[논문]접속로그와 패스워드에 따른 가변 및 동적솔트에 관한 연구

정진호; 차영욱; 김춘희

doi:10.9717/kmms.2020.24.1.058

접속로그와 패스워드에 따른 가변 및 동적솔트에 관한 연구
A Study on the Variable and Dynamic Salt According to Access Log and Password 원문보기

멀티미디어학회논문지 = Journal of Korea Multimedia Society, v.24 no.1, 2021년, pp.58 - 66

정진호 (DJ FAMILY) , 차영욱 (Dept. of Computer Engineering, Andong National University) , 김춘희 (Dept. of Electronic&Information Communication Engineering, Daegu Cyber University)

Abstract ▼ AI-Helper

The user's password must be encrypted one-way through the hash function and stored in the database. Widely used hash functions such as MD5 and SHA-1 have also been found to have vulnerabilities, and hash functions that are considered safe can also have vulnerabilities over time. Salt enhances password security by adding it before or after the password before putting it to the hash function. In the case of the existing Salt, even if it is randomly assigned to each user, once it is assigned, it is a fixed value in a specific column of the database. If the database is exposed to an attacker, it poses a great threat to password cracking. In this paper, we suggest variable-dynamic Salt that dynamically changes according to the user's password during the login process. The variable-dynamic Salt can further enhance password security during login process by making it difficult to know what the Salt is, even if the database or source code is exposed.

주제어

표/그림 (10)

그림 Fig. 1. Average number of characters in leaked user passwords worldwide in 2017.
그림 Fig. 2. Generation of password hash value using Salt.
그림 Fig. 3. Pritesh Salt.
그림 Fig. 4. Access log-based static Salt.
그림 Fig. 5. Salt combination locations in password in case of variable-dynamic Salt.
그림 Fig. 6. Login authentication procedure using variable-dynamic Salt.
그림 Fig. 7. Implementation of variable-dynamic Salt using PHP code.
그림 Fig. 8. Performance comparison of variable-static and variable-dynamic Salts.
표 Table 1. Comparison of Salt methods.
그림 Fig. 9. Comparison of password cracking times. (a) Plain text password, (b) Variable-static Salt, and (c) Variable-dy-namic Salt.

참고문헌 (16)

The Ministry of Public Administration and Security (Personal Information Protection Policy), "Basic Measures for Securing Safety of Personal Information," 2019.
Korea Internet & Security Agency (KISA), "Personal Data Encryption Action Guide," 2019.
X. Wang, D. Feng, X. Lai, and H. Yu, "Collisions for Hash Functions MD4, MD5, HAVAL128 and RIPEMD," Cryptology ePrint Archive, Report 2004/199, pp. 1-4, 2004.
M. Stevens, E. Bursztein, P. Karpman, A. Albertini, and Y. Markov, "The First Collision for Full SHA-1," CRYPTO 2017, pp. 1-23, 2017.
P.N. Patel, J.K. Patel and P.V. Virparia, "A Cryptography Application using Salt Hash Technique," International Journal of Application or Innovation in Engineering & Management (IJAIEM), Vol. 2, Issue 6, 2013.
PHP.net. https://www.php.net/manual/en/function.md5.php (accessed August 17, 2020).
LAUGHFOOL's LAB. https://laughfool.tistory.com/16 (accessed August 17, 2020).
The security ledger. https://securityledger.com/2012/12/new-25-gpu-monster-devours-passwords-in-seconds/ (accessed August 17, 2020).
Statista. https://www.statista.com/statistics/744216/worldwide-distribution-of-password-length/ (accessed August 17, 2020).
Safe Saving Password. https://d2.naver.com/helloworld/318732 (accessed August 17, 2020).
Samsung Electronics Co. Ltd., User Device Performing Password Based Authentication and Password Registration and Authentication Method Thereof, 10-2014-0024427, Korea, 2007.
S. Boonkrong and C. Somboonpattanakit, "Dynamic Salt Generation and Placement for Secure Password Storing," IAENG International Journal of Computer Science, Vol. 43, pp. 27-36, 2016.

상세보기
A. Karrar, T. Almutiri, S. Algrafi, N. Alalwi, and A. Alharbi, "Enhancing Salted Password Hashing Technique Using Swapping Elements in an Array Algorithm," International Journal of Computer Science and Technology, Vol. 9, Issue. 1, pp. 21-25, 2018.
Privacy Statement/Security Notice/Accessibility Statement. https://www.nist.gov/privacypolicy (accessed August 17, 2020).
N. Nagaraj, V. Vaidya, and P.G. Vaidya, "Revisiting the One-Time Pad," International Journal of Network Security, Vol. 6, No. 1, pp. 94-102, 2008.
How Secure Is My Password?. https://howsecureismypassword.net (accessed August 17, 2020).

내보내기 구분	파일저장 인쇄 메일전송
구성항목	기본정보 상세정보 관리번호, 논문명, 저널/프로시딩명, 저자 , 발행년, 권, 호, 시작페이지, 끝페이지, 발행기관 관리번호, 논문명, 대등논문명, 저자 , 저널/프로시딩명, 발행기관, 발행년, 발행언어, 권, 호, 시작페이지, 끝페이지, ISBN, ISSN, 주제분야, 키워드, 초록(한글), 초록(영문), 저자(소속기관)
저장형식	Text(ASCII format) Excel format RefWorks Direct Export RIS format (for Reference Manager, ProCite, EndNote), Scholar's Aids, Mendeley
메일정보	받는사람 (필수) @ 보내는사람 (선택) @ 제목 내용 KISTI 검색결과 이메일 서비스
안내	총 건의 자료가 검색되었습니다. 다운받으실 자료의 인덱스를 입력하세요. (1-10,000) 검색결과의 순서대로 최대 10,000건 까지 다운로드가 가능합니다. 데이타가 많을 경우 속도가 느려질 수 있습니다.(최대 2~3분 소요) 다운로드 파일은 UTF-8 형태로 저장됩니다. 파일의 내용이 제대로 보이지 않을실 때는 웹브라우저 상단의 보기 -> 인코딩 -> 자동선택 여부를 확인하십시오. ~ Text(ASCII format) Excel format

연합인증