移动平台典型应用的身份认证问题研究

张效林; 谷大武; 张驰

doi:10.11959/j.issn.2096-109x.2020081

您当前的位置：

首页 >

文章列表页 >

移动平台典型应用的身份认证问题研究

学术论文 | 更新时间：2024-06-03

- 移动平台典型应用的身份认证问题研究
- Issues of identity verification of typical applications over mobile terminal platform
- 网络与信息安全学报 2020年6卷第6期页码：137-151
- 作者机构：
  
  1. 上海交通大学电子信息与电气工程学院，上海 200240
  2. 西安电子科技大学网络与信息安全学院，陕西西安 710126
- 作者简介：
  
  [ "张效林（1998– ），男，山西临汾人，上海交通大学硕士生，主要研究方向为信息安全与密码学" ]
  [ "谷大武（1970– ），男，河南漯河人，博士，上海交通大学教授、博士生导师，主要研究方向为密码学与系统安全" ]
  [ "张驰（1991– ），男，山西太原人，上海交通大学博士生，主要研究方向为硬件安全、基于机器学习的侧信道分析" ]
- 基金信息：
  
  国家电网有限公司总部科技项目;Security Protection Technology of Embedded Components and Control Units in Power System Terminal(2019GW-12)
- DOI：10.11959/j.issn.2096-109x.2020081
  中图分类号： TP311.1
- 网络首发：2020-12，
  
  纸质出版：2020-12-15
- 稿件说明：
移动端阅览
张效林, 谷大武, 张驰. 移动平台典型应用的身份认证问题研究[J]. 网络与信息安全学报, 2020,6(6):137-151.

Xiaolin ZHANG, Dawu GU, Chi ZHANG. Issues of identity verification of typical applications over mobile terminal platform[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 137-151.
张效林, 谷大武, 张驰. 移动平台典型应用的身份认证问题研究[J]. 网络与信息安全学报, 2020,6(6):137-151. DOI： 10.11959/j.issn.2096-109x.2020081.

Xiaolin ZHANG, Dawu GU, Chi ZHANG. Issues of identity verification of typical applications over mobile terminal platform[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 137-151. DOI： 10.11959/j.issn.2096-109x.2020081.

摘要

近年来的研究表明，针对USIM卡的攻击手段日益增多，在5G环境下攻击者也能使用复制的USIM卡绕过某些正常应用的身份认证，进而获取用户信息。在USIM可被复制的条件下，研究了移动平台上典型应用的身份认证流程，通过分析用户登录、重置密码、执行敏感操作的应用行为给出身份认证树。在此基础上，测试了社交通信、个人健康等7类58款典型应用，发现有29款认证时仅需USIM卡接收的SMS验证码便可通过认证。针对该问题，建议应用开启两步验证，并结合USIM防伪等手段完成认证。

Abstract

Recent studies have shown that attacks against USIM card are increasing

and an attacker can use the cloned USIM card to bypass the identity verification process in some applications and thereby get the unauthorized access.Considering the USIM card being cloned easily even under 5G network

the identity verification process of the popular mobile applications over mobile platform was analyzed.The application behaviors were profiled while users were logging in

resetting password

and performing sensitive operations

thereby the tree model of application authentication was summarized.On this basis

58 popular applications in 7 categories were tested including social communication

healthcare

etc.It found that 29 of them only need SMS verification codes to get authenticated and obtain permissions.To address this issue

two-step authentication was suggested and USIM anti-counterfeiting was applied to assist the authentication process.

关键词

Keywords

references

3GPP specification:31.102.Characteristics of the Universal Subscriber Identity Module (USIM) application [S ] .

国家统计局 . 电信业务统计数据 [EB ] .

DOGTIEV A . App download and usage statistics (2018),business of App(2018) [EB ] .

BLAIR I . Mobile App download and usage statistics,BuildFire [EB ] .

LIU J R , YU Y , STANDAERT F , et al . Small tweaks do not help:differential power analysis of milenage implementations in 3G/4G USIM cards [C ] // The 20th European Symposium on Computer Security . 2015 : 468 - 480 .

BRIER E , CLAVIER C , OLIVIER F . Correlation power analysis with a leakage model [C ] // Cryptographic Hardware and Embedded Systems . 2014 : 16 - 29 .

3GPP specication:35.206.Specification of the MILENAGE algorithm set [S ] .

ANWAR N , RIADI I , LUTHFI A . Analisis SIM card cloning terhadap algoritma random number Generator [J ] . Buana Inform , 2016 , 7 ( 2 ): 143 - 150 .

SINGH J , RUHL R , LINDSKOG D , et al . GSM OTA SIM cloning attack and cloning resistance in EAP-SIM and USIM [C ] // Proc Soc , 2013 : 1005 - 1010 .

RAO J R , ROHATGI P , SCHERZER H , et al . Partitioning attacks:or how to rapidly clone some GSM cards [C ] // Proc IEEE Symp Secur Priv , 2002 : 31 - 41 .

ZHANG C , LIU J R , GU D W , et al . Side-channel analysis for the authentication protocols of CDMA cellular networks [J ] . J Comput Sci Technol , 2019 : 1079 - 1095 .

3GPP specication:33.501.Security architecture and procedures for 5G System [S ] .

BASIN D , RADOMIROVIC S , DREIER J , et al . A formal analysis of 5G authentication [C ] // Proceedings of the ACM Conference on Computer and Communications Security . 2018 : 1383 - 1396 .

LoCCS GoCE . 抱紧你的SIM卡—5G物理安全初探 [EB ] .

LoCCS GoCE . hold your SIM card tight—a glance at 5G physical security [EB ] .

KOOT L . Security of mobile TAN on smartphones a risk analysis for the iOS and Android smartphone platforms [D ] . The Netherlands:Radboud University Nijmegen , 2012 .

DMITRIENKO A , LIEBCHEN C , ROSSOW C , et al . Security analysis of mobile two-factor authentication schemes [J ] . Intel Technol J , 2014 : 138 - 161 .

ALECU B . SMS Fuzzing-SIM Toolkit attack [R ] . 2013 .

KIM H K , YEO H , HWANG H J , et al . Effective mobile applications testing strategies [R ] . 2016 .

Google . Esspresso testing android-framework,Github [EB ] .

Apple . Apple ui-automation documentation,Apple [EB ] .

GOMEZ L , NEAMTIU I , AZIM T , et al . Reran:timing-and touch-sensitive record and replay for android [C ] // 35th International Conference on Software Engineering (ICSE) . 2013 : 72 - 81 .

HU Y , AZIM T , NEAMTIU I . Versatile yet lightweight record-and-replay for android [C ] // Proceedings of the 2015 ACM SIGPLAN International Conference on Object-Oriented Programming,Systems,Languages,and Applications . 2015 : 349 - 366 .

MACHIRY A , TAHILIANI R , NAIK M . Dynodroid:an input generation system for android Apps [C ] // Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering . 2013 : 224 - 234 .

Appsee . App mobile analytics platform [EB ] .

OpenSTF . Smartphone test farm,Github [EB ] .

WANG R , CHEN S , WANG X F . Signing me onto your accounts through facebook and google:a traffic-guided security study of commercially deployed single-sign-on web services [C ] // 2012 IEEE Symposium on Security and Privacy . 2012 : 365 - 379 .

GAN C , WANG W . Uses and gratifications of social media:a comparison of microblog and WeChat [J ] . Journal of Systems and Information Technology , 2015 ( 4 ): 351 - 363 .

DMITRIENKO A , LIEBCHEN C , ROSSOW C , et al . On the (in) security of mobile two-factor authentication [C ] // International Conference on Financial Cryptography and Data Security . 2014 : 365 - 383 .

AppAnnie . The App analytics and App industry standard [EB ] .

Statista . Global business data platform [EB ] .

iresearch . App指数分析 [EB ] .

Iresearch . App index Analysis [EB ] .

QuestMobile . 2019移动App半年增长报告 [EB ] .

QuestMobile . Mobile App semi-annual growth report of 2019 [EB ] .

浏览量

901

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于国密算法的车载以太网控制器身份认证方法

货运列车车载网络轻量级身份认证协议研究