臺灣博碩士論文加值系統

隨著網路科技與行動裝置的進步，使用者可以更輕易地透過行動裝置進行網路的存取。在2014年，Kuo等學者提出了應用在行動網路中的相互驗證方法並宣稱此方法是有效與安全的。在分析Kuo等學者的方法後，我們發現其有兩個缺點。第一，該方法無法抵禦中間人攻擊。第二，在該方法的密碼更新階段會遭遇到同步問題。在本研究中，將會詳細地介紹所發現的缺點、提出改善這些安全漏洞的方法，並對所提出之方法進行分析，證明此方法是安全且適用於行動網路環境中。

With the rapid advances of the network technologies and mobile devices, users can easily use their mobile devices to access Internet services through wireless networks. In 2014, Kuo et al. proposed a mobility network authentication scheme and claimed their scheme was efficient and secure. Unfortunately, we find that their scheme has two weaknesses. First, it cannot resist man-in-the-middle attack. Second, it suffers from the synchronization problem in password change phase. In this study, the found weaknesses will be shown in detail, and an improved scheme for mobility networks is proposed to remedy these weaknesses. We also analyze the proposed scheme and prove that our scheme is secure and suitable for mobility networks.

中文摘要 i
Abstract ii
Table of content iii
List of figures iv
Chapter 1. Introduction 1
1.1 Motivation and background 1
1.2 Thesis organization 2
Chapter 2. Review of Kuo et al.’s scheme 3
2.1 Notations 3
2.2 Registration phase 3
2.3 Authentication and establishment of the session key phase 4
2.4 Update session key phase 7
2.5 Password change phase 7
Chapter 3. Analysis on Kuo et al.’s scheme 9
3.1 Main-in-the-middle attack 9
3.2 The synchronization problem 9
Chapter 4. The proposed scheme 11
4.1 Registration phase 11
4.2 Login phase 12
4.3 Authentication and establishment of the session key phase 12
4.4 Update session key phase 14
4.5 Password change phase 15
Chapter 5. Property analysis 17
5.1 User anonymity 17
5.2 Man-in-the-middle attack resistance 17
5.3 The synchronization problem resistance 17
5.4 Insider attack resistance 18
5.5 Local password change 18
5.6 Mutual authentication 18
Chapter 6. Conclusions 20
Bibliography 21

[1] S. Suzukiz and K. Nakada, “An authentication techinque based on distributed security management for the global mobility network,” IEEE Jounal Selected Areas in Communications, vol. 15, no. 8, pp. 1608-1617, 1997.
[2] L. Buttyan, C. Gbaguidi, S. Staamann and U. Wilhelm, “Extensions to an authentication technique proposed for the global mobility network,” IEEE Transactions on Communications, vol. 48, no. 3, pp. 373-376, 2000.
[3]Z.J. Tzeng and W.G. Tzeng, “Authentication of mobile users in third generation mobile systems,” Wireless Personal Communications, vol. 16, no. 1, pp. 35-50, 2001.
[4]K.F. Hwang and C.C Chang, “A self-encryption mechanism for authentication of roaming and teleconference services,” IEEE Transactions on Wireless Communications, vol. 2, no. 2, pp. 400-407, 2003.
[5]J. Zhu and J. Ma, “A new authentication scheme with anonymity for wireless environments,” IEEE Transactions on Consumer Electronics, vol. 50, no. 1, pp. 230-234, 2004.
[6]C.Y. Lee, C.C. Chang, and C.H. Lin, “User authentication with anonymity for global mobility networks,” Proceedings of the 2005 IEEE Mobility Conference, The Second Asia Pacific Conference on Mobile Technology, Guangzhou, China, pp. 1-5, November 2005.
[7]C.C. Lee, M.S Hwang, and I.E. Liao, “Security enhancement on a new authentication scheme with anonymity for wireless environments,” IEEE Transactions on Industrial Electronics, vol. 53, no. 5, pp. 1683-1687, 2006.
[8]C.C Chang, C.Y. Lee, and Y.C. Chiu, “Enhanced authentication scheme with anonymity for roaming service in global mobility networks,” Computer Communications, vol. 32, no. 4, pp. 611-618, 2009.
[9]W.C. Kuo, H.J. Wei, and J.C. Cheng, “An efficient and secure anonymous mobility network authentication scheme,” Journal of Information Security and Applications, vol. 19, no. 1, pp. 18-24, 2014.