A Smart-Card-Based Remote User Authentication Protocol with Privacy Support

With advancement of computer community and widespread dissemination of network applications, users generally need multiple servers to provide different services. Accordingly, the multiserver architecture has been prevalent, and designing a secure and efficient remote user authentication under multiserver architecture becomes a nontrivial challenge. In last decade, various remote user authentication protocols have been put forward to correspond to the multi-server scenario requirements. However, these schemes suffered from certain security problems or their cost consumption exceeded users' own constrained ability. In this paper, we present an anonymous remote user authentication with key agreement scheme for multi-server architecture employing self-certified public keys without pairings. The proposed scheme can not only retain previous schemes' advantages but also achieve user privacy concern. Moreover, our proposal can gain higher efficiency by removing the pairings operation compared with the related schemes. Through analysis and comparison with the related schemes, we can say that our proposal is in accordance with the scenario requirements and feasible to the multi-server architecture.

In recent years, several dynamic ID-based remote user authentication schemes have been proposed. In 2012, Wen and Li proposed a dynamic ID-based remote user authentication with key agreement scheme. They claimed that their scheme can resist impersonation attack and insider attack and provide anonymity for the users. However, we will show that Wen and Li's scheme cannot withstand insider attack and forward secrecy, does not provide anonymity for the users, and inefficiency for error password login. In this paper, we propose a novel ECC-based remote user authentication scheme which is immune to various known types of attack and is more secure and practical for mobile clients.

In recent 2012, Wen and Li.'s has presented a dynamic ID-based remote user authentication with key agreement scheme. They claimed that their scheme can resisted insider attack and provide anonymity for the users. However, Juan Qu and Li-min Zou., described that Wen and Li.'s scheme could not withstand insider attack, does not provide anonymity for the users, and inefficiency for error password login. A different approach to symmetric cryptology is taken in this study to resolve the fore was made Compared to Juan Qu and Li-min Zou scheme, a different approach was made with symmetric cryptology in this study to supplement the forementioned weak points. We propose an enhanced authentication scheme, which covers all the identified weakness of Wen and Li.'s scheme and an efficient user authentication scheme that preserve perfect anonymity to both the outsider and remote server.

Recently, Li et al. proposed a novel smart card and dynamic ID-based remote user authentication scheme for multi-server environments. They claimed that their scheme can resist several types of attacks. However, through careful analysis, we find that Li et al.’s scheme is vulnerable to stolen smart card and off-line dictionary attacks, replay attacks, impersonation attacks and server spoofing attacks. By analyzing other similar schemes, we find that a certain type of dynamic ID-based multi-server authentication scheme in which only hash functions are used and whereby no registration center participates in the authentication and session key agreement phase faces difficulties in providing perfectly efficient and secure authentication. To compensate for these shortcomings, we propose a novel dynamic ID-based remote user authentication scheme for multi-server environments based on pairing and self-certified public keys. Security and performance analyses show that the proposed scheme is secure against various attacks and has many excellent features.

Rapid growth of mobile and networking technologies, resulted in new paradigms of networking like Internet of Things (IoT) etc, which allows user to connect to insecure public communication channel through various devices and can access the services and data provided by remote server. Thus, remote user authentication and key agreement for wireless, wired, IoT communications becoming more challenging task. In this context many researchers have proposed authentication schemes. In 2013, An et al. proposed a dynamic ID-based remote user authentication scheme which is secure, even if the secret values stored in the smart card is revealed. In 2014, Troung et al claimed that An et al scheme is vulnerable to server forgery attack and proposed an improved scheme. In this manuscript, we validate that Troung et al's scheme is vulnerable to known session specific temporary information attack, replay and impersonation attack. Furthermore, we also propose the improved scheme to overcome these limitations without increase in the cost front.

Very recently, Khan, Kim, and Alghathbar [6] proposed a dynamic ID-based remote user authentication scheme and claimed that their scheme can provide user anonymity. However, in this article, the authors demonstrate that either a malicious user or an adversary with a valid smart card can trace any user by eavesdropping on his normal authentication session over the public channel. Therefore, Khan et al.'s scheme fails to provide the privacy service as claimed. Hence, the authors present an improved scheme to overcome its flaw and examine the privacy of the improved scheme by using the smart card-based privacy model. In addition, the security and efficiency of the improved scheme are scrutinized. The conclusive result is that the design of the improved scheme is reasonable in not only both privacy and security aspects but also the performance aspect.

Recently, drones have gained significant importance in various fields, such as military applications, healthcare, smart agriculture, and traffic monitoring. Equipped with embedded systems capable of sensing, collecting, and transmitting data in real time via public communication channels, drones enable the flow of confidential and sensitive information into cyberspace. However, this poses a risk of data being compromised during transmission over unsecured public channels. To mitigate such risks, many mutual authentication schemes have been proposed. Nevertheless, existing solutions still face security and performance limitations. In response, we propose the design of two lightweight and secure remote user authentication protocols and a key agreement for the Internet of Drones (IoD) environment. The first protocol, P-I, allows users and drones to mutually authenticate each other, establishing a secure and reliable connection. The second protocol, P-II, serves to re-authenticate authorized users, achieving a balance between security and performance. Both protocols utilize hash functions to enhance security and efficiency. We analyze the proposed protocols and conduct an informal security analysis and performance evaluation, focusing on security features, computational overhead, and communication efficiency. Our findings demonstrate that the proposed protocols outperform existing solutions by meeting all security requirements, achieving effective re-authentication, resisting both active and passive attacks, and providing suitable performance for IoD environments.

Password authentication is the simplest and the most convenient authentication mechanism that allows a legal user to login the remote system. In 2004, Das et al proposed a dynamic ID-based remote user authentication scheme using smart cards. Later, Liao, Lee, and Hwang made a slight modification to achieve mutual authentication. In this paper, we point out some weaknesses in their scheme such as password independent, smart card loss attacks, masquerade attacks, forgery attacks, denial of service attacks, etc, and propose an improved scheme to withstand these weaknesses. In our scheme, the remote system doesnpsilat need to store the verification table any more. Based on dynamic ID, it allows the user to choose and change their password freely, and can achieve mutual authentication. Comparing with the original scheme, our scheme does not lead additional communication loads and computational costs.

In 2005, Lee et al. proposed a secure smart card based remote user authentication scheme to improve the security of Chien et al.'s scheme. More recently, Sood et al. pointed out that Lee et al.'s scheme is still vulnerable to the reflection attack, off-line password guessing attack, user impersonation attack and fails to preserve user anonymity. Consequently, Sood et al. proposed a more secure remote user authentication scheme, which is an improvement over Lee et al.'s scheme to overcome their security drawbacks. In this study, however, we find that Sood et al.'s scheme still cannot achieve the claimed security and report its following flaws: (1) It fails to preserve user anonymity under their non-tamper resistance assumption of the smart card; (2) It cannot withstand stolen-verifier attack. The proposed cryptanalysis discourages any use of the scheme for practical applications.

Remote user authentication is a very important mechanism in the network system to verify the correctness of remote user and server over the insecure channel. In remote user authentication, server and user mutually authenticate each other and draw a session key. In 2012, An presented a biometric based remote user authentication scheme and claimed that his scheme is secure. In this article, we analyze An's scheme and show that his scheme is vulnerable to known session specific temporary information attack, forward secrecy attack. Moreover, we also identify that An's scheme fails to ensure efficient login phase and user anonymity. Recently, Li et al. also presented a biometric based three-factor remote user authentication scheme with key agreement. They claimed that their scheme provides three-factor remote user authentication. However, we analyze and find that scheme does not achieve three-factor remote user authentication and also fails to satisfy key security attributes. Further, the article presents an improved anonymous authentication scheme which eliminates all the drawbacks of An's and Li et al.'s scheme. Moreover, proposed scheme presents efficient login and password change mechanism where incorrect password input can be quickly detected and user can freely change his password.

Forward secrecy is one of the important properties of remote user authentication schemes to limit the effects of eventual failure of the entire system when the long-term private keys of one or more parties are compromised. Recently, Tsai et al. showed that Wang et al.’s dynamic ID-based remote user authentication scheme fails to achieve user anonymity and is vulnerable to user impersonation attack, and proposed an enhanced version to overcome all the identified flaws. In this paper, however, we will point out that, Tsai et al.’s scheme still suffers from the denial of service attack and cannot provide forward secrecy. To remedy these security flaws, we propose an enhanced authentication scheme, which covers all the identified weaknesses of Tsai et al.’s scheme and is more suitable for mobile application scenarios where resource constrained and security concerned.KeywordsPassword-basedAuthentication protocolNon-tamper resistantSmart cardCryptanalysisDenial of service attack

This paper proposes an efficient three-factor remote user authentication scheme based on random projected biometrics. Similarity-preserving property of random projection overcomes the sensitivity of one-way hash to the intra-class variation of biometric. Furthermore, special random projection is a non-invertible transformation and the seed of random matrix can be easily changed so that privacy protection and biometric changeability are guaranteed. The templates are matched on the client side to resist insider attacks. Besides, both the computational burden of server and the communication load via channel are alleviated. The comprehensive analysis indicates that the proposed scheme is secure.

A rise of prevalence ageing population and chronic diseases in Saudi Arabia, patients need to be regular face-to-face meet Doctors/physicians for consultation and treatment. Telecare Medical Information System (TMIS) enables patients to gain remote access their medical information and medical services. Patient authentication and privacy-preserving have become more challenging. Recently, some biometric based remote user authentication schemes using smart cards for TMIS have been proposed. The schemes are not secure against the tampering and theft by way of a stored biometric template, privilege insider attack, and stolen/lost the smart card. Furthermore, these schemes have computation and communication costs overruns. This paper presents an improved efficient and secure biometric remote user authentication scheme with renewability and anonymity has been proposed to remedy the weakness of these schemes. The security analysis and performance comparison of the proposed scheme is formally given and showed the advantages over these schemes.

Recently, the incorporation of state-of-the-art technology such as Electronic Healthcare Records (EHRs), networks, and cloud computing has transformed the traditional healthcare system. However, security problems have arisen as a result of the integration of technology. Secure remote user authentication is a core part of the healthcare system to validate the user’s identification via an unsecured communication network. Since then, several remote user authentication schemes have been presented, each with its own set of pros and limitations. As a result, security, malicious attacks, and privacy concerns are considered one of the main challenges related to the healthcare system. In this paper, we propose a safe user authentication scheme for patients in the healthcare system that overcomes these flaws and confirms the security of the proposed work using scyther, a formal security tool. In the healthcare environment, our work provides an effective means to construct an environment capable of setting, registering, storing, searching, analyzing, authentication, and verifying electronic healthcare information in order to protect the information of patients. Furthermore, our suggested scheme uses symmetric encryption based on the crypto-hash function for accessing the anomaly of the patient’s identity and One-Time Password (OTP). Towards the end of the study, the performance analysis results indicate a delicate balance of security and performance that is frequently lacking in previous works.

Recently, Wang et al. proposed a new dynamic ID-based remote user authentication scheme which is an improvement of Das et al.'s scheme. They claimed their scheme is efficient and secure. After thorough analyses, we find Wang et al.'s scheme suffers from masquerade attacks because an attacker can choose an identity at will and be authenticated by the remote server successfully. In this paper, we will demonstrate how to mount masquerade attacks on Wang et al.'s proposed scheme.