在主從式架構下使用者認證機制之研究

The study of user authentication schemes for client/server environment

張瑞翔(Raxi-Shying Chung)

指導教授 ： 李正吉

亞洲大學/資訊學院/光電與通訊學系/碩士(2010年)

摘要

近年來隨著網路技術以及主從式架構不斷的快速發展，越來越多的研究主題在研究主從式架構。透過網路技術，網際網路造就了許多不同的多媒體服務，像是線上遊戲、電子信箱…等各種服務。然而大部分多媒體服務都是使用主從式架構。在主從式的環境中，認證性是在安全需求中是最重要的一部分，因為駭客可能會偽造成使用者去登入伺服器取得一些利益。所以任何使用者在登入伺服器使用多媒體服務之前，他們必須通過伺服器的認證。
因此，在本論文中，我們將討論三種不同的主從式環境下使用者認證機制，並且分別指出他們的安全性弱點。接著我們分別提出改善的方法去解決那些安全性弱點。此外，我們整理了一些相關文獻去比較安全性、效率性和功能性。根據這些安全性分析，我們提出的方法會是最安全、最有效率以及最實用的使用者認證機制在主從式架構上。

關鍵字

使用者認證, 資訊安全, 匿名性

並列摘要

Since network technology and the client/server architecture are rapidly development and more important in research recently. The Internet can support many different multi-media services such as on-line games, e-mail, and so forth. However, the most services are supported by the client/server infrastructure. In the client/server environment, authentication is one of most important security requirements, because an adversary might try to cheat the server with some benefits. It means that before the legal user accesses the server for some services, they must be authenticated by the server.
In this study, we discuss the characteristics and requirements on three user authentication schemes for client-server environment and point out that their scheme has some security weaknesses. Then we proposed improved scheme to solve these weaknesses and compared with related works in terms of security analysis, performance comparisons and functionality comparisons. According security analysis and comparisons, our proposed scheme is more secure, efficient and practical.

並列關鍵字

user authentication, security, user anonymity

參考文獻

[42] G. Yang, D. S. Wong, H. Wang, and X. Deng, Two-factor mutual authentication based on smart cards and passwords, Journal of Computer and System Sciences, vol. 74, no. 7, pp. 1160-1172, 2008.

[1] P. G. Argyroudis, R. Verma, H. Tewari, and D. O’Mahony, Performance analysis of cryptographic protocols on handheld devices, In Proceedings of the 3rd IEEE International Symposium on Network Computing and Applications (NCA2004), Cambridge, USA, pp. 169–174, Sep. 2004.

[2] C. C. Chang and J. S. Lee, An efficient and secure multi-server password authentication scheme using smart cards, In Proceedings of the 2004 IEEE International Conference on Cyberworlds, pp. 417-422, 2004.

[3] Y. F. Chang, C. C. Chang, and Y. W. Su, A secure improvement on the user-friendly remote authentication scheme with no time concurrency mechanism, In Proceedings of the IEEE International Conference on Advanced Information Networking and Applications, vol. 2, April 2006.

[4] H. Y. Chien, J. K. Jan, and Y. M. Tseng, An efficient and practical solution to remote authentication: smart card, Computers & Security, vol. 21, no. 4, pp. 372-375, 2002.