On the Security of Some Password Authentication Protocols

Security flaw of Hölbl et al.’s protocol

The authentication system plays a crucial role in the context of GLObal MObility NETwork (GLOMONET) where Mobile User (MU) often need to seamless and secure roaming service over multiple Foreign Agents (FA). However, designing a robust and anonymous authentication protocol along with a user privacy is essential and challenging task. Due to the resource constrained property of mobile terminals, the broadcast nature of a wireless channel, mobility environments are frequently exposed to several attacks. Many researchers focus their interests on designing an efficient and secure mobile user authentication protocol for mobility networks. Very recently (in 2018), Xu et al presented the novel anonymous authentication system for roaming in GLOMONET, and insisted that their protocol is more secure than existing authentication protocols. The security strength of Xu et al.’s authentication protocol is analysed and identified that the protocol is vulnerable to stolen verifier attack, privileged insider attack, impersonation attack and denial of service attack. In-fact, the protocol suffers from clock synchronization problem and cannot afford local password-verification to detect wrong passwords quickly. As a remedy, we proposed an efficient and robust anonymous authentication protocol for mobility networks. The proposed mobile user authentication protocol achieves the provable security and has the ability to resist against numerous network attacks. Besides, the correctness of the novel authentication protocol is validated using formal security tool called AVISPA (Automated Validation of Internet Security Protocols & Applications). Finally, the performance analysis and simulation results reveals that the proposed authentication protocol is computationally efficient and practically implementable in resource limited mobility environments.

A secure light weight scheme for user authentication and key agreement in multi-gateway based wireless sensor networks

With the booming integration of IoT technology in our daily life applications such as smart industrial, smart city, smart home, smart grid, and healthcare, it is essential to ensure the security and privacy challenges of these systems. Furthermore, time‐critical IoT applications in healthcare require access from external parties (users) to their real‐time private information via wireless communication devices. Therefore, challenges such as user authentication must be addressed in IoT wireless sensor networks (WSNs). In this paper, we propose a secure and lightweight three‐factor (3FA) user authentication protocol based on feature extraction of user biometrics for future IoT WSN applications. The proposed protocol is based on the hash and XOR operations, including (i) a 3‐factor authentication (i.e., smart device, biometrics, and user password); (ii) shared session key; (iii) mutual authentication; and (iv) key freshness. We demonstrate the proposed protocol’s security using the widely accepted Burrows–Abadi–Needham (BAN) logic, Automated Validation of Internet Security Protocols and Applications (AVISPA) simulation tool, and the informal security analysis that demonstrates its other features. In addition, our simulations prove that the proposed protocol is superior to the existing related authentication protocols, in terms of security and functionality features, along with communication and computation overheads. Moreover, the proposed protocol can be utilized efficiently in most of IoT’s WSN applications, such as wireless healthcare sensor networks.

The Medical Internet of Things (MIoT) plays a pivotal role in modern healthcare by integrating wireless communication and cloud computing to enhance medical practices. However, this framework presents security vulnerabilities, such as the risk of eavesdroppers exploiting public channels to intercept sensitive patient data or impersonate legitimate devices and services. Consequently, authentication between wearable devices and servers is essential before transmitting confidential information through open channels. While several authentication techniques offer protection against quantum attacks, they often incur high communication and computation costs, underscoring the need for further advancement. This paper introduces a multifactor authentication protocol designed to strengthen the integrity of cloud-assisted MIoT systems by incorporating post-quantum security. The proposed protocol utilizes a post-quantum fuzzy commitment (PQFC) scheme to enhance security and is rigorously analyzed under the random oracle model and ProVerif tool. Its functionality and security are thoroughly assessed, demonstrating adherence to key requirements such as memoryless operation, user anonymity, mutual authentication, and resistance to various threats, including biometric tampering, stolen-verifier attacks, and insider attacks. Additionally, a comprehensive comparison with existing schemes highlights a balanced trade-off between security and efficiency.

Remote user authentication is a mechanism in which the remote server verifies the legitimacy of a user over an insecure communication channel. Password based authentication schemes have been widely deployed to verify the legitimacy of remote users as password authentication is one of the simplest and the most convenient authentication mechanism over insecure networks. In remote user authentication scheme, the user is assigned a smart card, which is being personalized by some parameters and provide the legal users to use the resources of the remote system. Until now, there have been ample of remote user authentication schemes published in the literature and each published schemes have its own merits and demerits. Recently, many schemes proposed are based on the one-way hash function. The computational complexity of their schemes is superior to the discrete logarithm-problem-based schemes. In our paper, we have defined all the security requirements and the goals. An ideal password authentication schemes should satisfy and achieve all of these. We have presented the results of our survey through five of the currently available secure one way hash function based remote user authentication schemes. We hope an ideal smart card (not storing (ID i ,PW i ), which meets all the security requirements and achieves all the goals can be developed.

Regulating illegal activities in cyberspace to balance user privacy and cyberspace governance has been a non-trivial challenge when designing anonymous authentication solutions. For example, while several existing anonymous authentication protocols support accountability, they either risk leaking users' private keys or incur significant overhead for accountability in each ongoing authentication, including in cloud service-based authentication schemes. Seeking to address these limitations, this paper proposes an auditable anonymous user authentication (A2UA) protocol based on blockchain for cloud services. The A2UA protocol mainly employs bilinear pairing, partial authentication factors, dynamic credits and fake-public keys (FPKs) to achieve anonymous mutual authentication between users and cloud service providers, and applies ring signature and blockchain to accomplish two-level accountability while maintaining user privacy. Our analysis results show that the A2UA protocol outperforms several other existing schemes in terms of security, computation and communication costs as well as security and privacy features. Additionally, it has good feasibility in terms of the Ethereum Gas cost as demonstrated in our evaluation.

Although flaws have been found out in SSH, the Secure Shell, there has been little discussion about its architecture or design safety. Therefore, considering SSH architecture, e.g. the key exchange protocol, user authentication protocols and total design of the SSH, we not only discuss SSH architectural safety but show critical flaws for SSH users. For establishing the SSH connection, before user authentication, the SSH server and client exchange a session key, which can communicate securely. Then, over the secret channel encrypted by the session key, the SSH server authenticates a user in the SSH client using a user's password or public key. However, owing to defects in the SSH protocols and its design, a user can be deprived of their password in the authentication protocol. Moreover, we show that those who use its public key for authentication are exposed to the same risks as password-oriented users.

Authentication is one of the fundamental mechanisms to enable a legitimate user to log into a remote server in an insecure environment. Many authentication protocols have been proposed in the literature for preventing unauthorized parties from access resources. Recently, Chen et al. proposed a password-based remote user authentication and key agreement scheme using common storage devices, such as USB sticks. They claimed that the scheme can withstand off-line dictionary attacks even if the authentication information stored in the device is obtained by the adversary. However, we observe that Chen et al.’s scheme is insecure against off-line dictionary attacks in this case. To remedy this security flaw, we propose an improved authentication protocol without using smart cards. Compared with the previous schemes, our scheme not only provides more security guarantees, but also is more efficient both in computation and communication cost.DOI: http://dx.doi.org/10.5755/j01.itc.42.2.2079

Currently, smart card based remote user authentication schemes have been widely adopted due to their low cost and convenient portability. With the purpose of using various different internet services with single registration and to protect the users from being tracked, various dynamic ID based multi-server authentication protocols have been proposed. Recently, Li et al. proposed an efficient and secure dynamic ID based authentication protocol using smart cards. They claimed that their protocol provides strong security. In this paper, we have demonstrated that Li et al.’s protocol is vulnerable to replay attack, denial of service attack, smart card lost attack, eavesdropping attack and server spoofing attacks.

So far, many strong-password authentication schemes have been proposed, however, none is secure enough. In 2003, Lin, Shen, and Hwang proposed a strong-password authentication scheme using smart cards, and claimed that their scheme can resist the guessing attack, the replay attack, the impersonation attack, and the stolen-verifier attack. Later, Ku, Tsai, and Chen showed that Lin-Shen-Hwang's scheme suffers from a replay attack and a denial-of-service attack. Herein, we propose a more secure hash-based strong-password authentication scheme without using smart cards.

SE-AKA: A secure and efficient group authentication and key agreement protocol for LTE networks

In a distributed environment, one of the major concerns is authentication of remote users. In this sector, legitimate users are more powerful attackers. The remote systems working with password and smart card ensures authorised access. Smart card based remote user authentication schemes have been adopted due to their low computation cost and portability. In 2012, Wen and Li proposed an improved dynamic ID based remote user authentication with key agreement scheme. They stated that their scheme provides protection against impersonation attack and preserves secret information. In this paper, we unveil the drawbacks of Wen and Li's scheme. Also we show that their scheme does not detect wrong password quickly, making it vulnerable to insider and smart card stolen attack. Further the scheme provides no protection for forward secrecy. To solve these security weaknesses, we propose a robust authentication scheme which overcomes all the pointed flaws, by keeping eminence of Wen and Li's scheme.

Radio-frequency-identification (RFID) technology has been widely used to identify the RFID-Tags associated with objects through RFID-Reader using electromagnetic signals. The rapid growth of RFID technology is also accompanied by contemporary security challenges and threats. The highly secure authentication protocol is obligatory to overcome security challenges. Recently Srivastava et al. have proposed a Hash-biometric based authentication protocol for RFID Systems to resist the security threats. However, this study points out that Srivastava et al. scheme is vulnerable to 1) Possible Stolen Verifier Attack 2) Anonymity and Traceability Issue 3) Impersonation Attack by illegitimate user 4) Insider Attack. An enhanced and efficient protocol is presented in this paper for RFID Systems based on biometric authentication to handle security challenges and attacks found in Srivastava et al. scheme. The proposed protocol is formally tested and verified through well-known security automated tool (ProVerif). The proposed protocol is adequately secure and has a preferable efficiency in contrast to the other existing schemes.

Denial of Service DoS attacks prevent legitimate users from accessing resources by compromising availability of a system. Despite advanced prevention mechanisms, DoS attacks continue to exist, and there is no widely-accepted solution. We propose a deception-based protection mechanism that involves game theory to model the interaction between the defender and the attacker. The defender's challenge is to determine the optimal network configuration to prevent attackers from staging a DoS attack while providing service to legitimate users. In this setting, the defender can employ camouflage by either disguising a normal system as a honeypot, or by disguising a honeypot as a normal system. We use signaling game with perfect Bayesian equilibrium PBE to explore the strategies and point out the important implications for this type of dynamic games with incomplete information. Our analysis provides insights into the balance between resource and investment, and also shows that defenders can achieve high level of security against DoS attacks with cost-effective solutions through the proposed deception strategy.