유·무선 연결이 가능한 홈 디바이스의 증가로 다양한 홈 서비스가 나타나고 있으나, 인가 없는 원격 접속으로사생활 침해와 개인정보의 유출이 발생하고 있다. 이는 디바이스의 인증 부재와 전송 데이터의 보호가 없는 것에 대부분기인한다. 본 논문에서는 스마트폰을 사용하여 디바이스의 비밀 정보를 안전한 메모리에 저장하고 디바이스의 인증을수행한다. 패스워드에 디바이스 개인키를 곱한 그림자 패스워드를 디바이스에 저장하여 디바이스 패스워드의 직접적인유출을 막는다. 또한, Lamport의 일회용 패스워드 기법으로 스마트폰과 디바이스를 상호인증하고, SRP 프로토콜을이용하여 패스워드를 복구하여 디바이스 사이의 세션키를 공유하는 방법을 제안한다. 본 논문에서 제안하는 프로토콜은도청, 재전송, 위장 공격 등에 안전하다.
Although various home services are developed as increasing the number of home devices with wire and wireless connection, privacy infringement and private information leakage are occurred by unauthorized remote connection. It is almost caused by without of device authentication and protection of transmission data. In this paper, the devices' secret value are stored in a safe memory of a smartphone. A smartphone processes device authentication. In order to prevent leakage of a device's password, a shadow password multiplied a password by the private key is stored in a device. It is proposed mutual authentication between a smartphone and a device, and session key agreement for devices using recovered passwords on SRP. The proposed protocol is resistant to eavesdropping, a reply attack, impersonation attack.
KATS, Smart home industry and standardization trend , KATS Technical Report, Vol.74, 2015.
CISCO, CISCO Annual Internet Report(2018–2023) , 2020.
KISA, IoT Security Guide for Household Appliances , 2017.
https://owasp.org/www-pdf-archive/OWASP-IoT-Top -10-2018-final.pdf
MQTT 3.1.1 specification. OASIS. 2015.
Z.Shelby, K.Hartke and C.Bormann, "Constrained Application Protocol (CoAP)," RFC 7252, 2014.
E.Rescorla and N.Modadugu, "Datagram Transport Layer Security Version 1.2," RFC 6347, 2012.
X.Sun, S.Men, C.Zhao and Z.Zhou, "A security authentication scheme in machine-to-machine home network service." Secur. Comm.. Netw., Vol.8, pp.2678-2686, 2012.
M.Zhao, X.Yao, H.Liu and H.Ning, "Physical Unclonable Function Based Authentication Protocol for Unit IoT and Ubiquitous IoT." In Proceedings of the 2016 International Conference on Identification, IIIKI, pp.179-184, 2016.
M.A.Muhal, X.Luo, Z.Mahmood and A.Ullah, "Physical Unclonable Function Based Authentication Scheme for Smart Devices in Internet of Things." In Proceedings of the 2018 IEEE International Conference on Smart Internet of Things(SmartIoT), pp.160–165, 2018.
M.A.Jan, F.Khan, M.Alam and M.Usman, "A payload-based mutual authentication scheme for Internet of Things." Future Gen. Comput. Syst., Vol.92, pp.1028-1039, 2019.
K.Lee, "A Scheme for Information Protection using Blockchain in IoT Environment," Jour. of The Korea Internet of Things Society, Vol.5, No.2, pp.33-39, 2019.
L.Lamport, "Password Authentication with Insecure Communication," Communications of the ACM, Vol.24, No.11, pp.770-772, 1981.
W.Diffie and M.E.Hellman, "New Directions in Cryptography," IEEE Trans. on Information Theory, Vol.IT-22, No.6, pp.644-654, 1976.
T.Wu, "The Secure Remote Password Protocol,"Proceedings of the 1998 Internet Society Network and Distributed System Security Symposium, pp.97-111, 1998.
T.Wu, "SRP-6: Improvements and Refinements to the Secure Remote Password Protocol," Submission to the IEEE P1363 Working Group, 2002.