Cheong H. Choi, Journal of Internet Computing and Services, Vol. 19, No. 5, pp. 55-66, Oct. 2018
10.7472/jksii.2018.19.5.55, Full Text:
Keywords: authentication, Diffie-Hellman, Elliptic Curve Crypto

Abstract

Since existing server-based authentications use vulnerable password-based authentication, illegal leak of personal data occurs frequently. Since this can cause illegal ID compromise, alternative authentications have been studied. Recently token-based authentications like OAuth 2.0 or JWT have been used in web sites, however, they have a weakness that if a hacker steals JWT token in the middle, they can obtain plain authentication data from the token, So we suggest a new authentication method using the verification token of authentic code to encrypt authentication data with effective time. The verification is to compare an authentication code from decryption of the verification-token with its own code. Its crypto-method is based on do XOR with ECDH session key, which is so fast and efficient without overhead of key agreement. Our method is outstanding in preventing the personal data leakage.

Statistics
Cite this article