An improved remote user authentication scheme with key agreement

In distributed systems, user authentication schemes based on password and smart card are widely used to ensure only authorized access to the protected services. Recently, Chang et al. presented an untraceable dynamic-identity-based user authentication scheme with verifiable-password-update. In this research, we illustrate that Chang et al.’s scheme violates the purpose of dynamic-identity contrary to authors’ claim. We show that once the smart card of an arbitrary user is lost, passwords of all registered users are at risk. Using information from an arbitrary smart card, an adversary can impersonate any user of the system. In addition, its password change phase has loopholes and is misguiding. The scheme has no provision for session key agreement and the smart card lacks any verification mechanism. Then we come-up with an improved remote user authentication scheme with the session key agreement, and show its robustness over related schemes.     

一种改进的基于动态身份远程用户认证方案

基于动态身份远程用户认证可有效防止用户关键信息泄露,保证已认证用户通过授权获取网络服务.针对Wen-Li提出的基于动态身份远程用户认证与密钥协商方案进行安全性分析,指出该方案存在安全缺陷,可能导致泄露用户部分关键信息,进而遭受网络攻击.在保留Wen-Li方案优点的基础上提出一种改进的远程用户认证方案,重新设计了认证过程中的会话密钥和密钥确认消息.与Wen-Li方案相比,改进方案能够抵御中间人攻击以及盗窃智能卡攻击,并增强了方案的前向安全性.     

基于动态ID的远程用户身份认证方案

用户身份认证作为网络安全和信息安全的第一道屏障,有着非常重要的作用.口令与智能卡相结合的认证方式可以克服传统口令认证方式的诸多弊端,能够提高网络和信息系统整体的安全性.对基于动态ID的远程用户身份认证方案进行了分析,指出了该方案在入侵者持有用户智能卡的情况下,即使不知道用户口令也能够伪装成合法用户通过远程系统的身份验证,获取系统的网络资源.提出了一种改进方案,能有效抵御重放攻击、伪造攻击、口令猜测攻击、内部攻击和伪装攻击.     

一种改进的远程用户身份认证方案

物联网的快速发展给人们的生产生活带来了极大的便利,但是如何保证用户的信息安全是物联网发展中必须解决的一个重要问题。为了解决该问题,必须在增加较低计算量的前提下,提出安全性更高的身份认证协议。对Nikooghadam等人提出的保护用户身份的协议进行了分析,并在此基础上提出了一种改进的远程用户身份认证协议。采用BAN逻辑进行验证,也进行了性能比较与计算效率分析,结果表明,提出的协议在增加较低计算量的前提下具有更高的安全性。     

An improved timestamp-based remote user authentication scheme

To protect the remote server from various malicious attacks, many authentication schemes have been proposed. Some schemes have to maintain a password verification table in the remote server for checking the legitimacy of the login users. To overcome potential risks of verification tables, researchers proposed remote user authentication schemes using smartcard, in which the remote server only keeps a secret key for computing the user’s passwords and does not need any verification table for verifying legal user. In 2003 Shen, Lin, and Hwang proposed a timestamp-based password authentication scheme using smartcards in which the remote server does not need to store the passwords or verification table for user authentication. Unfortunately, this scheme is vulnerable to some deadly attacks. In this paper, we analyze few attacks and finally propose an improved timestamp-based remote user authentication scheme. The modified scheme is more efficient and secure than original scheme.     

A more efficient and secure dynamic ID-based remote user authentication scheme

In 2004, Das, Saxena and Gulati proposed a dynamic ID-based remote user authentication scheme. This scheme allows users to change and choose passwords freely, and the server does not maintain any verifier table. It is also secure to against ID-theft, replay attacks and insider attacks and so on. However, research has been done to point that it is completely insecure for its independent of the password. Furthermore, it did not achieve mutual authentication and could not resist impersonate remote server attack. In this paper, an enhanced password authentication scheme which still keeps the merits of the original scheme was presented. Security analysis proved that the improved scheme is more secure and practical.     

An ID-based remote mutual authentication with key agreement scheme for mobile devices on elliptic curve cryptosystem

Recently, remote user authentication schemes are implemented on elliptic curve cryptosystem (ECC) to reduce the computation loads for mobile devices. However, most remote user authentication schemes on ECC are based on public-key cryptosystem, in which the public key in the system requires the associated certificate to prove its validity. Thus, the user needs to perform additional computations to verify the certificate in these schemes. In addition, we find these schemes do not provide mutual authentication or a session key agreement between the user and the remote server. Therefore, we propose an ID-based remote mutual authentication with key agreement scheme on ECC in this paper. Based upon the ID-based concept, the proposed scheme does not require public keys for users such that the additional computations for certificates can be reduced. Moreover, the proposed scheme not only provides mutual authentication but also supports a session key agreement between the user and the server. Compared with the related works, the proposed scheme is more efficient and practical for mobile devices.     

基于智能卡的远程用户匿名身份认证和密钥协商方案

分析了Li-Niu等(LI X, NIU J W, KHAN M K, et al. An enhanced smart card based remote user password authentication scheme［J］. Journal of Network and Computer Applications, 2013, 36(5):1365-1371.)基于智能卡的远程用户登录认证方案,指出了方案中存在的安全性问题,并提出了改进方案。新方案利用一种自认证的时间戳技术,与对称加密技术相结合,解决了多数智能卡方案中存在的时钟同步问题。与Li-Niu方案相比,新方案不仅可以提供用户的匿名登录,而且能够抵抗扮演攻击和内部攻击,适用于复杂的网络环境。     

An improved bilinear pairing based remote user authentication scheme

Recently Das et al. proposed a novel remote user authentication scheme using bilinear pairings. Chou et al. identified a weakness in Das et al.'s scheme and made an improvement. In this paper, we show that both Das et al.'s and Chou et al.'s schemes are insecure against forgery and replay attacks. We proposed an improved scheme that overcomes the security flaws without affecting the merits of the original scheme.     

基于口令的远程身份认证及密钥协商协议

基于口令的身份认证协议是研究的热点。分析了一个低开销的基于随机数的远程身份认证协议的安全性,指出了该协议的安全缺陷。构造了一个基于随机数和Hash函数、使用智能卡的远程身份认证和密钥协商协议：PUAKP协议。该协议使用随机数,避免了使用时戳带来的重放攻击的潜在风险。该协议允许用户自主选择和更改口令,实现了双向认证,有较小的计算开销;能够抵御中间人攻击;具有口令错误敏感性、口令的主机非透明性和强安全修复性;生成的会话密钥具有新鲜性、机密性、已知密钥安全性和前向安全性。     

An efficient improvement remote user mutual authentication and session key agreement scheme for E-health care systems

The E-health care systems allow patients to gain the health monitoring facility and access medical services remotely. A secure mechanism for mutual authentication and session key agreement is the most important requirements for E-Health Care Systems. Recently, Amin et al.’s proposed a mutual authentication and session key agreement protocol and claimed that their scheme is secure against all possible attacks. In this paper, we show that not only their scheme is vulnerable to privileged-insider attack, replay attack, session key disclosure attack, but also does not provide patient untraceability and backward secrecy. In order to withstand the mentioned security weaknesses, we propose an efficient remote mutual authentication scheme for the systems which are using ECC and Fuzzy Extractor. The proposed scheme not only resists against different security attacks, but it also provides an efficient registration, login, mutual authentication, session key agreement, and password and biometric update phases. During the experimentation, it has been observed that the proposed scheme is secure against various known attacks. Beside, our scheme is robust against privileged-insider attack that it rarely checked in security analysis. The informal analysis will ensure that our scheme provides well security protection against the different security attacks. Furthermore, we analyzed the security of the scheme using AVISPA software and Random Oracle Model. The formal analysis results and performance evaluation vouch that our scheme is also secure and efficient in computation and communication cost.     

一种改进的智能卡远程用户匿名认证方案

针对Sonwanshi提出的远程用户认证方案存在会话密钥安全性差、不能抵御扮演攻击和离线口令猜测攻击的缺陷,提出了一种改进方案,主要在注册和登录阶段增加了安全性能。在注册阶段,用户口令直接在智能卡内进行相应运算,不再提交给服务器。这不仅降低了服务器对口令存储、维护的开销,而且避免了服务器对用户的攻击,提高了安全性能。在登录阶段,采用随机数的挑战应答方式取代原方案的时间戳方式,消除了时钟不同步导致的认证失败。对原方案、改进方案和其他同类方案进行安全性和效率分析的结果表明,改进方案不仅弥补了原方案的缺陷,而且相对同类方案,降低了时间复杂度,适用于安全需求高、处理能力低的设备。     

An ID-based authenticated dynamic group key agreement with optimal round

Group key agreement protocols are crucial for achieving secure group communications.They are designed to provide a set of users with a shared secret key to achieve cryptographic goal over a public network.When group membership changes,the session key should be refreshed efficiently and securely.Most previous group key agreement protocols need at least two rounds to establish or refresh session keys.In this paper,a dynamic authenticated group key agreement(DAGKA) protocol based on identity-based cryptography is presented.By making use of the members’ values stored in previous sessions,our Join and Leave algorithms reduce the computation and communication costs of members.In the proposed protocol,Setup and Join algorithms need one round.The session key can be refreshed without message exchange among remaining users in Leave algorithm,which makes the protocol more practical.Its security is proved under decisional bilinear Diffie-Hellman(DBDH) assumption in random oracle model.     

一种强安全的WSN用户认证及密钥协商方案

针对无线传感器网络双因素用户认证方案中智能卡内敏感信息被破译、公共信道信息传输被侦听引起的匿名性隐患及密码猜测等攻击,在T-M方案的基础上,注册阶段采用哈希加密深度隐藏了用户隐私信息,增强智能卡中元素的抗猜测性;又将网关作为消息中转站提前对用户进行验证,调整了信息传输结构及认证方式,减少节点能耗且加强消息传输的安全防护;同时,在网关端添加写保护用户身份日志表,及时记录用户登录信息,以防资源滥用。理论分析及实验显示了所提方案有效抵御了T-M方案的不足,大大减少了传感节点的通信开销,提供更多的安全防护且具有计费功能。     

对Liao等人身份鉴别方案的分析与改进

基于智能卡的身份鉴别是一种双因子鉴别,被广泛应用于鉴别远程用户的身份。2006年,Liao等人提出了一种基于智能卡的身份鉴别方案。在目前身份鉴别研究的基础上,分析指出了Liao等人方案存在的安全漏洞,并对方案作了改进,改进后的方案不仅保持了Liao等人方案的优点,而且极大地增强了系统的高效性、安全性和实用性。     

A more efficient and secure ID-based remote mutual authentication with key agreement scheme for mobile devices on elliptic curve cryptosystem

Recently, Yang and Chang proposed an identity-based remote login scheme using elliptic curve cryptography for the users of mobile devices. We have analyzed the security aspects of the Yang and Chang's scheme and identified some security flaws. Also two improvements of the Yang and Chang's scheme have been proposed recently, however, it has been found that the schemes have similar security flaws as in the Yang and Chang's scheme. In order to remove the security pitfalls of the Yang and Chang and the subsequent schemes, we proposed an enhanced remote user mutual authentication scheme that uses elliptic curve cryptography and identity-based cryptosystem with three-way challenge-response handshake technique. It supports flawless mutual authentication of participants, agreement of session key and the leaked key revocation capability. In addition, the proposed scheme possesses low power consumption, low computation cost and better security attributes. As a result, the proposed scheme seems to be more practical and suitable for mobile users for secure Internet banking, online shopping, online voting, etc.     

动态ID多因素远程用户身份认证方案的改进

基于动态身份信息ID的远程用户身份认证方案,在保证远程用户身份匿名性及不可追踪性的前提下,可实现远程用户与服务器端的双向身份认证。对Yang提出的基于动态ID的远程用户身份认证方案进行了安全分析,指出Yang方案无法抵御重放攻击、服务器伪装攻击、用户伪装攻击,且不能提供双向认证。针对这些缺陷,提出了一种多因素远程用户身份认证方案的改进,并进行了安全性和效率分析,分析结果表明,改进的方案弥补了Yang方案的不足,且具有较高的安全性能。     

An efficient and secure multi-server authentication scheme with key agreement

Remote user authentication is used to validate the legitimacy of a remote log-in user. Due to the rapid growth of computer networks, many network environments have been becoming multi-server based. Recently, much research has been focused on proposing remote password authentication schemes based on smart cards for securing multi-server environments. Each of these schemes used either a nonce or a timestamp technique to prevent the replay attack. However, using the nonce technique to withstand the replay attack is potentially susceptible to the man-in-the-middle attack. Alternatively, when employing the timestamp method to secure remote password authentication, it will require the cost of implementing clock synchronization. In order to solve the above two issues, this paper proposes a self-verified timestamp technique to help the smart-card-based authentication scheme not only effectively achieve password-authenticated key agreement but also avoid the difficulty of implementing clock synchronization in multi-server environments. A secure authenticated key agreement should accomplish both mutual authentication and session key establishment. Therefore, in this paper we further give the formal proof on the execution of the proposed authenticated key agreement scheme.     

新的基于身份认证的群密钥协商协议

群密钥协商（GKA）协议在构建安全多播信道中扮演着主要角色。由于公钥管理的简洁性和高效性,基于身份的认证群密钥协商协议密码系统近年来成为热门研究方向。提出了一个基于Weil对和完全三叉树结构的群密钥协商协议,同时提出了成员加入和离开子协议。对新方案的安全性进行了分析,结果显示,新方案可以抵抗常见的攻击。在性能方面,新方案在参与者较多时有较明显的计算优势。