OAuth 2.0 프로토콜에서 E-mail을 이용한 사용자 권한 인증 The Extended Authentication Protocol using E-mail Authentication in OAuth 2.0 Protocol for Secure Granting of User Access원문보기
최근 다양한 웹 서비스와 어플리케이션들이 사용자에게 제공되고 있다. 이러한 서비스들은 인증된 사용자에 한해서 서비스를 제공하기 때문에 사용자는 매번 서비스 별로 인증을 수행해야 하는 불편함을 겪고 있다. 이러한 불편함을 해결하기 위해 $3^{rd}$Party 어플리케이션이 웹 서비스에 대하여 제한된 접근 권한을 얻을 수 있게 해주는 OAuth(Open Authorization) 프로토콜이 등장하게 되었다. 이러한 OAuth 프로토콜은 사용자에게 편리하고 유연한 서비스를 제공한다. 그러나 OAuth 2.0 프로토콜에서는 재전송 공격, 피싱 공격, 위장 공격 취약점이 발생할 수 있다. 그러므로 본 논문에서는 OAuth 2.0 프로토콜의 보안성 향상을 위하여 E-mail인증을 통해 Resource Owner를 인증 후 Access Token 발급을 할 수 있는 방법을 제안한다.
최근 다양한 웹 서비스와 어플리케이션들이 사용자에게 제공되고 있다. 이러한 서비스들은 인증된 사용자에 한해서 서비스를 제공하기 때문에 사용자는 매번 서비스 별로 인증을 수행해야 하는 불편함을 겪고 있다. 이러한 불편함을 해결하기 위해 $3^{rd}$ Party 어플리케이션이 웹 서비스에 대하여 제한된 접근 권한을 얻을 수 있게 해주는 OAuth(Open Authorization) 프로토콜이 등장하게 되었다. 이러한 OAuth 프로토콜은 사용자에게 편리하고 유연한 서비스를 제공한다. 그러나 OAuth 2.0 프로토콜에서는 재전송 공격, 피싱 공격, 위장 공격 취약점이 발생할 수 있다. 그러므로 본 논문에서는 OAuth 2.0 프로토콜의 보안성 향상을 위하여 E-mail인증을 통해 Resource Owner를 인증 후 Access Token 발급을 할 수 있는 방법을 제안한다.
Currently there are wide variety of web services and applications available for users. Such services restrict access to only authorized users, and therefore its users often need to go through the inconvenience of getting an authentication from each service every time. To resolve of such inconvenienc...
Currently there are wide variety of web services and applications available for users. Such services restrict access to only authorized users, and therefore its users often need to go through the inconvenience of getting an authentication from each service every time. To resolve of such inconvenience, a third party application with OAuth(Open Authorization) protocol that can provide restricted access to different web services has appeared. OAuth protocol provides applicable and flexible services to its users, but is exposed to reply attack, phishing attack, impersonation attack. Therefore we propose method that after authentication Access Token can be issued by using the E-mail authentication. In proposed method, regular user authentication success rate is high when value is 5 minutes. However, in the case of the attacker, the probability which can be gotten certificated is not more than the user contrast 0.3% within 5 minutes.
Currently there are wide variety of web services and applications available for users. Such services restrict access to only authorized users, and therefore its users often need to go through the inconvenience of getting an authentication from each service every time. To resolve of such inconvenience, a third party application with OAuth(Open Authorization) protocol that can provide restricted access to different web services has appeared. OAuth protocol provides applicable and flexible services to its users, but is exposed to reply attack, phishing attack, impersonation attack. Therefore we propose method that after authentication Access Token can be issued by using the E-mail authentication. In proposed method, regular user authentication success rate is high when value is 5 minutes. However, in the case of the attacker, the probability which can be gotten certificated is not more than the user contrast 0.3% within 5 minutes.
* AI 자동 식별 결과로 적합하지 않은 문장이 있을 수 있으니, 이용에 유의하시기 바랍니다.
제안 방법
0 protocol. The proposed method can protect OAuth 2.0 protocol from known vulnerabilities such as the replay attack, phishing attack, and impersonation attack.
Such protocol provides applicability and extensibility, but is vulnerable to attacks such as the replay attack, phishing attack, and impersonation attack. This study proposed a method to issue an access token after an e-mail authentication of the resource owner for enhanced security protection of OAuth 2.0 protocol. The proposed method can protect OAuth 2.
이론/모형
For MAS to securely deliver the e-mail containing the authentication code to the resource owner in step 6, the ELGamal algorithm was used [14-15]. The MAS generates very large prime number p, and issue a public key, y=gamod p that matches the private key, a∈p* of the resource owner signed up for the MAS.
Such vulnerabilities can stir up some serious security issues because these security flaws can break in access to multiple services with only a single attack. For protection against such security vulnerabilities this study proposes a user authentication method that utilizes e-mail during the authentication between the third party application and the user.
참고문헌 (15)
Seon-Joo Kim, "An Efficient Access Control Mechanism for Application Software using the OAuth in the SaaS Cloud System", Graduate School of PaiChai University, 2013.
Jeong-Kyung Moon, "A Delegator for Authentication Management System using OAuth in Cloud Computing Environment", Graduate School of Kongju National University, 2013.
Myung Hyun Han, "Research on the extended OAuth protocol for real-name authentication", Graduate of School of Information Technology Chung-Ang University, 2013.
Meng-Yu Wu, Tsern-Huei Lee, "Design and Implementation of Cloud API Access Control Based on OAuth", In Proc. Of TENCON Spring Conference, 2013. http://dx.doi.org/10.1109/TENCONSpring.2013.6584492
http://en.wikipedia.org/wiki/OAuth
Daeyoung Heo, Suntae Hwang, "OAuth based Proxy Delegation Service", Journal of Internet Computing and Services, Vol. 13, No.6, 2012, pp. 55-62 http://dx.doi.org/10.7472/jksii.2012.13.6.55
D. Hardt, "The OAuth 2.0 authorization framework," Internet Engineering Task Force(IETF) RFC 6749, 2012.
E. Hammer-Lahav, Ed, "The OAuth 1.0 Protocol", Internet Engineering Task Force(IETF) RFC5849, 2010.
M. Jones and D. Hardt, "OAuth 2.0 Authorization Framework: Bearer token usage", Internet Engineering Task Force(IETF) RFC6750, 2012.
Feng Yang, Sathiamoorthy Manoharan, "A security analysis of the OAuth protocol", In Proc. Of Communications, Computers and Signal Processing (PACRIM), 2013. http://dx.doi.org/10.1109/PACRIM.2013.6625487
T. Lodderstedt, M. McGloin, and P. Hunt, "OAuth 2.0 threat model and security considerations", Internet Engineering Task Force(IETF) RFC6819, 2013.
K. P. L. Francisco Corella, "Security analysis of double redirection protocols", Pomcor, Tech. Rep., 2011.
J. Richer, W. Mills, and H. Tschofenig, "OAuth 2.0 message authentication code (MAC) tokens", draft-ietf-oauth-v2-http-mac-02, 2012.
Won-Jin Lee, Kee-Won Kim, "Cryptanalysis and Improvement of an E-mail Exchange Protocol with Mutual Authentication", Journal of KIIT, Vol 11, No. 10, 2013, pp. 61-68.
Hae-Soon Ahn, Jongjung Woo, Ki-Dong Bu, "Robust E-mail Exchange Protocol with Mutual Authentication", Journal of KIIT, Vol. 10, No. 11, 2012, pp. 105-112.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.