臺灣博碩士論文加值系統

越來越多的學者在設計遠端認證協定時，將生物特徵結合通行碼(Passwords)和智慧卡(Smart cards)，以達到更高安全的需求。然而，在目前所提出相關遠端認證協定的文獻中，在認證階段的時候，皆是在智慧卡內來比對生物特徵(Biometrics)，而不是在認證的伺服器上。雖然這樣的設計讓伺服器端無法知道使用者的生物特徵資料，可以保有生物特徵的隱私，但是卻會產生安全上的缺陷，因為遠端伺服器並沒有真正驗證到生物特徵這個安全因子，因此我們認為在智慧卡上驗證生物特徵的方式，並不是真正的三個安全因子（通行碼、智慧卡、生物特徵）的遠端認證協定。在本文中，我們提出了一個真正的三個安全因子遠端認證協定，也就是我們將會在遠端伺服器驗證通行碼、智慧卡和生物特徵，另外我們也考慮到使用者生物特徵的隱私，因此我們所提出的協定雖然是在伺服器端做生物特徵的驗證，但是使用者卻無須向任何人，包括驗證的伺服器，暴露自己的生物特徵資料。而且我們所提出協定可抵擋重送攻擊(The replay attacks)和離線字典攻擊(The offline-dictionary attacks)，並且也達到符合智慧卡低計算量的需求。因此我們所提出的協定做到效率上的考量，也兼顧了安全性和隱私性。最後，我們用GNY邏輯分析來證明我們的協定的確達到了認證的目標。

More and more researchers combine biometrics with passwords and smart cards to design remote authentication schemes for the purpose of high-degree security. However, in most of these authentication schemes proposed in the literatures so far, biometric characteristics are verified in the smart cards only, not in the remote servers, during the authentication processes. Although this kind of design can prevent the biometric data of the users from being known to the servers, it will result in that they are not real three-factor authentication schemes and therefore some security flaws may occur since the remote servers do not indeed verify the security factor of biometrics. In this thesis we propose a truly three-factor remote authentication scheme where all of the three security factors, passwords, smart cards, and biometric characteristics, are examined in the remote servers. Especially, the proposed scheme fully preserves the privacy of the biometric data of every user, that is, the scheme does not reveal the biometric data to anyone else, including the remote servers. Furthermore, we also demonstrate that the proposed scheme is immune to both the replay attacks and the offline-dictionary attacks and it achieves the requirement of low-computation cost for smart-card users. Finally, we give a formal analysis based on the GNY logic to prove that our goals are achieved.

Abstract 1
Chapter 1 Introduction 5
Chapter 2 Related Works 8
2.1 Lee–Ryu–Yoo Scheme 8
2.2 Kim–Lee–Yoo scheme 9
2.2.1 Timestamp Based Scheme 10
2.2.2 Nonce based scheme 11
2.3. Cryptanalysis of Kim–Lee–Yoo Scheme 12
2.4. Lin and Lia’s Scheme 13
2.5. Rabin’s Cryptosystem 16
2.6. The Image Processing of Fingerprints 17
Chapter 3 Basic Idea 19
Chapter 4 Our Scheme 22
4.1 Initialization Phase 23
4.2 Registration Phase 23
4.3 Login and Authentication Phase 24
Chapter 5 Discussions 27
Chapter 6 Three-Factor Security 30
Chapter 7 Formal Analysis 33
7.1 Formulae and Statements 33
7.2 Logical postulates 34
7.3 Protocol Description 37
7.4 Goals 38
7.6 Assumption list 39
7.6 Protocol Analysis 40
Chapter 8 Conclusions 43

[1] F.A. Afsar, M. Arif, and M. Hussain, “Fingerprint identification and verification system using minutiae matching,” Proceedings of National Conference on Emerging Technologies, pp. 141-146, 2004.
[2] M. Burrows, M. Abadi, and R. Needham, “A logic of authentication,” ACM Transactions on Computer Systems, Vol. 23, No. 5, pp. 1-13, 1989.
[3] C.C. Chang and I.C. Lin, “Remarks on fingerprint-based remote user authentication scheme using smart cards,” ACM SIGOPS Operating Systems Review, Vol. 38, Issue 4 , pp. 91-96, 2004.
[4] L. Gong, Roger Needham, and Raphael Yahalom, “Reasoning about belief in cryptographic protocols,” Proceedings of the 1990 IEEE Computer Society Symposim on Research in Security and Privacy, pp. 234-246, 1990.
[5] H.S. Kim, J.K. Lee, and K.Y. Yoo, “ID-based password authentication scheme using smart cards and fingerprints,” ACM SIGOPS Operating Systems Review, Vol. 37, No. 4, pp. 32-41, 2003.
[6] C.H. Lin and Y.Y. Lai, “A flexible biometrics remote user authentication
Scheme,” Computer Standards & Interfaces, Vol. 27, Issue 1, pp. 19-23, 2004.
[7] J.K. Lee, S.R. Ryu and K.Y. Yoo, “Fingerprint-based remote user authentication scheme using smart cards,” Electronics Letters, Vol. 38, No. 12, pp. 554-555, 2002.
[8] V. Matyas Jr. and Z. Riha, “Toward reliable user authentication through biometrics,” IEEE Security & Privacy, Vol. 1, No. 3, pp. 45-49, 2003.
[9] C.J. Mitchell and Q. Tang, “Security of the Lin-Lai smart card based user authentication scheme,” Technical Report, http://www.rhul.ac.uk/mathematics/ techreports, 2005.
[10] D. M. Nessett, “A critique of the Burrows, Abadi, and Needham logic,” Operating System Review, Vol. 24, No. 2, pp. 35-38, 1990.
[11] M.O. Rabin, “Digitalized signatures and public-key functions as intractable as factorizations,” Technical Report, MIT/LCS/TR212, MIT Lab., Computer Science, Cambridge, Mass. Jan. 1979.
[12] M. Rejman-Greene, “Secure authentication using biometric methods,” Information Security Technical Report, Vol. 7, No. 3, pp. 30-40, 2002
[13] L. Rila and C. J. Mitchell, “Security protocols for biometrics-based cardholder authentication in smartcards,” Lecture Notes in Computer Science, Vol. 3482, Springer-Verlag, pp. 488-497, 2005.
[14] M. Scott, “Cryptanalysis of an ID-based password authentication scheme using smart cards and fingerprints,” ACM SIGOPS Operating Systems Review, Vol. 38, Issue 2, pp. 73-75, 2004.
[15]U. Uludag, S. Pankanti, S. Prabhakar and A. K. Jain, “Biometric cryptosystems: issues and challenges,” Proceedings of The IEEE, Vol. 92, No. 6, 2004.
[16] 張景銘、王進賢, 實驗室規模指紋辨識系統之設計與實現, 國立中正大學電機工程研究所, 92年8月, 第五頁, 國家圖書館全國博碩士論文資訊網