Security analysis of smart card based password authentication schemes

One of the most commonly used user authentication mechanisms is two factor authentication based on smart card and password. The core feature of the scheme is to enforce that the user must have the smart card and know the password in order to gain access to server. Recently, Liu et al. proposed a smart card based password authentication scheme and argued that it is secure against insider attack, replay attack and man in the middle attack and provides perfect forward secrecy. In this paper, we show security weaknesses in Liu et al.’s scheme focused on off-line password guessing attack and masquerading attack and it does not provide perfect forward secrecy and anonymity. Accordingly, we propose a privacy preserving user authentication scheme based on smart card, denoted as PUAS, to remedy these security weaknesses and to provide anonymity and perfect forward secrecy. PUAS is more secure with a bit of computational overhead to support several positive properties in security and privacy.

Thirteen security requirements for an ideal password authentication scheme using smart cards are listed and a new smart card based password authentication scheme with identity anonymity is proposed. The new scheme can satisfy all the listed ideal security requirements and has the following merits: ① it can resist all the attacks listed in introduction; ② less storage memory requirement due to no verification table stored in server; ③ low computational cost due to hash functions based operations; ④ even if the smart card is lost, the new system is still secure; ⑤ As user identity is anonymous, this scheme is more practical. The new proposed scheme can be applied in source constraint networks.

As the technology of mobile devices spreads fast, the price of mobile devices is getting cheaper. Most of the people have mobile devices, and these devices have the technology of near field communication (NFC). With the long time development and research, the mobile devices use NFC technology on the payment and authentication applications, and replace the smartcard, the access control card, and the credit card by using the card emulation mode. It helps the development of NFC applications. In recent years, more and more users begin using NFC technology on mobile payment and authentication. Many researches have proposed the related NFC authentication protocols, but their schemes are still lack of some security properties and functions, which are necessary for NFC authentication protocols. In this paper, we propose a secure and efficient NFC authentication scheme between two NFC devices by the help of the authentication server that provides mutual authentication.

One of the most commonly used two-factor user authentication mechanisms nowadays is based on smart card and personal identity number or password. A scheme of this type is usually known as, a smart card based password authentication. The core feature of such a scheme is to enforce two-factor authentication in the sense that, the client must have the smart card and know the card PIN number in order to gain access to the server. In this paper, we propose and advanced remote mutual authentication scheme between a smart card, a smart card reader and the backend server database to ensure system security integrity. Our scheme provides high security and mutual authentication at a reasonable computational cost. Furthermore, it restricts most of the current attack mechanisms. It is simple and can be adapted to any kind of lightweight devices.

An efficient authentication and key agreement scheme for multi-gateway wireless sensor networks in IoT deployment

In 2004, Ku et al. proposed an improved efficient remote authentication scheme using smart cards to repair the security pitfalls found in Chien et al.’s scheme, in which only few hashing operations are required. Later, Yoon et al. presented an enhancement on Ku et al.’s scheme. Recently, Wang et al. showed that both Ku et al.’s scheme and Yoon et al.’s scheme are still vulnerable to the guessing attack, forgery attack and denial of service (DoS) attack. Then, proposed an efficient improvement over Ku et al.’s and Yoon et al.’s schemes with more security. In this paper, we state that Wang et al.’s scheme is vulnerable to the impersonation attack and parallel session attack. A modification to enhance the security of Wang et al.’s scheme is proposed. Our scheme is suitable for applications with high security requirement.

In modern society, there exist many different types of authentication processes that we are unaware of not only in IT fields but also in our daily lives. Many recent issues of cyber crimes target weak passwords or careless management of passwords. This fact proves the importance of user authentication. In this paper, a secure user authentication scheme using smart cards in IPTV and also offer, by using smart cards and bio information to ensure strong security and a secure user authentication scheme is proposed. We propose extended model of "Fingerprint-based access control using smart card in IPTV" suggested in the previous work. We can extend our scheme to provide contents to subscribers according to an attribute of a subscriber instead of an age by modifying the function in the registration phase. And we analyzed the security of our proposed scheme about caused by malicious attacks.

There are many remote user authentication schemes proposed in literatures for preventing unauthorized parties from accessing resources in an insecure environment. Due to inherent tamper-resistance, most of them are based on smart card authentication schemes. Unfortunately, the cost of cards and readers make these schemes costly. In the real world, common storage devices, such as universal serial bus (USB) thumb drives, portable HDDs, mobile phones, Laptop or Desktop PCs, are widely used, and they are much cheaper or more convenient for storing user authentication information. However, since these devices do not provide tamper-resistance, it is a challenge to design a secure authentication scheme using these kinds of memory devices. In this paper, we will propose a secure password-based remote user authentication and key agreement scheme without using smart cards. According to our analysis, the proposed scheme guarantees mutual authentication and also resists off-line dictionary, replay, forgery, and impersonation attacks. Compared to related scheme, the proposed scheme’s computation cost is lower and the total message length is shorter. Therefore, our scheme is suitable even for applications in limited power computing environments.DOI: http://dx.doi.org/10.5755/j01.itc.41.1.975

In recent 2012, Wen and Li.'s has presented a dynamic ID-based remote user authentication with key agreement scheme. They claimed that their scheme can resisted insider attack and provide anonymity for the users. However, Juan Qu and Li-min Zou., described that Wen and Li.'s scheme could not withstand insider attack, does not provide anonymity for the users, and inefficiency for error password login. A different approach to symmetric cryptology is taken in this study to resolve the fore was made Compared to Juan Qu and Li-min Zou scheme, a different approach was made with symmetric cryptology in this study to supplement the forementioned weak points. We propose an enhanced authentication scheme, which covers all the identified weakness of Wen and Li.'s scheme and an efficient user authentication scheme that preserve perfect anonymity to both the outsider and remote server.

A complete remote authentication scheme should provide the following security properties: (1) mutual authentication, (2) session key exchange, (3) protection of user anonymity, (4) support of immediate revocation capability, (5) low communication and computation cost, (6) resistance to various kinds of attacks, (7) freely choosing and securely changing passwords by users, and (8) without storing password or verification tables in servers. However, none of the existing schemes meets all the requirements. In this paper, along the line of cost effective approach using hash functions for authentication, we propose an efficient and practical remote user authentication scheme with smart cards to support the above complete security properties.

Sun proposed an efficient remote authentication scheme using smart cards which ensures low communication and computation cost, but the user cannot choose his/her password at will. Thus, Wu and Chieu presented an improvement. However, Yang and Wang pointed out that Wu and Chieu's scheme is vulnerable to the password guessing and forgery attacks. To preserve the advantage of Sun's scheme and Wu and Chieu's scheme and to amend the security weakness, we propose an improvement in this paper. Moreover, our scheme needs no time concurrency mechanism and ensures mutual authentication.

The smart card-based user authentication scheme is a simple and user-friendly scheme, which establishes the secure and authorized communication over the open channel. In this paper, we have intimated an efficient remote user authentication scheme for the multiserver environment. Many password-based authentication schemes have been suggested for the multiserver environment using the smart card. We have analyzed Lee et al.’s scheme and observed that this scheme could not withstand online password guessing attack and offline password guessing attack. And also, it cannot achieve session key security and mutual authentication. The suggested scheme overcomes the weaknesses of the Lee et al.’s scheme and provides more security.

Rapid development in mobile devices and cloud computing technologies has increased the number of mobile services from different vendors on the cloud platform. However, users of these services are facing different security and access control challenges due to the nonexistence of security solutions capable of providing secure access to these services, which are from different vendors, using a single key. An effective security solution for heterogeneous Mobile Cloud Computing (MCC) services should be able to guarantee confidentiality and integrity through single key-based authentication scheme. Meanwhile, a few of the existing authentication schemes for MCC services require different keys to access different services from different vendors on a cloud platform, thus increases complexity and overhead incurred through generation and storage of different keys for different services. In this paper, an efficient mutual authentication scheme for accessing heterogeneous MCC services is proposed. The proposed scheme combines the user’s voice signature with cryptography operations to evolve efficient mutual authentication scheme devoid of key escrow problem and allows authorized users to use single key to access the heterogeneous MCC services at a reduced cost.

In 2005, Lee et al. proposed a secure smart card based remote user authentication scheme to improve the security of Chien et al.'s scheme. More recently, Sood et al. pointed out that Lee et al.'s scheme is still vulnerable to the reflection attack, off-line password guessing attack, user impersonation attack and fails to preserve user anonymity. Consequently, Sood et al. proposed a more secure remote user authentication scheme, which is an improvement over Lee et al.'s scheme to overcome their security drawbacks. In this study, however, we find that Sood et al.'s scheme still cannot achieve the claimed security and report its following flaws: (1) It fails to preserve user anonymity under their non-tamper resistance assumption of the smart card; (2) It cannot withstand stolen-verifier attack. The proposed cryptanalysis discourages any use of the scheme for practical applications.

최근 Hsiang-Shih는 Yoon 등의 스킴[7]을 개선한 사용자 인증 스킴을 제안하였다[10]. 그러나 제안된 스킴은 패스워드를 기반으로 하는 스마트카드를 이용한 사용자 인증 스킴에서 고려하는 보안 요구사항을 만족하지 못한다. 본 논문에서는, Hsiang-Shih가 제안한 스킴은 off-line 패스워드 추측공격에 취약함을 보였다. 즉, 공격자가 사용자의 스마트카드를 훔치거나 일시적으로 접근하여 그 안에 저장된 정보를 추출하여 사용자의 패스워드를 알아낼 수 있음을 보였다. 또한 이와 같은 문제점들을 해결한 해쉬함수와 난수에 기반한 개선된 사용자 인증스킴을 제안하였다. 제안한 인증 스킴은 패스워드 추측공격, 위조 및 위장공격이 불가능함을 알 수 있었다. 그리고 사용자와 서버가 상대방을 인증할 수 있는 효율적인 상호 인증방식을 제시하였다. Recently Hsiang-Shih proposed the user authentication scheme to improve Yoon et al's scheme. But the proposed scheme has not been satisfied security requirements considering in the user authentication scheme using the password based smart card. In this paper, we proved that Hsiang-Shih's scheme is vulnerable to the off-line password guessing attack. In other words, the attacker can get the user's password using the off-line password guessing attack on the scheme when the attacker steals the user's smart card and extracts the information in the smart card. Also, the improved scheme based on the hash function and random number was introduced, thus preventing the attacks, such as password guessing attack, forgery attack and impersonation attack etc. And we suggested the effective mutual authentication scheme that can authenticate each other at the same time between the user and server.