臺灣博碩士論文加值系統

由於網路科技進步，上網商業交易的人口與日俱增，為使伺服器更安全及更有效率地認證使用者身份，智慧卡提供了儲存使用者資訊及微量運算的功能。

然而，在多伺服器環境中，使用者可能向多個伺服器註冊要求提供多種服務導致使用者會有多帳號多密碼的問題，提供服務的伺服器會有多個使用者來註冊也導致伺服器管理者會有控管使用者權限的問題，如使用者如何更新權限的問題，及使用者不具使用資格時，管理者如何立即刪除使用者權限的問題。

有鑑於此，本研究使用雜湊訊息認證碼提出一安全存取控制機制，其優點如下： 1. 低計算成本；2. 可自由地選擇登入密碼；3. 伺服器不必儲存密碼表或驗證表；4. 無時間同步問題；5. 提供使用者和伺服器間交互認證；6. 提供連線期間金鑰溝通；7. 使用者只需註冊一次即可存取多台伺服器；8. 不同使用者在不同伺服器中具多種權限且能用原本的智慧卡更新使用者權限；9. 提供立即取消使用者權限功能。

Due to the advancement of Internet technology, the population of business transactions in the Internet is increasing. To let servers authenticate users’ identifications more safely and efficiently, smart cards provide users with the function of storing users’ information with limited computation.

However, in multi-server environment, users register many servers to request services that causes the problem of maintaining many accounts and passwords. Besides, due to large number of users, server managers have the problem of controlling users’ authority such as how to update users’ authority.
Especially, when registered users do not have qualification, it is important to revoke users’ authority immediately.

For above reasons, we propose a secure access control scheme using hashed message authentication codes. The proposed access control scheme has following merits: 1. low computation cost; 2. freely password chosen; 3. no password tables or verification tables in the server; 4. no time-synchronization problems; 5. accessing multiple servers with just one registration; 6. providing mutual authentication for users and servers; 7. providing session key agreement; 8. providing different updatable authority in each server; 9. providing immediate authority revocation capability.

中文摘要　．．．．．．．．．．．．．．．．．．．．． iii
英文摘要　．．．．．．．．．．．．．．．．．．．．． iv
誌謝辭　　．．．．．．．．．．．．．．．．．．．．． v
內容目錄　．．．．．．．．．．．．．．．．．．．．． vi
表目錄　　．．．．．．．．．．．．．．．．．．．．． viii
圖目錄　　．．．．．．．．．．．．．．．．．．．．． ix
第一章　　緒論．．．．．．．．．．．．．．．．．．． 1
　　第一節　　研究背景與動機．．．．．．．．．．．． 1
　　第二節　　研究目的．．．．．．．．．．．．．．． 1
　　第三節　　研究範圍．．．．．．．．．．．．．．． 3
　　第四節　　研究方法．．．．．．．．．．．．．．． 4
　　第五節　　研究架構．．．．．．．．．．．．．．． 6
第二章　　文獻探討．．．．．．．．．．．．．．．．． 7
　　第一節　　認證之技術．．．．．．．．．．．．．． 7
　　第二節　　智慧卡．．．．．．．．．．．．．．．． 9
　　第三節　　Diffie- Hellman 金鑰交換法．．．．．．． 13
　　第四節　　權限控管．．．．．．．．．．．．．．． 14
　　第五節　　遠端使用者認證機制．．．．．．．．．． 18
　　第六節　　多對多關係認證實例．．．．．．．．．． 29
第三章　　本研究之多伺服器存取控制機制．．．．．．． 32
　　第一節　　本研究多伺服器存取控制機制之內容．．． 32
第四章　　本研究多伺服器存取控制機制之分析．．．．． 40
　　第一節　　安全性分析．．．．．．．．．．．．．． 40
　　第二節　　效能分析．．．．．．．．．．．．．．． 49
第五章　　結論與未來發展方向．．．．．．．．．．．． 57
　　第一節　　結論．．．．．．．．．．．．．．．．． 57
　　第二節　　未來發展方向．．．．．．．．．．．．． 60
參考文獻．．．．．．．．．．．．．．．．．．．．．． 62

一、中文部份
Chen, Z.(2002)，智慧卡技術實務-使用Java card(周利欽，翁御舜 譯)，台北：碁峰資訊股份有限公司，(原文於2001年出版)。
王建閔(2005)，自動櫃員機(ATM) 智慧卡(Smart Card)安全認證之研究，中國文化大學資訊管理研究所未出版之碩士論文，35-40。
邵曉薇，郭雨涵(2000)，電子商務導論，台北：旗標出版股份有限公司。
賴溪松，韓亮，張真誠(2003)，近代密碼學及其應用，台北：旗標出版股份有限公司。
二、英文部份
Chang, C. C. & Kuo, J. Y. (2005). An efficient multi-server password authenticated key agreement scheme using smart cards with access control. In T. K. Shih (Ed.). Proceedings of the 19th International Conference on Advanced Information Networking and Applications, (pp. 257-260), Taiwan: Tamkang University.
Chang, C.C. & Lee, J. S. (2004). An efficient and secure multi-server password authentication scheme using smart cards. In M. Nakajima, Y. Hatori, & A. Sourin (Eds.). Proceedings of the International Conference on Cyberworlds, (pp. 417- 422), Tokyo, Japan: Tokyo Institute of Technology (FIT).
Chen, Y. C. & Yeh, L. Y. (2005a). An efficient authentication and access control scheme using smart cards. In L. Barolli (Ed.). Proceeding of the 11th International Conference on Parallel and Distributed Systems, (pp.78-82), Japan: Fukuoka Institute of Technology (FIT).
Chen, Y. C. & Yeh, L. Y. (2005b). An efficient nonce-based authentication scheme with key agreement, Applied Mathematics and Computation, 169(2), 982-994.
Chien H. Y. & Jan J. K. (2003). An integrated user authentication and access control scheme without public key cryptography. In L. D. Sanson (Ed.). Proceedings of the 37th International Carnahan Conference on Security Technology, (pp. 137- 143), Taipei, Taiwan.
Chien, H. Y., Jan, J. K., & Tseng, Y. M. (2002). An efficient and practical solution to remote authentication: smart card, Computers & Security, 21(4), 372-375.
Diffie, W. & Hellman, M. E. (1976). New Directions in Cryptography, IEEE Transactions on Information Theory, 22(6), 644–654.
Fan, C. I., Chan, Y. C., & Zhang, Z. K. (2005). Robust remote authentication scheme with smart cards, Computers & Security, 24(8), 619-628.
Gong, L. (1992). A security risk of depending on synchronized clocks, ACM SIGOPS Operating Systems Review, 26(1), 49–53.
Hansmann,U., Nicklous, M. S., Schack, T., Schneider, A. & Serliger F. (2000). Smart card application development using Java (2nd ed.). New York: Springer.
Hwang, M. S., Lee, C. C., & Tang, Y. L. (2002). A simple remote user authentication scheme, Mathematical & Computer Modelling, 36(1-2), 103-107
Hwang, R. J. & Shiau S. H. (2005). Password authenticated key agreement protocol for multi-servers architecture. In M. HI (Ed.). Proceedings of the International Conference on Wireless Networks, Communications and Mobile Computing, (pp. 279- 284).
Juang, W. S. (2004a). Efficient multi-server password authenticated key agreement using smart cards, IEEE Transactions on Consumer Electronics, 50(1), 251- 255.
Juang, W. S. (2004b). Efficient password authenticated key agreement using smart cards, Computers & Security, 23(2), 167-173.
Lee, S. W., Kim, H. S., & Yoo, K. Y. (2005). Efficient nonce-based remote user authentication scheme using smart cards, Applied Mathematics and Computation, 167(1), 355-361.
Liaw, H. T., Lin, J. F., & Wu, W. C. (2006). An efficient and complete remote user authentication scheme using smart cards, Mathematical & Computer Modelling, 44(1-2), 223-228.
Lin, I. C., Hwang M. S., & Li L. H. (2003). A new remote user authentication scheme for multi-server architecture, Future Generation Computer Systems, 19(1), 13–22.
National Institute of Science and Technology. (2002). Secure hash standard (FIPS Publication 180-2). Washington, DC: US department of Commerce.
Sandhu, R. S. & Samarati, P. (1994). Access control: Principles and practice, IEEE Communication Magazine, 32(9), 40-48.
Shieh, W. G. & Wang, J. M. (2006). Efficient remote mutual authentication and key agreement, Computers & Security, 25(1), 72-77.
Stallings, W. (2003). Network security essentials: Application and standards (2nd ed.). New Jersey: Prentice Hall.
Sun, H. M. (2000). An efficient remote user authentication scheme using smart cards, IEEE Transactions on Consumer Electronics, 46(4), 958-961.
Tsaur, W. J., Wu, C. C., & Lee, W. B. (2004). A smart card-based remote scheme for password authentication in multi-server internet services, Computer Standards & Interfaces, 27(1), 39–51.