Security Analysis of a Secure and Practical Dynamic Identity-Based Remote User Authentication Scheme

A password based remote user authentication scheme is a two-party protocol whereby an authentication server in a distributed system confirms the identity of a remote individual logging on to the server over an untrusted, open network. This paper discusses the security of Chen et al.’s remote user authentication scheme making use of smart cards. They have recently presented an improved version of Lin, Shen, and Hwang’s scheme. But, unlike their claims, in Chen et al.’s scheme, if an attacker gains access to some user’s smart card and extracts the information stored in the smart card, he/she can easily find out the user’s password. We show this by mounting a dictionary attack on the scheme. In addition, Chen et al.’s scheme does not support its main security goal of authenticating between a remote individual and the server. This is shown via a sever impersonation attack on the scheme. Motivated by these security flaws, we propose a more secure remote user authentication scheme that achieves both two-factor security and mutual authentication.

Remote user authentication schemes are commonly used for communication between authorized users and remote servers over an insecure network. Due to its simplicity and convenience this method is widely used in many environments, such as sensor networks or remote host login systems. In recent years, several remote user authentication schemes using smart cards have been proposed. Recently, Singhal and Ramaiya proposed an efficient smart card-based authentication scheme using hash function. They claimed that their scheme could withstand several kinds of attacks, including off-line password guessing attacks, user impersonation attacks, privileged-insider attacks, etc. However, there are some vulnerabilities in Singhal and Ramaiya's scheme. It was found their scheme could not withstand off-line password guessing attack and user impersonation attack. Besides, their scheme cannot achieve perfect forward secrecy, and also fail to preserve user anonymity. In this paper, we propose a security enhanced user authentication scheme to resolve the aforementioned weaknesses. Our proposed scheme is also based on the hash function and our analysis shows that this scheme is more efficient and secure than previous schemes.

With rapid growth of wireless local area networks (WLAN) and computing techniques, handheld devices have become a popular tool in terms of working, entertaining and communicating in daily life. Considering the huge amounts of messages travelling in WLAN, a secure authentication scheme is definitely necessary, which is also required to be flexible across multiple organizations. Aiming for establishing a secure and flexible WLAN authentication scheme for various organizations, this paper reviews existing secure authentication mechanisms, describes the details of the proposed authentication scheme, and evaluates achievements of such a scheme.

Implantable medical devices (IMDs) are man-made devices, which can be implanted in the human body to improve the functioning of various organs. The IMDs monitor and treat physiological condition of the human being (for example, monitoring of blood glucose level by insulin pump). The advancement of information and communication technology enhances the communication capabilities of IMDs. In healthcare applications, after mutual authentication, a user (for example, doctor) can access the health data from the IMDs implanted in a patient's body. However, in this kind of communication environment, there are always security and privacy issues, such as leakage of health data and malfunctioning of IMDs by an unauthorized access. To mitigate these issues, in this paper, we propose a new secure remote user authentication scheme for IMDs communication environment to overcome security and privacy issues in existing schemes. We provide the formal security verification using the widely accepted Automated Validation of Internet Security Protocols and Applications tool. We also provide the informal security analysis of the proposed scheme. The formal security verification and informal security analysis prove that the proposed scheme is secure against known attacks. The practical demonstration of the proposed scheme is performed using the broadly accepted NS2 simulation tool. The computation and communication costs of the proposed scheme are also comparable with the existing schemes. Moreover, the scheme provides additional functionality features, such as anonymity, untraceability, and dynamic implantable medical device addition.

In the last few years, researchers have extensively studied the key exchange protocol. In 2007, Kwon et al. proposed a simple three-step key exchange protocol using smart card. In 2008, Chen and Lee proposed a secure and efficient user authentication scheme using smart card that is modified to enhance the security of the series of the Peyravian-Zunic scheme. The current paper demonstrates the vulnerability of Kwon et al.'s protocol regarding off-line password guessing attack and forgery attack. Also, we show that Chen and Lee's scheme is still vulnerable to the off-line password guessing attack and has the non-reparability. In this paper, in addition, after analyzing the two protocols, we propose each of countermeasure against our attacks.

Remote user authentications are an essential tool for e-commerce in Internet environment. In these systems, identity privacy is provided by concealing user's identity. In this article, we introduce the identity privacy study of this setting, and explore a secure and efficient dynamic ID-based remote user authentication protocol with untraceability. We adapt a pair of dynamic IDs to realize the user's anonymity, and present a novel nonce-based authentication approach. Our protocol eliminates all identified security flaws in original protocols. Furthermore, high performance and other good functionalities are preserved.

사용자 인증 스킴은 개방된 통신환경에서 원격지에 있는 사용자가 서버에 로긴할 때 정당한 사용자 인지를 확인하는 것이다. 2005년 Liao등은 스마트 카드를 이용해서 사용자의 익명성을 보장하는 사용자 인증 스킴을 제안하였다. 최근 Yoon등은 Liao가 제안한 사용자 인증 스킴의 안전성 분석을 수행한 후 그 스킴에 존재하는 결점을 보완하는 향상된 스킴을 제안하였다. 그러나 안타깝게도 그들이 제안한 스킴은 사용자가 서버를 인증하는 방식과 서버가 사용자를 인증 방식을 모두 수행할 수 없고 패스워드의 안전성에도 문제점이 존재한다. 이러한 문제점을 이 논문에서는 서버 가장 공격, 사용자 가장 공격, 오프라인 사전공격을 수행하여 지적하였다. 아울러 본 논문에서는 Yoon등이 제안한 논문의 취약점을 제거하여 보다 안전한 사용자 인증 스킴을 제안하였다. A remote user authentication scheme is a two-party protocol whereby an authentication server in a distributed system confirms the identity of a remote individual logging on to the server over an untrusted, open network. In 2005, Liao et al. proposed a remote user authentication scheme using a smart card, in which users can be authenticated anonymously. Recently, Yoon et al. have discovered some security flaws in Liao et al.'s authentication scheme and proposed an improved version of this scheme to fix the security flaws. In this article, we review the improved authentication scheme by Yoon et al. and provide a security analysis on the scheme. Our analysis shows that Yoon et al.'s scheme does not guarantee not only any kind of authentication, either server-to-user authentication or user-to-server authentication but also password security. The contribution of the current work is to demonstrate these by mounting two attacks, a server impersonation attack and a user impersonation attack, and an off-line dictionary attack on Yoon et al.'s scheme. In addition, we propose the enhanced authentication scheme that eliminates the security vulnerabilities of Yoon et al.'s scheme.

Remote user authentication is a mechanism in which the remote server verifies the legitimacy of a user over an insecure communication channel. Password based authentication schemes have been widely deployed to verify the legitimacy of remote users as password authentication is one of the simplest and the most convenient authentication mechanism over insecure networks. In remote user authentication scheme, the user is assigned a smart card, which is being personalized by some parameters and provide the legal users to use the resources of the remote system. Until now, there have been ample of remote user authentication schemes published in the literature and each published schemes have its own merits and demerits. Recently, many schemes proposed are based on the one-way hash function. The computational complexity of their schemes is superior to the discrete logarithm-problem-based schemes. In our paper, we have defined all the security requirements and the goals. An ideal password authentication schemes should satisfy and achieve all of these. We have presented the results of our survey through five of the currently available secure one way hash function based remote user authentication schemes. We hope an ideal smart card (not storing (ID i ,PW i ), which meets all the security requirements and achieves all the goals can be developed.

Password as an easy-to-remember credential plays an important role in remote user authentication schemes, while drawing from a space so small that an adversary may exhaustively search all possible candidate passwords to guess the correct one. In order to enhance the security of the password authentication scheme, smart card is introduced as the second factor to construct two-factor authentication scheme. However, we find out that two latest smart-card-based password authentication schemes are vulnerable to offline password guessing attacks under the definition of secure two-factor authentication. Furthermore, in order to show the serious consequence of offline password guessing attacks, we illustrate that the password compromise impersonation attacks as further threats are effective to break down the authentication schemes. Finally, we conclude the reasons why these weaknesses exist and present our improved ideas to avoid these problems in the future.

Hardware smart tokens are gaining popularity in strong online remote authentication. Das introduced a dynamic ID-based remote user authentication scheme with one-way hash function using the smart card. Lee, Hwang, Jian and others made alternative dynamic ID-based authentication schemes with smart card. This paper proposes an improved dynamic ID-based authentication scheme based on Jian's scheme by Adding public key cryptographic layer and using hardware smart token. Our proposed scheme will be more flexible because the using of dynamic ID-based authentication scheme with hardware token makes it easier and more secure.

As the technology of mobile devices spreads fast, the price of mobile devices is getting cheaper. Most of the people have mobile devices, and these devices have the technology of near field communication (NFC). With the long time development and research, the mobile devices use NFC technology on the payment and authentication applications, and replace the smartcard, the access control card, and the credit card by using the card emulation mode. It helps the development of NFC applications. In recent years, more and more users begin using NFC technology on mobile payment and authentication. Many researches have proposed the related NFC authentication protocols, but their schemes are still lack of some security properties and functions, which are necessary for NFC authentication protocols. In this paper, we propose a secure and efficient NFC authentication scheme between two NFC devices by the help of the authentication server that provides mutual authentication.

To keep the pace with the development of internet technology, remote user authentication techniques become more and more important to protect user’s privacy. Recently, Kumari, et al., presented an improved remote user authentication scheme with key agreement based on dynamic-identity using smart card. This scheme allows legal users to change the password at his will without the need to connect the server. They claimed that their scheme could resist smart card stolen or loss attack, user impersonation and server masquerading attack, and provide user anonymity and untraceability and so on. However, our research indicates that their scheme is completely unsafe. Furthermore, the scheme can’t provide the proper mutual authentication. In this manuscript, we will propose a new scheme, which can withstand those attacks mentioned above and provide the perfect user anonymity and forward secrecy. Security analysis makes it clear that the improved scheme apparently is more secure and practical.

Recently, the incorporation of state-of-the-art technology such as Electronic Healthcare Records (EHRs), networks, and cloud computing has transformed the traditional healthcare system. However, security problems have arisen as a result of the integration of technology. Secure remote user authentication is a core part of the healthcare system to validate the user’s identification via an unsecured communication network. Since then, several remote user authentication schemes have been presented, each with its own set of pros and limitations. As a result, security, malicious attacks, and privacy concerns are considered one of the main challenges related to the healthcare system. In this paper, we propose a safe user authentication scheme for patients in the healthcare system that overcomes these flaws and confirms the security of the proposed work using scyther, a formal security tool. In the healthcare environment, our work provides an effective means to construct an environment capable of setting, registering, storing, searching, analyzing, authentication, and verifying electronic healthcare information in order to protect the information of patients. Furthermore, our suggested scheme uses symmetric encryption based on the crypto-hash function for accessing the anomaly of the patient’s identity and One-Time Password (OTP). Towards the end of the study, the performance analysis results indicate a delicate balance of security and performance that is frequently lacking in previous works.

Recently, Lu et al. presented a mutual authentication scheme for Session Initiation Protocol. Lu et al. claimed their scheme provides safeguard against familiar attacks and offers efficient authentication facility. However, this paper divulges that the scheme of Lu et al. is prone to server and user impersonation attacks. Additionally, the scheme of Lu et al. implicates correctness concerns. Consequently, an enhanced scheme is proposed, not only to resolve correctness concerns but also to provide robustness against server and user impersonation attacks. The proposed scheme makes use of a user‐specific secret parameter to deal with the security and correctness issues. The formal and informal security analysis proves the robustness and efficiency of the proposed scheme against all familiar attacks. Furthermore, security analysis is also substantiated through popular automated tool PROVERIF. Copyright © 2016 John Wiley & Sons, Ltd.

A provably secure and lightweight authentication scheme for Internet of Drones for smart city surveillance