行動網路安全機制之研究

A Research on Security Mechanisms in Mobile Networks

陳煥文(Huan-Wen Chen)

指導教授 ： 張雅芬

國立臺中科技大學/資訊與流通學院/資訊工程系碩士班/碩士(2019年)

摘要

在現代通訊中，無線移動網路扮演著重要角色。使用者可使用行動裝置隨時隨地存取無線移動網路且取得所需資料。全球移動網路（Global Mobile Network）可在異地網路提供由本地代理支援的漫遊服務。但由於傳輸媒體的特質，任何人都可以竊聽或攔截無線傳輸的訊息。此屬性使得身份驗證對在安全性的確保上為一重要因素。
最近，Madhusudhan和Shashidhara提出了一種用於全球移動網路中漫遊服務的認證方案。他們聲稱他們的方案可以確保使用者匿名和不可追踪性、相互驗證、完美的前向保密、本地密碼驗證、會談金鑰安全性和公平性、無時間同步問題及用戶友好性。在分析了他們的方案後，我們發現它存在一些缺陷。首先，惡意使用者可以取得會談金鑰。其次，惡意使用者可以冒充合法使用者。第三，他們的方案無法抵禦去同步攻擊。第四，他們的方案無法確保外地代理與本地代理間的相互認證。
此外，Gupta和Chaudhari在2018年為全球移動網路中的漫遊服務提出了匿名雙因素身份驗證協議。他們聲稱，他們的方案不僅可確保強大的用戶匿名性、相互身份驗證和完美的前向保密，還可抵禦去同步攻擊、密碼猜測攻擊，重播攻擊和內部攻擊。在分析了他們的方案後，我們發現它存在一些缺陷。首先，外地代理無法確定本地代理是誰以及所接收的請求是否傳送予自己。其次，本地代理無法成功記錄認證失敗的次數。第三，外地代理無法確定本地代理發送的消息是否傳送予自己。第四，惡意使用者可發動平行攻擊來獲取未經授權的服務。
在本研究中，我們將詳細說明上面兩個為全球移動網路設計的安全方案所無法抵禦之攻擊及安全缺失。

關鍵字

全球漫遊 ； 移動網絡 ； 使用者匿名 ； 同步 ； 平行攻擊

並列摘要

In contemporary communications, wireless mobile networks play an important role. Users use mobile devices to access wireless mobile networks anytime and anywhere to get the needed data. Global Mobile Network (GLOMONET) provides roaming services supported by a home agent in any foreign network. Due to the nature of transmission media, anyone can eavesdrop or intercept the messages transmitted wirelessly. This property makes authentication important to ensure security.
Recently, Madhusudhan and Shashidhara proposed an authentication scheme for roaming service in global mobile networks. They claimed that their scheme could ensure user anonymity and untraceability, mutual authentication, perfect forward secrecy, local password verification, session key security and fairness, no time synchronization problem, and user friendliness. After analyzing their scheme, we find that it suffers from some flaws. First, a session key can be retrieved by a malicious user. Second, a malicious user can impersonate a legal user. Third, their scheme suffers from de-synchronization attack. Fourth, mutual authentication between the foreign agent and the home agent is not ensured as claimed.
Meanwhile, Gupta and Chaudhari proposed an anonymous two factor authentication protocol for roaming service in global mobile networks in 2018. They claimed that their scheme could not only ensure strong user anonymity, mutual authentication and perfect forward secrecy but also resist desynchronization attack, password guessing attack, replay attack, and insider attack. After analyzing their scheme, we find that it suffers from some flaws. First, the foreign agent cannot determine who the home agent is and whether the received request is for itself or not. Second, some operation cannot be executed by the home agent to record the number of authentication failure. Third, the foreign agent cannot determine whether the message received sent by the home agent is for itself or not. Fourth, a malicious user can mount parallel attack to obtain the unauthorized service.
In this thesis, we will show the security flaws that these two schemes designed for Global Mobile Network suffer from.

並列關鍵字

global roaming ； mobility networks ； user anonymity ； synchronization ； parallel attack

參考文獻

[1] J. Zhu and J Ma, “A new authentication scheme with anonymity for wireless environments,” IEEE Transactions on Consumer Electronics, Vol. 50. No. 1, pp. 231-235, 2004.

[2] C.C. Lee, M.S. Hwang and I.E. Liao, “Security enhancement on a new authentication scheme with anonymity for wireless environments,” IEEE Transactions on Industrial Electronics, Vol. 53, No. 5, pp. 1683-1687, 2006.

[3] C.C. Wu, W.B. Lee and W.J. Tsaur, “A secure authentication scheme with anonymity for wireless communications,” IEEE Communications Letters, Vol. 12, No. 10, pp. 722-723, 2008.

[4] C.C. Chang, C.Y. Lee and Y.C. Chiu, “Enhance authentication scheme with anonymity for roaming service in global mobility networks,” Computer Communications, Vol. 32, No. 4, pp. 611-618, 2009.

[5] T.Y. Youn, T.H. Park and J. Lim, “Weaknesses in an anonymous authentication scheme for roaming service in global mobile networks,” IEEE Communications Letters, Vol. 13, No. 7, pp. 471-473, 2009.