开源智能终端认证漏洞挖掘及登录认证改进

刘武; 王永科; 孙东红; 任萍; 刘柯

doi:10.16511/j.cnki.qhdxxb.2017.26.037

PDF(1098 KB)

清华大学学报（自然科学版） ›› 2017, Vol. 57 ›› Issue (9) : 897-902. DOI: 10.16511/j.cnki.qhdxxb.2017.26.037

计算机科学与技术

开源智能终端认证漏洞挖掘及登录认证改进

刘武¹, 王永科², 孙东红¹, 任萍³, 刘柯⁴

作者信息 +

Login authentication vulnerability mining and improved login authentication method based on an open source intelligent terminal

LIU Wu¹, WANG Yongke², SUN Donghong¹, REN Ping³, LIU Ke⁴

Author information +

文章历史 +

摘要

开源智能终端占智能终端市场的绝对优势，基于开源智能终端的应用层出不穷，但与此同时，其安全隐患也一样触目惊心。该文以典型社交网络APP登录认证为例，通过逆向分析当今市场上的主流Android应用，分析登录认证实现过程的机理，对登录认证机制进行安全性评估，挖掘基于现有认证机制的安全漏洞，并针对所发现的安全问题提出了登录认证机制改进方案，总结出一套安全实用的登录认证实践方案，有效提高移动智能终端系统的安全性。

Abstract

Open source intelligent terminals have many advantages in intelligent smart phones with endless applications of intelligent terminals based on open source codes. However, there are also many security risks for applications using intelligent terminals. This study analyzes the login authentication of a mainstream Android application in today's market by reverse analysis. The security flaws for current login authentication mechanisms are evaluated to discover potential security vulnerabilities in intelligent terminal devices. An improved for login authentication scheme is then given which effectively improves the security of intelligent terminal systems.

导出引用

刘武, 王永科, 孙东红, 任萍, 刘柯. 开源智能终端认证漏洞挖掘及登录认证改进[J]. 清华大学学报（自然科学版）. 2017, 57(9): 897-902 https://doi.org/10.16511/j.cnki.qhdxxb.2017.26.037

LIU Wu, WANG Yongke, SUN Donghong, REN Ping, LIU Ke. Login authentication vulnerability mining and improved login authentication method based on an open source intelligent terminal[J]. Journal of Tsinghua University(Science and Technology). 2017, 57(9): 897-902 https://doi.org/10.16511/j.cnki.qhdxxb.2017.26.037

中图分类号： TP393.0

参考文献

[1] 中国互联网络信息中心. 中国互联网络发展状况统计报告.. http://www.cnnic.net.cn/hlwfzyj/hlwxzbg/hlwtjbg/201701/P020170123364672657408.pdf. China Internet Network Information Center. China Internet Development Statistics Report.. http://www.cnnic.net.cn/hlwfzyj/hlwxzbg/hlwtjbg/201701/P020170123364672657408.pdf. (in Chinese) [2] Strategy Analytics Company. Wireless Smartphone Strategies.. http://www.strategya-nalytics.com/default.aspx?mod=saservice&a0=91&m=5#1. [3] 张一文, 雷友珣. Android"碎片化" 问题的适配方案的分析与应用[J]. 软件, 2015, 36(12):180-183.Zhang Y W, Lei Y X. An analysis and application for adaptation solutions of Android fragmentation[J]. Computer Engineering & Software, 2015, 36(12):180-183. (in Chinese) [4] Yuan Z, Lu Y, Xue Y. Droid detector:Android malware characterization and detection using deep learning[J]. Tsinghua Science & Technology, 2016, 21(1):114-123. [5] Feizoliah A, Anuarn B, Salleh R, et al. A review on feature selection in mobile malware detection[J]. Digital Investigation, 2015, 6(13):22-37. [6] Yang X L. Malicious detection based on reliefF and boosting multidimensional features[J]. Journal of Communications, 2015, 10(11):910-917. [7] IETF OAuth Work Group. OAuth Protocol.. http://oauth.net/. [8] 陈伟, 杨伊彤, 牛乐园. 改进的OAuth 2.0协议及其安全性分析[J]. 计算机系统应用, 2014, 23(3):25-30.Chen W, Yang Y T, Niu L Y. Improved OAuth 2.0 protocol and analysis of its security[J]. Computer Systems and Applications, 2014, 23(3):25-30. (in Chinese) [9] Schneier B. Two-factor authentication:Too little, too late[J]. Communications of the ACM, 2005, 48(4):136. [10] Shehab M, Marouf S. Recommendation models for open authorization[J]. Dependable and Secure Computing, 2012, 9(4):583-596. [11] Wang R, Zhou Y, Chen S, et al. Explicating SDKs:Uncovering assumptions underlying secure authentication and authorization[C]//Proceedings of the 22nd USENIX Conference on Security (SEC 2013). Berkeley, CA, USA:ACM, 2013:399-414. [12] IETF OAuth Work Group. The OAuth 2.0 Authorization Framework.. https://tools.ietf.org/html/rfc6749#page-61. [13] Chen E, Pei Y, Chen S, et al. OAuth demystified for mobile application developers[C]//Proceedings of the ACM Conference on Computer and Communications Security (CCS 2014). Scottsdale, AZ, USA:ACM, 2014:892-903. [14] 王焕孝, 顾纯祥, 郑永辉. 开放授权协议OAuth2.0的安全性形式化分析[J]. 信息工程大学学报, 2014, 15(2):141-147.Wang H X, Guo C X, Zheng Y H. Formal security analysis of OAuth2.0 authorization protocol[J]. Journal of Information Engineering University, 2014, 15(2):141-147. (in Chinese) [15] Mariantonietta L P, Febio M, Daniele S. A survey on security for mobile devices[J]. IEEE Communications Surveys & Tutorials, 2013, 15(1):446-471. [16] William E, Machigar O, Patrick M. Understanding Android security[J]. IEEE Security and Privacy, 2009, 7(1):50-57. [17] Asaf S, Yuval F, Uri K, et al. Google Android:A comprehensive security assessment[J]. IEEE Security and Privacy, 2010, 8(2):35-44. [18] Zhang Y, Fang J, Wang K, et al. Overview of Android security vulnerabilities mining technology[J]. Computer Research and Development, 2015, 52(10):2167-2177. [19] Enck W, Ongtang M, Mcdaniel P. Understanding Android security[J]. IEEE Security and Privacy, 2009, 7(1):50-57.

PDF(1098 KB)

Accesses

Citation

Detail

段落导航

收稿日期	出版日期
2016-06-18	2017-09-15
发布日期
2017-09-15

选择文件类型/文献管理软件名称

选择包含的内容

摘要

Abstract

关键词

Key words

引用本文

{{custom_sec.title}}

{{custom_sec.title}}

参考文献

访问统计

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

摘要

Abstract

关键词

Key words

引用本文

{{custom_sec.title}}

{{custom_sec.title}}

参考文献

访问统计