Efficient and complete remote authentication scheme with smart cards

This paper proposes an efficient three-factor remote user authentication scheme based on random projected biometrics. Similarity-preserving property of random projection overcomes the sensitivity of one-way hash to the intra-class variation of biometric. Furthermore, special random projection is a non-invertible transformation and the seed of random matrix can be easily changed so that privacy protection and biometric changeability are guaranteed. The templates are matched on the client side to resist insider attacks. Besides, both the computational burden of server and the communication load via channel are alleviated. The comprehensive analysis indicates that the proposed scheme is secure.

The smart card-based user authentication scheme is a simple and user-friendly scheme, which establishes the secure and authorized communication over the open channel. In this paper, we have intimated an efficient remote user authentication scheme for the multiserver environment. Many password-based authentication schemes have been suggested for the multiserver environment using the smart card. We have analyzed Lee et al.’s scheme and observed that this scheme could not withstand online password guessing attack and offline password guessing attack. And also, it cannot achieve session key security and mutual authentication. The suggested scheme overcomes the weaknesses of the Lee et al.’s scheme and provides more security.

A rise of prevalence ageing population and chronic diseases in Saudi Arabia, patients need to be regular face-to-face meet Doctors/physicians for consultation and treatment. Telecare Medical Information System (TMIS) enables patients to gain remote access their medical information and medical services. Patient authentication and privacy-preserving have become more challenging. Recently, some biometric based remote user authentication schemes using smart cards for TMIS have been proposed. The schemes are not secure against the tampering and theft by way of a stored biometric template, privilege insider attack, and stolen/lost the smart card. Furthermore, these schemes have computation and communication costs overruns. This paper presents an improved efficient and secure biometric remote user authentication scheme with renewability and anonymity has been proposed to remedy the weakness of these schemes. The security analysis and performance comparison of the proposed scheme is formally given and showed the advantages over these schemes.

In 2004, Ku et al. proposed an improved efficient remote authentication scheme using smart cards to repair the security pitfalls found in Chien et al.’s scheme, in which only few hashing operations are required. Later, Yoon et al. presented an enhancement on Ku et al.’s scheme. Recently, Wang et al. showed that both Ku et al.’s scheme and Yoon et al.’s scheme are still vulnerable to the guessing attack, forgery attack and denial of service (DoS) attack. Then, proposed an efficient improvement over Ku et al.’s and Yoon et al.’s schemes with more security. In this paper, we state that Wang et al.’s scheme is vulnerable to the impersonation attack and parallel session attack. A modification to enhance the security of Wang et al.’s scheme is proposed. Our scheme is suitable for applications with high security requirement.

As the technology of mobile devices spreads fast, the price of mobile devices is getting cheaper. Most of the people have mobile devices, and these devices have the technology of near field communication (NFC). With the long time development and research, the mobile devices use NFC technology on the payment and authentication applications, and replace the smartcard, the access control card, and the credit card by using the card emulation mode. It helps the development of NFC applications. In recent years, more and more users begin using NFC technology on mobile payment and authentication. Many researches have proposed the related NFC authentication protocols, but their schemes are still lack of some security properties and functions, which are necessary for NFC authentication protocols. In this paper, we propose a secure and efficient NFC authentication scheme between two NFC devices by the help of the authentication server that provides mutual authentication.

In 1999, Hwang and Li proposed a new user authentication scheme using smart cards. The scheme does not need any password or verification table. Later, Sun proposed an efficient remote use authentication scheme to improve the efficiency of the Hwang-Li scheme. However, these two schemes do not allow users to freely choose and change their passwords. In this article, we shall propose a simple and efficient remote user authentication scheme that allows users to freely choose and change their passwords without significantly increasing the computation cost.

Agent technology is emerging as a new software paradigm in the areas of distributed computing. The use of multiple agents is a common technique in agent-based systems. In distributed agent systems, for secure communication, the communicating agents should authenticate each other by using authentication protocols. A remote agent authentication scheme is a two-party protocol whereby an authentication server in a distributed system confirms the identity of a remote individual logging on to the server over an untrusted, open network. This paper discusses the security of Yoon et al.'s remote agent authentication scheme making use of smart cards. Yoon et al.'s scheme was proposed to solve the security problem with Hwang et al.'s authentication scheme and was claimed to provide mutual authentication between the server and the remote agent. But, unlike the claim, in Yoon et al.'s scheme, if an attacker steals some agent's smart card and extracts the information stored in the smart card, he/she can violate the authentication goal of the scheme without knowing the agent's password. We show this by mounting two attacks, a agent impersonation attack and a sever impersonation attack, on Yoon et al's scheme. In addition, in Yoon et al.'s scheme, if an attacker steals some agent's smart card and extracts the information stored in the smart card and reads Ui's login massage, he/she can violate its fundamental goal of a password security. We show this by mounting a dictionary attack on Yoon et al.'s scheme and also figure out what has gone wrong with the scheme.

Mutual authentication has been widely used to verify the legal user and server over a common communication channel. To ensure secure connection between user and server, a large number of remote mutual authentication schemes for multi-server have been proposed by researchers. However, there is a common feature that the identity of user is static in the login phase, which may leak some information of user. Therefore, a good deal of smart card based anonymous multi-server remote user authentication scheme have been proposed to overcome this problem. Recently, Banerjee et al. pointed out that Li et al.’s scheme is vulnerable to user impersonates attack and stolen smart card attack. Later, they proposed an improved protocol to fix this problem. However, we found that Banerjee et al.’s scheme is still vulnerable to user impersonation attack and off-line password guessing attack. Finally, we proposed an enhanced scheme to eliminate the security vulnerability.

Sun proposed an efficient remote authentication scheme using smart cards which ensures low communication and computation cost, but the user cannot choose his/her password at will. Thus, Wu and Chieu presented an improvement. However, Yang and Wang pointed out that Wu and Chieu's scheme is vulnerable to the password guessing and forgery attacks. To preserve the advantage of Sun's scheme and Wu and Chieu's scheme and to amend the security weakness, we propose an improvement in this paper. Moreover, our scheme needs no time concurrency mechanism and ensures mutual authentication.

This paper proposes a secure session key exchange and mutual authentication scheme between mobile machines in WLAN-based ad hoc networks. One of the main security challenges for secure machine to machine communication is to accomplish a simple and efficient session key exchange and mutual authentication. The main idea of this paper is that non-interactive session key exchange uses the mobile machine's ID and mutual authentication without communication with an authentication server whenever a data transmission occurs between the mobile machines. The proposed scheme is secure against man-in-the-middle attack, impersonation attack, and modification attack.

One of the most commonly used two-factor user authentication mechanisms nowadays is based on smart card and personal identity number or password. A scheme of this type is usually known as, a smart card based password authentication. The core feature of such a scheme is to enforce two-factor authentication in the sense that, the client must have the smart card and know the card PIN number in order to gain access to the server. In this paper, we propose and advanced remote mutual authentication scheme between a smart card, a smart card reader and the backend server database to ensure system security integrity. Our scheme provides high security and mutual authentication at a reasonable computational cost. Furthermore, it restricts most of the current attack mechanisms. It is simple and can be adapted to any kind of lightweight devices.

Recently, Amin proposed an efficient dynamic ID-based remote user password authentication scheme for multi-server environment. They claimed that his scheme resisted different possible attacks include off-line identity guessing attack, off-line password guessing attack, and smart card stolen attack. However, we find some weaknesses of his scheme in this article. We show that his scheme is vulnerable to off-line identity guessing with smart card stolen attack and off-line password guessing with smart card stolen attack.

Telecare medical information systems are developed to establish an online convenient communication platform for patients and medical staff to exchange healthcare related services. Being installed on Internet, these systems are prone to different security and privacy threats, which may result in leakage of sensitive health-related data and privacy compromise of the patients. Hence, a major challenge is to establish a secure communication channel between the patients and medical servers, where parties are mutually authenticated and a session key is agreed upon and shared between them for further information exchange. Recently, Ostad-Sharif et al. presented an ECC- based anonymous authentication and key agreement method for healthcare applications. In this article, we first prove that Ostad- sharif et al.'s scheme is vulnerable to key compromise password guessing attacks and key compromise impersonation attacks. Then, we propose a secure and efficient authentication and key agreement scheme for telecare medical information systems which can provide mutual authentication and perfect forward secrecy, and resists against key compromise password guessing attacks, key compromise impersonation attacks, insider attacks, and replay attacks. The security of the proposed scheme is also proved formally with the Scyther tool.

Rapid development in mobile devices and cloud computing technologies has increased the number of mobile services from different vendors on the cloud platform. However, users of these services are facing different security and access control challenges due to the nonexistence of security solutions capable of providing secure access to these services, which are from different vendors, using a single key. An effective security solution for heterogeneous Mobile Cloud Computing (MCC) services should be able to guarantee confidentiality and integrity through single key-based authentication scheme. Meanwhile, a few of the existing authentication schemes for MCC services require different keys to access different services from different vendors on a cloud platform, thus increases complexity and overhead incurred through generation and storage of different keys for different services. In this paper, an efficient mutual authentication scheme for accessing heterogeneous MCC services is proposed. The proposed scheme combines the user’s voice signature with cryptography operations to evolve efficient mutual authentication scheme devoid of key escrow problem and allows authorized users to use single key to access the heterogeneous MCC services at a reduced cost.

In the last few years, researchers have extensively studied the key exchange protocol. In 2007, Kwon et al. proposed a simple three-step key exchange protocol using smart card. In 2008, Chen and Lee proposed a secure and efficient user authentication scheme using smart card that is modified to enhance the security of the series of the Peyravian-Zunic scheme. The current paper demonstrates the vulnerability of Kwon et al.'s protocol regarding off-line password guessing attack and forgery attack. Also, we show that Chen and Lee's scheme is still vulnerable to the off-line password guessing attack and has the non-reparability. In this paper, in addition, after analyzing the two protocols, we propose each of countermeasure against our attacks.