植基於智慧卡暨使用者隱私保護之身分認證的研究

A Study on Smart-card-based User Authentication Schemes Preserving User Anonymity

張培禹(Pei-Yu Chang)

指導教授 ： 張雅芬

國立臺中科技大學/資訊與流通學院/資訊工程系碩士班/碩士(2012年)

https://doi.org/10.6826/NUTC.2012.00102

摘要

隨著網際網路的技術快速的發展，人們可以輕易地透過開放網路在遠端登入伺服器並存取其資源，當透過分散式存取遠端伺服器時，身分認證在防止系統資源或服務被未經授權的使用者存取方面扮演一個很重要的角色。近年來，隨著使用者的隱私逐漸受到重視，保護使用者的身分隱私也是一個重要的課題。因此，有許多基於智慧卡的身份認證機制紛紛被提出，以在雙向認證的金鑰協議中同時保有使用者的隱私性。然而，大多數的身份認證機制因為沒有全盤考量系統的安全性，導致其有安全性的隱憂。
在本篇研究中有兩個主題，首先我們討論基於智慧卡中保護使用者隱私的身份認證機制之特色並整理出其安全性上的需求，進而提出一個改進王學者等人提出的身份認證機制。除此之外，由於有愈來愈多的應用被架構在多重伺服器的環境下，因此我們提出了一個適用於多重伺服器架構下的身份認證機制，該機制以動態識別號確保使用者隱私且具備高強韌性。我們提出的方法不但符合安全需求，且在保護使用者隱私下適用於資源受限制的設備。

關鍵字

使用者隱私 ； 身份認證 ； 智慧卡 ； 金鑰協議

並列摘要

With the rapid development of computer network technologies, users can easily access remote servers’ resources over public but insecure channels anytime anywhere. When accessing remote services over distributed networks, user authentication plays an important role to prevent resources or services from being accessed by unauthorized users. For personal privacy, it is essential to protect the user’s identity because user anonymity has received much attention in recent year. Therefore, many user authentication schemes using smart cards have been proposed to solve the issue of user anonymity while achieving mutual authentication and key agreement. However, most of them are vulnerable to some security threats because they do not thoroughly consider the security concerns.
In this thesis, there are two main subjects. First, we discuss characteristics and requirements of smart-card-based user authentication schemes preserving user anonymity and propose an improvement of Wang et al.’s scheme. In addition, more and more applications are implemented in multi-server environment because computer network technologies have grown spectacularly. Thereupon, we propose a robust and novel dynamic-ID-based authentication scheme ensuring user anonymity for multi-server environment using smart cards. The proposed schemes not only comply with all security requirements but also suit applications in the resource-limited devices while preserving user anonymity.

並列關鍵字

User anonymity ； user authentication ； smart card ； key agreement

參考文獻

[1] L. Lamport, “Password authentication with insecure communication,” Communications of the ACM, vol. 24, no.11, pp. 770-772, Nov. 1981.

[2] G. Horng, “Password authentication without using a password table,” Information Processing Letters, vol. 55, no. 5, pp. 247-250, 1995

[3] M. S. Hwang and L. H. Li, “A new remote user authentication scheme using smart cards,” IEEE Transactions on Consumer Electronics, vol. 46, no. 1, pp. 28-30, Feb. 2000.

[4] C. C. Lee and Y. F. Chang, “On security of a practical three-party key exchange protocol with round efficiency,” Information Technology and Control, vol. 37, no. 4, pp. 333-335, Dec. 2008.

[5] X. M. Wang, W. F. Zhang, J. S. Zhang, and M. K. Khan, “Cryptanalysis and improvement on two efficient remote user authentication scheme using smart cards,” Computer Standards & Interfaces, vol. 29, no. 5, pp. 507-512, 2007.