to authenticate senders by the recipient. In 1981, Lamport proposed a remote pass- word based authentication scheme, which was shown to be e cient for a server to authenticate user's identi cation. There were some other schemes which provide similar approaches to improve the scheme in Lamport after it was proposed. In 2004, Das et al. proposed a dynamic ID-based remote user authentication scheme. Then, Wang et al points out three weeknesses of Das et al. scheme in 2009. The rst weekness, the weakness of Das et al scheme is that an attacker can perform user authentication with any random password successfully using a stolen smart card. The second, their scheme does not support mutual authentication. The third, the weakness is that the generated secret exchange in their registration phase does not use a secure channel to pass secret values. In 2009, Hsiang et al. presented another authentication scheme. Then, in 2012, Hsieh and Leu points out impersonation attack and o -line password guessing attack to Hsiang's scheme. After reviewing Hsieh and Leu's scheme, we nd that their scheme does not provide user anonymity. Besed on one way hash functions, we proposed a remote user authentication scheme which does provide user anonymity. The same scheme can resist outsider masquer- ii ade attack and insider guessing attack, also.