Security on Dynamic ID-based Authentication Schemes

Hardware smart tokens are gaining popularity in strong online remote authentication. Das introduced a dynamic ID-based remote user authentication scheme with one-way hash function using the smart card. Lee, Hwang, Jian and others made alternative dynamic ID-based authentication schemes with smart card. This paper proposes an improved dynamic ID-based authentication scheme based on Jian's scheme by Adding public key cryptographic layer and using hardware smart token. Our proposed scheme will be more flexible because the using of dynamic ID-based authentication scheme with hardware token makes it easier and more secure.

In 2004, Das et al. proposed a dynamic identity based remote user authentication scheme. They claimed that their scheme is secure against different attacks. Unfortunately, many researchers demonstrated that Das et al. scheme is vulnerable to various attacks. Furthermore, this scheme does not achieve mutual authentication and thus can not resist malicious server attack. In 2005, Liao et al. improved Das et al.'s scheme and claimed that the improved scheme achieves mutual authentication, withstand password guessing attack and insider attack. In 2006, Yoon and Yoo demonstrated a reflection attack on Liao et al.'s scheme that breaks the mutual authentication. In this paper, we found that Liao et al.'s scheme is also vulnerable to malicious user attack, impersonation attack, stolen smart card attack and offline password guessing attack. Moreover, Liao et al.'s scheme does not maintain the user's anonymity and its password change phase is insecure. This paper presents a secure dynamic identity based authentication scheme using smart cards to resolve the aforementioned problems, while keeping the merits of different dynamic identity based authentication schemes.

Very recently, Khan, Kim, and Alghathbar [6] proposed a dynamic ID-based remote user authentication scheme and claimed that their scheme can provide user anonymity. However, in this article, the authors demonstrate that either a malicious user or an adversary with a valid smart card can trace any user by eavesdropping on his normal authentication session over the public channel. Therefore, Khan et al.'s scheme fails to provide the privacy service as claimed. Hence, the authors present an improved scheme to overcome its flaw and examine the privacy of the improved scheme by using the smart card-based privacy model. In addition, the security and efficiency of the improved scheme are scrutinized. The conclusive result is that the design of the improved scheme is reasonable in not only both privacy and security aspects but also the performance aspect.

Patient can obtain sorts of health-care delivery services via Telecare Medical Information Systems (TMIS). Authentication, security, patient's privacy protection and data confidentiality are important for patient or doctor accessing to Electronic Medical Records (EMR). In 2012, Chen et al. showed that Khan et al.'s dynamic ID-based authentication scheme has some weaknesses and proposed an improved scheme, and they claimed that their scheme is more suitable for TMIS. However, we show that Chen et al.'s scheme also has some weaknesses. In particular, Chen et al.'s scheme does not provide user's privacy protection and perfect forward secrecy, is vulnerable to off-line password guessing attack and impersonation attack once user's smart card is compromised. Further, we propose a secure anonymity authentication scheme to overcome their weaknesses even an adversary can know all information stored in smart card.

Telecare medical information systems (TMIS) enable healthcare delivery services. However, access of these services via public channel raises security and privacy issues. In recent years, several smart card based authentication schemes have been introduced to ensure secure and authorized communication between remote entities over the public channel for the (TMIS). We analyze the security of some of the recently proposed authentication schemes of Lin, Xie et al., Cao and Zhai, and Wu and Xu's for TMIS. Unfortunately, we identify that these schemes failed to satisfy desirable security attributes. In this article we briefly discuss four dynamic ID-based authentication schemes and demonstrate their failure to satisfy desirable security attributes. The study is aimed to demonstrate how inefficient password change phase can lead to denial of server scenario for an authorized user, and how an inefficient login phase causes the communication and computational overhead and decrease the performance of the system. Moreover, we show the vulnerability of Cao and Zhai's scheme to known session specific temporary information attack, vulnerability of Wu and Xu's scheme to off-line password guessing attack, and vulnerability of Xie et al.'s scheme to untraceable on-line password guessing attack.

In 2010, Sood-Sarje-Singh proposed two dynamic ID-based remote user authentication schemes. The first schemeis a security improvement of Liao et al.’s scheme and the second scheme is a security improvement of Wang etal.’s scheme. In both cases, the authors claimed that their schemes can resist many attacks. However, we find thatboth schemes have security flaws. In addition, their schemes require a verification table and time-synchronization,making the schemes unfeasible and unsecured for electronic services. In order to remedy the security flaws ofSood et al.’s schemes, we propose a robust scheme which resists the well-known attacks and achieves all thedesirable security goals.

SUMMARYWith the use of smart card in user authentication mechanisms, the concept of two‐factor authentication came into existence. This was a forward move towards more secure and reliable user authentication systems. It elevated the security level by requiring a user to possess something in addition to know something. In 2010, Sood et al. and Song independently examined a smart‐card‐based authentication scheme proposed by Xu et al. They showed that in the scheme of Xu et al., an internal user of the system can turn hostile to impersonate other users of the system. Both of them also proposed schemes to improve the scheme of Xu et al. Recently, Chen et al. identified some security problems in the improved schemes proposed by Sood et al. and Song. To fix these problems, Chen et al. presented another scheme, which they claimed to provide mutual authentication and withstand lost smart card attack. Undoubtedly, in their scheme, a user can also verify the legitimacy of server, but we find that the scheme fails to resist impersonation attacks and privileged insider attack. We also show that the scheme does not provide important features such as user anonymity, confidentiality to air messages, and revocation of lost/stolen smart card. Besides, the scheme defies the very purpose of two‐factor security. Furthermore, an attacker can guess a user's password from his or her lost/stolen smart card. To meet these challenges, we propose a user authentication method with user anonymity. We show through analysis and comparison that the proposed scheme exhibits enhanced efficiency in contrast to related schemes, including the scheme of Chen et al. Copyright © 2013 John Wiley & Sons, Ltd.

In 2008, Bindu et al. proposed an improvement to Chien et al.'s remote password authentication scheme preserving user anonymity, and has asserted that the scheme is secure against replay attack, guessing attack, insider attack and man-in-the-middle attack, etc. However, in this paper, we have shown that Bindu et al.'s scheme is still insecure against man-in-the-middle attack and password guessing attack, and does not provide user anonymity. Also, we propose an improved scheme to withstand these weaknesses, while preserving their merits, even if the secret information stored in the smart card is revealed. As a result of analysis, the proposed scheme is secure against user impersonation attack, server masquerading attack, password guessing attack and does provide user anonymity. And we can see that the proposed scheme is relatively more effective than Bindu et al.'s scheme.

One of the most commonly used user authentication mechanisms is two factor authentication based on smart card and password. The core feature of the scheme is to enforce that the user must have the smart card and know the password in order to gain access to server. Recently, Liu et al. proposed a smart card based password authentication scheme and argued that it is secure against insider attack, replay attack and man in the middle attack and provides perfect forward secrecy. In this paper, we show security weaknesses in Liu et al.’s scheme focused on off-line password guessing attack and masquerading attack and it does not provide perfect forward secrecy and anonymity. Accordingly, we propose a privacy preserving user authentication scheme based on smart card, denoted as PUAS, to remedy these security weaknesses and to provide anonymity and perfect forward secrecy. PUAS is more secure with a bit of computational overhead to support several positive properties in security and privacy.

Recently, because the interest and needs in privacy protection are growing, smartcard-based remote user authentication schemes have been actively studied to provide the user anonymity. In 2008, Kim et al. first proposed an authentication scheme in order to ensure the user anonymity against both external attackers and the remote server and track malicious users with the help of a trusted trace sever. However, in 2010, Lee et al. showed that Kim et al.`s scheme cannot provide the user anonymity against remote server, which is because the server can trace users without any help of the trace server, and then proposed a improved scheme. On the other hand, in 2010, Horng et al. proposed an authentication scheme with non-tamper resistant smart cards, in which the non-tamper resistant smart card means that an attacker may find out secret information stored in the smart card through special data analysis techniques such as monitoring power consumption, to be secure against a variety of attacks and to provide the user anonymity against external attackers. In this paper, we will propose a remote user authentication scheme with non-tamper resistant smart cards not only to ensure the user anonymity against both external attackers and the remote server but also to track malicious users with only the help of a trusted trace sever.

In 2009, Xu et al. found that Lee et al.’s scheme is defenseless to offline password guessing attack. Xu et al. also indicated that Lee and Chiu’s scheme is unguarded to forgery attack. Moreover, Lee and Chiu’s scheme doesn’t achieve mutual authentication and thus cannot resist malicious server attack. Xu et al. proposed an improved scheme. In 2010 Anil K Sarje et al. shown that Xu et al.’s scheme is vulnerable to forgery attack and proposed an improved scheme which preserves the merits of Xu et al. scheme and resists various attacks. In this paper we will show that Anil K Sarje et al. scheme cannot avoid any of the attacks they claimed that their scheme will resists. We then present our enhanced scheme to fix the vulnerabilities found in Anil K Sarje et al. scheme and various related dynamic identity based authentication schemes while preserving their merits.

Recently, Amin proposed an efficient dynamic ID-based remote user password authentication scheme for multi-server environment. They claimed that his scheme resisted different possible attacks include off-line identity guessing attack, off-line password guessing attack, and smart card stolen attack. However, we find some weaknesses of his scheme in this article. We show that his scheme is vulnerable to off-line identity guessing with smart card stolen attack and off-line password guessing with smart card stolen attack.

The growing number of connected devices in IoT networks has raised security concerns. These networks face unique challenges, including limited resources, lack of standardized security protocols, and diverse devices and applications. Identity-based authentication is needed to address these threats and limitations. Implementing a multi-factor authentication system can enhance security and protect sensitive information from unauthorized access. The proposed Identity Based Authentication (IAS) scheme is implemented using the NS-2 simulator to address security challenges in IoT networks. Each node is assigned a unique identity for authentication, ensuring only authorized access and preventing security breaches. The IAS scheme enhances IoT network security by verifying node identities. Two scenarios are considered to evaluate the scalability and interoperability of the IAS scheme. The first scenario involves a random environment, assessing performance in real-world settings with varying device densities and network conditions. The second scenario involves a cluster-based environment, providing insights into the scheme's functionality and efficiency. By examining both scenarios, this research aims to provide a comprehensive understanding of how the authentication scheme performs in different deployment scenarios. The findings highlight the importance of selecting the appropriate authentication scheme based on the specific network environment and requirements. The superiority of the IAS authentication scheme suggests its potential for widespread adoption and implementation in various network scenarios over other authentication schemes.

Recently, Li et al. proposed a novel smart card and dynamic ID-based remote user authentication scheme for multi-server environments. They claimed that their scheme can resist several types of attacks. However, through careful analysis, we find that Li et al.’s scheme is vulnerable to stolen smart card and off-line dictionary attacks, replay attacks, impersonation attacks and server spoofing attacks. By analyzing other similar schemes, we find that a certain type of dynamic ID-based multi-server authentication scheme in which only hash functions are used and whereby no registration center participates in the authentication and session key agreement phase faces difficulties in providing perfectly efficient and secure authentication. To compensate for these shortcomings, we propose a novel dynamic ID-based remote user authentication scheme for multi-server environments based on pairing and self-certified public keys. Security and performance analyses show that the proposed scheme is secure against various attacks and has many excellent features.

There are many remote user authentication schemes proposed in literatures for preventing unauthorized parties from accessing resources in an insecure environment. Due to inherent tamper-resistance, most of them are based on smart card authentication schemes. Unfortunately, the cost of cards and readers make these schemes costly. In the real world, common storage devices, such as universal serial bus (USB) thumb drives, portable HDDs, mobile phones, Laptop or Desktop PCs, are widely used, and they are much cheaper or more convenient for storing user authentication information. However, since these devices do not provide tamper-resistance, it is a challenge to design a secure authentication scheme using these kinds of memory devices. In this paper, we will propose a secure password-based remote user authentication and key agreement scheme without using smart cards. According to our analysis, the proposed scheme guarantees mutual authentication and also resists off-line dictionary, replay, forgery, and impersonation attacks. Compared to related scheme, the proposed scheme’s computation cost is lower and the total message length is shorter. Therefore, our scheme is suitable even for applications in limited power computing environments.DOI: http://dx.doi.org/10.5755/j01.itc.41.1.975