植基於智慧卡的使用者身份驗證方法之研究

A Study of the Smart card-Based Authentication Scheme

林忠智(Chung-Chih Lin)

指導教授 ： 詹昭文

國立臺中科技大學/資訊學群/資訊科技與應用研究所/碩士(2008年)

摘要

近年來隨著電腦科技的蓬勃發展，網際網路技術快速的興起，便利、快速且無遠弗界的
特性造成一股劃時代的熱潮，使用者可以透過網路取得各種的服務。要使用網路服務必
須登入遠端電腦系統並驗證使用者身份（user authentication）。假定使用者要使用網
路伺路器所提供的服務, 他/她必須擁有合法帳號與通行碼並透過網路驗證身份。然而，
透過網路作為資訊傳遞媒介可能隱含了機密資訊被不法人士取得的危險，如何讓使用者
的機密資訊不被不法人士所取得，保障使用者的身份不被冒用成為一個重要的課題。為
了保障使用網路服務的安全性，本研究論文提出了兩個植基於智慧卡的密碼身份驗證機
制。本機制可以抵擋幾個常見的攻擊，例如偽造攻擊、重送攻擊和中間人攻擊...等，並
且滿足幾個重要的特性，包括user-friendly、perfect forward secrecy、no password table、lower computation cost、mutual-authentication與session key-agreement等特性。

關鍵字

遠端登入、密碼驗證、智慧卡

並列摘要

In recent years, the computer technology has developed rapidly. The internet has also growing popular. The public network services are so convenient that are generally used around the world. Every user can use various kinds of services through the public network.
Once a user wants to access a server, he or she must has a pair of legal identification and secret password for authenticating. However, there is some illegal person who always try to steal the secret from others in the public network.
The confidential information might be stolen from network ransmission. Therefore,to keep the confidential information which belongs to person becomes a very important issue. In order to

guarantees the security of the providing services, two new password-based authentication

schemes using smart card are proposed in this thesis. The new schemes can prevent several

common attacks, such as forgery attack, replay attack and man-in-the-middle attack. The

schemes have several important properties including user-friendly, mutual authentication,

session key agreement and lower computation cost.

並列關鍵字

remote login, password authentication, smart card

參考文獻

[1] L. Lamport, "Password authentication with insecure communication," Communication of ACM, Vol. 24, 1981, pp. 770-772.

[3] H.M. Sun, "An efficient remote use authentication scheme using smart cards," IEEE Transactions on Consumer Electronics, Vol. 46, No. 4, 2000, pp. 958-961.

[4] Messerges TS, Dabbish EA, Sloan RH, "Examining smart card security under the threat of power analysis attacks," IEEE Transactions on Computers, Vol. 51, No. 5, 2002. pp. 541-552.

[5] M.S. Hwang and L.H. Li, "A new remote user authentication scheme using smart cards," IEEE Transactions on Consumer Electronics, Vol. 461, 2000, pp. 28-30.

[6] N.Y Lee and Y.C. Chiu, "Improved remote authentication scheme with smart card," ComputerStandards & Interfaces, Vol. 27, 2005, pp. 177-180.