A Secure and Anonymous Two-Factor Authentication Protocol in Multiserver Environment

In this paper, we propose a secure two-factor remote user authentication protocol using Elliptic curve cryptography. The proposed protocol provides the mutual authentication of participants, session key agreement and user anonymity. The security of our proposed protocol is based on one way hash function and elliptic curve cryptosystem and it is secure against all relevant security attacks. Compared with other relevant protocol, the security analysis and performance evaluation show that our proposed protocol can provide high level of security with less communication and computation cost. In addition, the BAN logic is applied to demonstrate the validity of the proposed protocol.

Wireless sensor networks (WSN) are widely used to provide users with convenient services such as health-care, and smart home. To provide convenient services, sensor nodes in WSN environments collect and send the sensing data to the gateway. However, it can suffer from serious security issues because susceptible messages are exchanged through an insecure channel. Therefore, secure authentication protocols are necessary to prevent security flaws in WSN. In 2020, Moghadam et al. suggested an efficient authentication and key agreement scheme in WSN. Unfortunately, we discover that Moghadam et al.’s scheme cannot prevent insider and session-specific random number leakage attacks. We also prove that Moghadam et al.’s scheme does not ensure perfect forward secrecy. To prevent security vulnerabilities of Moghadam et al.’s scheme, we propose a secure and lightweight mutual authentication protocol for WSNs (WSN-SLAP). WSN-SLAP has the resistance from various security drawbacks, and provides perfect forward secrecy and mutual authentication. We prove the security of WSN-SLAP by using Burrows-Abadi-Needham (BAN) logic, Real-or-Random (ROR) model, and Automated Verification of Internet Security Protocols and Applications (AVISPA) simulation. In addition, we evaluate the performance of WSN-SLAP compared with existing related protocols. We demonstrate that WSN-SLAP is more secure and suitable than previous protocols for WSN environments.

A secure light weight scheme for user authentication and key agreement in multi-gateway based wireless sensor networks

The main contribution of this paper is to analyze a secure passwordauthentication mechanism (SPAM), proposed by Chuang et al. in 2013(IEEE Syst J.). The SPAM was used for designing a secure handover inProxy Mobile IPv6 (PMIPv6) networks. Chuang et al. in the originalpaper claimed that SPAM provides high security properties and canresist various attacks. However, in this paper we point out thatSPAM is vulnerable to the critical attacks, such as stolen smartcard and off-line dictionary attack, replay attack and impersonationattack. In addition, we show that the identity of MNs and thesession key between MN and MAG can be disclosed by an insiderattacker; resultantly, anonymity and confidentiality between MNs andMAG will be completely broken in SPAM. As a remedy, we also propose an improved scheme which not only conquers the problems of the previous schemes but also provides a reduction in computational cost. Moreover, the proposed scheme provides the user anonymity and untraceability and secure session key agreement. Finally, the security of the improved protocol is proved in the random oracle model.DOI: http://dx.doi.org/10.5755/j01.itc.46.2.12118

In 2014, Arshad and Nikooghadam proposed an authentication and key agreement scheme for SIP to conquer the existing defects in Irshad et al.'s scheme. They claimed that their scheme resists various security attacks and has low computation cost. We found that even though Arshad et al.'s scheme achieves high efficiency, their scheme is insecure against server spoofing attacks, denial of service attacks and privilege insider attacks. Furthermore, the password change phase of their scheme is complicated and their scheme cannot provide user anonymity. To overcome the weaknesses of Arshad et al.'s scheme, we proposed an anonymous and secure authentication and key agreement protocol for SIP. Compared with Arshad et al.'s scheme, our scheme not only withstands more security attacks, but also achieves user anonymity and high efficiency.

Recently, Li et al. proposed a novel smart card and dynamic ID-based remote user authentication scheme for multi-server environments. They claimed that their scheme can resist several types of attacks. However, through careful analysis, we find that Li et al.’s scheme is vulnerable to stolen smart card and off-line dictionary attacks, replay attacks, impersonation attacks and server spoofing attacks. By analyzing other similar schemes, we find that a certain type of dynamic ID-based multi-server authentication scheme in which only hash functions are used and whereby no registration center participates in the authentication and session key agreement phase faces difficulties in providing perfectly efficient and secure authentication. To compensate for these shortcomings, we propose a novel dynamic ID-based remote user authentication scheme for multi-server environments based on pairing and self-certified public keys. Security and performance analyses show that the proposed scheme is secure against various attacks and has many excellent features.

With the development of intelligent transportation systems, the large-scale deployment of Roadside Units (RSUs) poses higher demands on the security, efficiency, and scalability of authentication and key agreement. However, the open wireless communication environment in intelligent transportation poses a significant security challenge, necessitating a reliable authentication and key agreement scheme to safeguard data on public channels from adversarial forgery and tampering. Nevertheless, in most conventional approaches, RSUs typically authenticate each other through the cloud. As the density of roadside units increases, cloud-based centralized authentication schemes face efficiency constraints due to computational and communication limitations. To address this issue, our paper introduces a security-enhanced and efficient cloud authentication and key agreement protocol. RSUs achieve mutual authentication using pre-shared keys and ECC-based public-private key pairs issued by the cloud, and subsequently establish session keys. Furthermore, this paper introduces a group key used to securely broadcast fundamental security messages among all members within a single RSU domain. The group key is updated whenever RSUs join or leave the group, ensuring that former members cannot access ongoing communications. Our scheme is rigorously evaluated through BAN logic and heuristic analysis, demonstrating robust security while simultaneously establishing superior computational and communication efficiency compared to existing approaches.

Remote user authentications are an essential tool for e-commerce in Internet environment. In these systems, identity privacy is provided by concealing user's identity. In this article, we introduce the identity privacy study of this setting, and explore a secure and efficient dynamic ID-based remote user authentication protocol with untraceability. We adapt a pair of dynamic IDs to realize the user's anonymity, and present a novel nonce-based authentication approach. Our protocol eliminates all identified security flaws in original protocols. Furthermore, high performance and other good functionalities are preserved.

Designing a user authentication protocol with anonymity for the global mobility network (GLOMONET) is a difficult task because wireless networks are susceptible to attacks and each mobile user has limited power, processing and storage resources. In this paper, a secure and lightweight user authentication protocol with anonymity for roaming service in the GLOMONET is proposed. Compared with other related approaches, our proposal has many advantages. Firstly, it uses low-cost functions such as one-way hash functions and exclusive-OR operations to achieve security goals. Having this feature, it is more suitable for battery-powered mobile devices. Secondly, it uses nonces instead of timestamps to avoid the clock synchronization problem. Therefore, an additional clock synchronization mechanism is not needed. Thirdly, it only requires four message exchanges between the user, foreign agent and home agent. Further, the security properties of our protocol are formally validated by a model checking tool called AVISPA. We also demonstrate that this protocol enjoys important security attributes including prevention of various attacks, single registration, user anonymity, no password table, and high efficiency in password authentication. Security and performance analyses show that compared with other related authentication schemes, the proposed scheme is more secure and efficient.

This paper introduces a new scheme, called Augmented Password AKE (APAKE), for authenticated key exchange protocols. In APAKE, a password is represented by a pair of values that is randomly selected in a huge space.We present an APAKE protocol. The protocol is secure against the attacks including offline dictionary attack and server compromise allowing for subsequent off-line dictionary attack. The protocol has a pass number of two, and it requires minor computational amounts. We also present a EKE protocol de-signed by simple modification of the APAKE protocol while preserving the security of the APAKE protocol.KeywordsHash FunctionPast CommunicationDictionary AttackCryptographic FunctionInteger Factorization ProblemThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

User anonymity is one of the key security features of an authenticated key agreement especially for communicating messages via an insecure network. Owing to the better properties and higher performance of chaotic theory, the chaotic maps have been introduced into the security schemes, and hence numerous key agreement schemes have been put forward under chaotic-maps. Recently, Xie et al. released an enhanced scheme under Farash et al.’s scheme and claimed their improvements could withstand the security loopholes pointed out in the scheme of Farash et al., i.e., resistance to the off-line password guessing and user impersonation attacks. Nevertheless, through our careful analysis, the improvements were released by Xie et al. still could not solve the problems troubled in Farash et al‥ Besides, Xie et al.’s improvements failed to achieve the user anonymity and the session key security. With the purpose of eliminating the security risks of the scheme of Xie et al., we design an anonymous password-based three-party authenticated key agreement under chaotic maps. Both the formal analysis and the formal security verification using AVISPA are presented. Also, BAN logic is used to show the correctness of the enhancements. Furthermore, we also demonstrate that the design thwarts most of the common attacks. We also make a comparison between the recent chaotic-maps based schemes and our enhancements in terms of performance.

Three party secure data transmission in IoT networks through design of a lightweight authenticated key agreement scheme

Because sensor nodes are deployed in public areas, these sensors are easy to capture by adversaries. Once a sensor is stolen, the sensitive information stored in it is likely to be exposed. Accordingly, designing a secure authentication protocol should consider this issue. Sadri et al. recently proposed a two-factor authentication protocol with anonymity for wireless sensor networks. Unfortunately, we found that their protocol had a design flaw in the user and sensor authentication phase. Besides, their protocol can not resist stolen smart card attacks, sensor capture attacks, and user impersonation attacks. In addition, their protocol does not provide perfect forward security. This paper proposes a provably secure authentication to overcome these weaknesses and flaws. By comparing the security and performance of the proposed protocol with other related protocols, we find that our work has reasonable computation overhead and better security.

A Biometric Authentication Security (BAS) protocol is a method by which a person's unique physiological or behavioral characteristics are used to verify their identity. These characteristics can include fingerprints, facial features, voice patterns, and more. Biometric authentication has become increasingly popular in recent years due to its convenience and perceived security benefits. However, ensuring that the BAS protocols are secure and cannot be easily compromised. . Developing a highly secure biometric authentication protocol is challenging, and proving its correctness is another challenge. In this work, we present a modern mechanism for formally analyzing biometric authentication security protocol by taking a Aadhaar Level-0 Iris-based Authentication Protocol as a use case. The mechanism uses formal methods to formally verify the security of the Aadhaar Level-0 Iris-based Authentication protocol, and is based on the widely-used BAN logic (Buruccu, Abadi, and Needham). Using Scyther model checker we analyze the existing biometric authentication protocol and have shown its effectiveness in identifying potential security vulnerabilities. The proposed mechanism is based on a set of security requirements that must be met for the protocol to be considered secure. These requirements include the need for the protocol to be resistant to replay attacks, man-in-the-middle attacks, and impersonation attacks. The mechanism also considers the possibility of an attacker obtaining the biometric data of a legitimate user.

EGHR: Efficient group-based handover authentication protocols for mMTC in 5G wireless networks