Cryptanalysis of an Improvement of a Biometrics-Based Remote User Authentication Scheme using Smart Cards

A robust anonymous biometric-based remote user authentication scheme using smart cards

A rise of prevalence ageing population and chronic diseases in Saudi Arabia, patients need to be regular face-to-face meet Doctors/physicians for consultation and treatment. Telecare Medical Information System (TMIS) enables patients to gain remote access their medical information and medical services. Patient authentication and privacy-preserving have become more challenging. Recently, some biometric based remote user authentication schemes using smart cards for TMIS have been proposed. The schemes are not secure against the tampering and theft by way of a stored biometric template, privilege insider attack, and stolen/lost the smart card. Furthermore, these schemes have computation and communication costs overruns. This paper presents an improved efficient and secure biometric remote user authentication scheme with renewability and anonymity has been proposed to remedy the weakness of these schemes. The security analysis and performance comparison of the proposed scheme is formally given and showed the advantages over these schemes.

BIAS: A novel secure and efficient biometric-based anonymous authentication scheme

Recently, biometric-based remote user authentication schemes along with passwords have drawn considerable attention in research. In 2011, Das proposed an improvement on an efficient biometric-based remote user authentication scheme using smart cards and claimed his scheme could resist various attacks. However, there are some weaknesses in Das’s scheme such as the privileged insider attack and the off-line password guessing attack. Besides, Das’s scheme also cannot provide user anonymity. To overcome these weaknesses, we shall propose a secure biometric-based remote user authentication with key agreement scheme using extended chaotic maps. The proposed scheme not only can resist the above-mentioned attacks, but also provide user anonymity.

Remote user authentication is a mechanism in which the remote server verifies the legitimacy of a user over an insecure communication channel. Password based authentication schemes have been widely deployed to verify the legitimacy of remote users as password authentication is one of the simplest and the most convenient authentication mechanism over insecure networks. In remote user authentication scheme, the user is assigned a smart card, which is being personalized by some parameters and provide the legal users to use the resources of the remote system. Until now, there have been ample of remote user authentication schemes published in the literature and each published schemes have its own merits and demerits. Recently, many schemes proposed are based on the one-way hash function. The computational complexity of their schemes is superior to the discrete logarithm-problem-based schemes. In our paper, we have defined all the security requirements and the goals. An ideal password authentication schemes should satisfy and achieve all of these. We have presented the results of our survey through five of the currently available secure one way hash function based remote user authentication schemes. We hope an ideal smart card (not storing (ID i ,PW i ), which meets all the security requirements and achieves all the goals can be developed.

In a distributed environment, one of the major concerns is authentication of remote users. In this sector, legitimate users are more powerful attackers. The remote systems working with password and smart card ensures authorised access. Smart card based remote user authentication schemes have been adopted due to their low computation cost and portability. In 2012, Wen and Li proposed an improved dynamic ID based remote user authentication with key agreement scheme. They stated that their scheme provides protection against impersonation attack and preserves secret information. In this paper, we unveil the drawbacks of Wen and Li's scheme. Also we show that their scheme does not detect wrong password quickly, making it vulnerable to insider and smart card stolen attack. Further the scheme provides no protection for forward secrecy. To solve these security weaknesses, we propose a robust authentication scheme which overcomes all the pointed flaws, by keeping eminence of Wen and Li's scheme.

Mutual authentication has been widely used to verify the legal user and server over a common communication channel. To ensure secure connection between user and server, a large number of remote mutual authentication schemes for multi-server have been proposed by researchers. However, there is a common feature that the identity of user is static in the login phase, which may leak some information of user. Therefore, a good deal of smart card based anonymous multi-server remote user authentication scheme have been proposed to overcome this problem. Recently, Banerjee et al. pointed out that Li et al.’s scheme is vulnerable to user impersonates attack and stolen smart card attack. Later, they proposed an improved protocol to fix this problem. However, we found that Banerjee et al.’s scheme is still vulnerable to user impersonation attack and off-line password guessing attack. Finally, we proposed an enhanced scheme to eliminate the security vulnerability.

In a remote user authentication scheme, a remote server verifies whether a login user is genuine and trustworthy. Several remote user authentication schemes using the password, the biometrics and the smart card have been proposed in the literature. In 2012, Sonwanshi et al. proposed a password-based remote user authentication scheme using smart card, which uses the hash function and bitwise XOR operation. Their scheme is very efficient because of the usage of efficient one-way hash function and bitwise XOR operations. They claimed that their scheme is secure against several known attacks. Unfortunately, in this paper we find that their scheme has several vulnerabilities including the offline password guessing attack and stolen smart card attack. In addition, we show that their scheme fails to protect strong replay attack.

Remote user authentication is important to identify whether communicating parties are genuine and trust- worthy using the password and the smart card between a login user and a remote server. A number of password-based authentication schemes using smart cards have been proposed in recent years. We find that two most recent password-based authentication schemes (Hsiang and Shih 2009, Chen and Huang 2010) assume that the attacker cannot extract the secret information of the smart card. However, in reality, the authors in (Kocher et al. 1999 and Messerges et al. 2002) show that the secrets stored in the card can be extracted by monitoring its power consumption. Therefore, these schemes fail to resist smart card security breach. As the main contribution of this paper, a robust remote user authentication scheme against smart card security breach is presented, while keeping the merits of the well-known smart card based authentication schemes.http://dx.doi.org/10.5755/j01.itc.40.3.632

ABSTRACTIn password‐based or two‐factor (password and smart card) authentications, password changing is one of common techniques used to improve the security of the systems protected by the password. However, the password‐changing operations in existing password authentications either depend on the login phase or violate the common practice that an old password should not be valid for subsequent login after being updated. On the other hand, password mistyping is very common in reality, which may be random or be skewed by the adversary via technical means or social engineering manipulation [i.e., a kind of denial‐of‐service (DoS) attack]. In human‐centric authentication mechanisms, password changing and DoS resilience are not marginal issues. The paper addresses the requirements of robust password changing in authentication and presents , a password authentication scheme with robust password changing, DoS resilience, and card‐compromise security. Thus, the proposal can be viewed as a suitable candidate instantiation for authentication services of human‐centric security, by embedding in the computer and software systems. also achieves other appealing features, such as self‐healing ability and strong privacy protection, which may be useful for human‐centric applications. Copyright © 2013 John Wiley & Sons, Ltd.

In conventional single-server environment, a user must register to every server if he/she wants to access numerous network services. It is exceedingly hard for users to generate different robust passwords and remember them with corresponding identities. To solve this problem, many multi-server authentication schemes have been proposed in recent years. In 2017, Chang et al. improved Chuang and Chen’s scheme, arguing that their scheme provides higher security and practicability. However, we demonstrate that Chang et al.’s scheme is still vulnerable to outsider attack and session key derived attack. In addition, we also find that both malicious user and server can carry out user impersonation attack in their scheme. In this paper, we propose a new biometrics-based authentication scheme that is suitable for use in multi-server environment. Finally, we show that the proposed scheme improves on the level of security in comparison with related schemes.

In 2004, Das et al. proposed a dynamic identity based remote user authentication scheme. They claimed that their scheme is secure against different attacks. Unfortunately, many researchers demonstrated that Das et al. scheme is vulnerable to various attacks. Furthermore, this scheme does not achieve mutual authentication and thus can not resist malicious server attack. In 2005, Liao et al. improved Das et al.'s scheme and claimed that the improved scheme achieves mutual authentication, withstand password guessing attack and insider attack. In 2006, Yoon and Yoo demonstrated a reflection attack on Liao et al.'s scheme that breaks the mutual authentication. In this paper, we found that Liao et al.'s scheme is also vulnerable to malicious user attack, impersonation attack, stolen smart card attack and offline password guessing attack. Moreover, Liao et al.'s scheme does not maintain the user's anonymity and its password change phase is insecure. This paper presents a secure dynamic identity based authentication scheme using smart cards to resolve the aforementioned problems, while keeping the merits of different dynamic identity based authentication schemes.

In 2005, Yoon et al. proposed a user-friendly remote user authentication scheme using smart cards. The security of their scheme is based on one-way hash function and they claimed that their scheme is secured from attacks and achievable for proving mutual authentication, freely choosing password, no verification tables, and involving very lightweight hashing operations. However, we find that Yoon et al.'s scheme suffers from the denial of service attack and performs only unilateral authentication (only user authentication). In this paper we consequently propose an enhanced version to eliminate the vulnerability. Furthermore, our enhanced scheme can also provide mutual authentication and key agreement between a remote server and login users.

Authentication is a ubiquitous task in users' daily lives. The dominant form of user authentication are text passwords. They protect private accounts like online banking, gaming, and email, but also assets in organisations. Yet, many issues are associated with text passwords, leading to challenges faced by both, users and organisations. This thesis contributes to the body of research enabling secure and usable user authentication, benefiting both, users and organisations. To that end, it addresses three distinct challenges. The first challenge addressed in this thesis is the creation of correct, complete, understandable, and effective password security awareness materials. To this end, a systematic process for the creation of awareness materials was developed and applied to create a password security awareness material. This process comprises four steps. First, relevant content for an initial version is aggregated (i.e. descriptions of attacks on passwords and user accounts, descriptions of defences to these attacks, and common misconceptions about password and user account security). Then, feedback from information security experts is gathered to ensure the correctness and completeness of the awareness material. Thereafter, feedback from lay-users is gathered to ensure the understandability of the awareness material. Finally, a formal evaluation of the awareness material is conducted to ensure its effectiveness (i.e. whether the material improves participant's ability to assess the security of passwords as well as password-related behaviour and decreases the prevalence of common misconceptions about password and user account security). The results of the evaluation show the effectiveness of the awareness material: it significantly improved the participants' ability to assess the security of password-related behaviour as well as passwords and significantly decreased the prevalence of misconceptions about password and user account security. The second challenge addressed in this thesis is shoulder-surfing resistant text password entry with gamepads (as an example of very constrained input devices) in shared spaces. To this end, the very first investigation of text password entry with gamepads is conducted. First, the requirements of authentication in the gamepad context are described. Then, these requirements are applied to assess schemes already deployed in the gamepad context and shoulder-surfing resistant authentication schemes from the literature proposed for non-gamepad contexts. The results of this assessment show that none of the currently deployed and only four of the proposals in the literature fulfil all requirements. Furthermore, the results of the assessment also indicate a need for an empirical evaluation in order to exactly gauge the shoulder-surfing threat in the gamepad context and compare alternatives to the incumbent on-screen keyboard. Based on these results, two user studies (one online study and one lab study) are conducted to investigate the shoulder-surfing resistance and usability of three authentication schemes in the gamepad context: the on-screen keyboard (as de-facto standard in this context), the grid-based scheme (an existing proposal from the literature identified as the most viable candidate adaptable to the gamepad context during the assessment), and Colorwheels (a novel shoulder-surfing resistant authentication scheme specifically designed for the gamepad context). The results of these two user studies show that on-screen keyboards are highly susceptible to opportunistic shoulder-surfing, but also show the most favourable usability properties among the three schemes. Colorwheels offers the most robust shoulder-surfing resistance and scores highest with respect to participants' intention to use it in the future, while showing more favourable usability results than the grid-based scheme. The third challenge addressed in this thesis is secure and efficient storage of passwords in portfolio authentication schemes. Portfolio authentication is used to counter capture attacks such as shoulder-surfing or eavesdropping on network traffic. While usability studies of portfolio authentication schemes showed promising results, a verification scheme which allows secure and efficient storage of the portfolio authentication secret had been missing until now. To remedy this problem, the (t,n)-threshold verification scheme is proposed. It is based on secret sharing and key derivation functions. The security as well as the efficiency properties of two variants of the scheme (one based on Blakley secret sharing and one based on Shamir secret sharing) are evaluated against each other and against a naive approach. These evaluations show that the two (t,n)-threshold verification scheme variants always exhibit more favourable properties than the naive approach and that when deciding between the two variants, the exact application scenario must be considered. Three use cases illustrate as exemplary application scenarios the versatility of the proposed (t,n)-threshold verification scheme. By addressing the aforementioned three distinct challenges, this thesis demonstrates the breadth of the field of usable and secure user authentication ranging from awareness materials, to the assessment and evaluation of authentication schemes, to applying cryptography to craft secure password storage solutions. The research processes, results, and insights described in this thesis represent important and meaningful contributions to the state of the art in the research on usable and secure user authentication, offering benefits for users, organisations, and researchers alike.

A remote user authentication scheme is a two-party protocol whereby an authentication server in a distributed system confirms the identity of a remote individual logging on to the server over an untrusted, open network. Recently, Lee et al. have proposed an efficient nonce-based scheme for remote user authentication using smart cards. This work reviews Lee et al.'s authentication scheme and provides a security analysis on the scheme. Our analysis shows that Lee et al.'s scheme does not achieve its basic aim of authenticating remote users and furthermore has a very hazardous method for changing passwords. In addition, we recommend some changes to the scheme so that it can attain at least its main security goal.