A dynamic ID-based authentication scheme with smart token

Very recently, Khan, Kim, and Alghathbar [6] proposed a dynamic ID-based remote user authentication scheme and claimed that their scheme can provide user anonymity. However, in this article, the authors demonstrate that either a malicious user or an adversary with a valid smart card can trace any user by eavesdropping on his normal authentication session over the public channel. Therefore, Khan et al.'s scheme fails to provide the privacy service as claimed. Hence, the authors present an improved scheme to overcome its flaw and examine the privacy of the improved scheme by using the smart card-based privacy model. In addition, the security and efficiency of the improved scheme are scrutinized. The conclusive result is that the design of the improved scheme is reasonable in not only both privacy and security aspects but also the performance aspect.

In 2010, Sood-Sarje-Singh proposed two dynamic ID-based remote user authentication schemes. The first schemeis a security improvement of Liao et al.’s scheme and the second scheme is a security improvement of Wang etal.’s scheme. In both cases, the authors claimed that their schemes can resist many attacks. However, we find thatboth schemes have security flaws. In addition, their schemes require a verification table and time-synchronization,making the schemes unfeasible and unsecured for electronic services. In order to remedy the security flaws ofSood et al.’s schemes, we propose a robust scheme which resists the well-known attacks and achieves all thedesirable security goals.

Password authentication is the simplest and the most convenient authentication mechanism that allows a legal user to login the remote system. In 2004, Das et al proposed a dynamic ID-based remote user authentication scheme using smart cards. Later, Liao, Lee, and Hwang made a slight modification to achieve mutual authentication. In this paper, we point out some weaknesses in their scheme such as password independent, smart card loss attacks, masquerade attacks, forgery attacks, denial of service attacks, etc, and propose an improved scheme to withstand these weaknesses. In our scheme, the remote system doesnpsilat need to store the verification table any more. Based on dynamic ID, it allows the user to choose and change their password freely, and can achieve mutual authentication. Comparing with the original scheme, our scheme does not lead additional communication loads and computational costs.

Recently, Li et al. proposed a novel smart card and dynamic ID-based remote user authentication scheme for multi-server environments. They claimed that their scheme can resist several types of attacks. However, through careful analysis, we find that Li et al.’s scheme is vulnerable to stolen smart card and off-line dictionary attacks, replay attacks, impersonation attacks and server spoofing attacks. By analyzing other similar schemes, we find that a certain type of dynamic ID-based multi-server authentication scheme in which only hash functions are used and whereby no registration center participates in the authentication and session key agreement phase faces difficulties in providing perfectly efficient and secure authentication. To compensate for these shortcomings, we propose a novel dynamic ID-based remote user authentication scheme for multi-server environments based on pairing and self-certified public keys. Security and performance analyses show that the proposed scheme is secure against various attacks and has many excellent features.

Recently, Wang et al. proposed a new dynamic ID-based remote user authentication scheme which is an improvement of Das et al.'s scheme. They claimed their scheme is efficient and secure. After thorough analyses, we find Wang et al.'s scheme suffers from masquerade attacks because an attacker can choose an identity at will and be authenticated by the remote server successfully. In this paper, we will demonstrate how to mount masquerade attacks on Wang et al.'s proposed scheme.

In 2004, Das et al. proposed a dynamic identity based remote user authentication scheme. They claimed that their scheme is secure against different attacks. Unfortunately, many researchers demonstrated that Das et al. scheme is vulnerable to various attacks. Furthermore, this scheme does not achieve mutual authentication and thus can not resist malicious server attack. In 2005, Liao et al. improved Das et al.'s scheme and claimed that the improved scheme achieves mutual authentication, withstand password guessing attack and insider attack. In 2006, Yoon and Yoo demonstrated a reflection attack on Liao et al.'s scheme that breaks the mutual authentication. In this paper, we found that Liao et al.'s scheme is also vulnerable to malicious user attack, impersonation attack, stolen smart card attack and offline password guessing attack. Moreover, Liao et al.'s scheme does not maintain the user's anonymity and its password change phase is insecure. This paper presents a secure dynamic identity based authentication scheme using smart cards to resolve the aforementioned problems, while keeping the merits of different dynamic identity based authentication schemes.

Recently, Wang et al. proposed a dynamic ID-based remote user authentication scheme using smart cards. They claimed that their scheme preserves anonymity of a user, has the features of strong password chosen by the server, and protected from several attacks. However, in this paper, we point out that Wang et al.’s scheme has practical pitfalls and is not feasible for real-life implementation. We identify that their scheme: does not provide anonymity of a user during authentication, user has no choice in choosing his password, vulnerable to insider attack, no provision for revocation of lost or stolen smart card, and does provide session key agreement. To remedy these security flaws, we propose an enhanced authentication scheme, which covers all the identified weaknesses of Wang et al.’s scheme and is more secure and efficient for practical application environment.

Dynamic ID-based authentication schemes based on password and smart card are widely used to provide two-factor authentication and user anonymity. However, these schemes have one or the other possible security weaknesses. In this paper, we analyze the schemes of Li et al. and Wang et al. published in recent years. After the analysis, we demonstrates that Li et al.’s schemes are vulnerable to off-line password guessing attack if the user’s identity is compromised, Li et al.’s scheme cannot withstand the impersonation attack and linkability attack, Wang et al.’s schemes cannot resist off-line password guessing attack if the attacker steals a smart card, Wang et al.’s schemes fail to provide forward security. Our result shows that none of the existing dynamic ID based authentication schemes can achieve all the desirable security goals.

Recently, Amin proposed an efficient dynamic ID-based remote user password authentication scheme for multi-server environment. They claimed that his scheme resisted different possible attacks include off-line identity guessing attack, off-line password guessing attack, and smart card stolen attack. However, we find some weaknesses of his scheme in this article. We show that his scheme is vulnerable to off-line identity guessing with smart card stolen attack and off-line password guessing with smart card stolen attack.

We propose a new dynamic ID-based remote user authentication scheme using smart cards, which it is based on one-way hash function, ElGamal’s public key cryptosystem and nonce. The scheme achieves the following security requirements: 1) users can choose and change their password freely, 2) mutual authentication between the user and the server, 3) the user and the server establish a session key after successful authentication process, 4) the server does not maintain a verification table, 5) the login request message does not contain the user’s identity, and 6) the authentication phase does not require time-synchronization, making it more secure than previous schemes. In order to verify the security characteristics of our protocol, we have modelled and analysed the proposal using High-level Protocol Specification Language (HLPSL) and Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. The results demonstrate that our protocol achieves more security requirements than previous works.

Patient can obtain sorts of health-care delivery services via Telecare Medical Information Systems (TMIS). Authentication, security, patient's privacy protection and data confidentiality are important for patient or doctor accessing to Electronic Medical Records (EMR). In 2012, Chen et al. showed that Khan et al.'s dynamic ID-based authentication scheme has some weaknesses and proposed an improved scheme, and they claimed that their scheme is more suitable for TMIS. However, we show that Chen et al.'s scheme also has some weaknesses. In particular, Chen et al.'s scheme does not provide user's privacy protection and perfect forward secrecy, is vulnerable to off-line password guessing attack and impersonation attack once user's smart card is compromised. Further, we propose a secure anonymity authentication scheme to overcome their weaknesses even an adversary can know all information stored in smart card.

Rapid growth of mobile and networking technologies, resulted in new paradigms of networking like Internet of Things (IoT) etc, which allows user to connect to insecure public communication channel through various devices and can access the services and data provided by remote server. Thus, remote user authentication and key agreement for wireless, wired, IoT communications becoming more challenging task. In this context many researchers have proposed authentication schemes. In 2013, An et al. proposed a dynamic ID-based remote user authentication scheme which is secure, even if the secret values stored in the smart card is revealed. In 2014, Troung et al claimed that An et al scheme is vulnerable to server forgery attack and proposed an improved scheme. In this manuscript, we validate that Troung et al's scheme is vulnerable to known session specific temporary information attack, replay and impersonation attack. Furthermore, we also propose the improved scheme to overcome these limitations without increase in the cost front.

Telecare medical information systems (TMIS) enable healthcare delivery services. However, access of these services via public channel raises security and privacy issues. In recent years, several smart card based authentication schemes have been introduced to ensure secure and authorized communication between remote entities over the public channel for the (TMIS). We analyze the security of some of the recently proposed authentication schemes of Lin, Xie et al., Cao and Zhai, and Wu and Xu's for TMIS. Unfortunately, we identify that these schemes failed to satisfy desirable security attributes. In this article we briefly discuss four dynamic ID-based authentication schemes and demonstrate their failure to satisfy desirable security attributes. The study is aimed to demonstrate how inefficient password change phase can lead to denial of server scenario for an authorized user, and how an inefficient login phase causes the communication and computational overhead and decrease the performance of the system. Moreover, we show the vulnerability of Cao and Zhai's scheme to known session specific temporary information attack, vulnerability of Wu and Xu's scheme to off-line password guessing attack, and vulnerability of Xie et al.'s scheme to untraceable on-line password guessing attack.

In 2009, Xu et al. found that Lee et al.’s scheme is defenseless to offline password guessing attack. Xu et al. also indicated that Lee and Chiu’s scheme is unguarded to forgery attack. Moreover, Lee and Chiu’s scheme doesn’t achieve mutual authentication and thus cannot resist malicious server attack. Xu et al. proposed an improved scheme. In 2010 Anil K Sarje et al. shown that Xu et al.’s scheme is vulnerable to forgery attack and proposed an improved scheme which preserves the merits of Xu et al. scheme and resists various attacks. In this paper we will show that Anil K Sarje et al. scheme cannot avoid any of the attacks they claimed that their scheme will resists. We then present our enhanced scheme to fix the vulnerabilities found in Anil K Sarje et al. scheme and various related dynamic identity based authentication schemes while preserving their merits.

In recent years, several dynamic ID-based remote user authentication schemes have been proposed. In 2012, Wen and Li proposed a dynamic ID-based remote user authentication with key agreement scheme. They claimed that their scheme can resist impersonation attack and insider attack and provide anonymity for the users. However, we will show that Wen and Li's scheme cannot withstand insider attack and forward secrecy, does not provide anonymity for the users, and inefficiency for error password login. In this paper, we propose a novel ECC-based remote user authentication scheme which is immune to various known types of attack and is more secure and practical for mobile clients.