An ID-based client authentication with key agreement protocol for mobile client-server environment on ECC with provable security

Recently, lots of remote user authentication schemes are implemented on elliptic curve cryptosystem (ECC) to reduce the computation loads for mobile devices. However, most of those remote user authentication schemes on ECC suffer from different attacks and can not provide provable security. Therefore, we propose an ID-based remote mutual authentication with key agreement scheme on ECC in this paper. The proposed scheme not only provides mutual authentication but also supports a session key agreement between the user and the server. The scheme also provides the known session key security, the perfect forward secrecy, the no key-compromise impersonation, the no unknown key-share and the no key control. Compared with the related works, the proposed scheme is more efficient and practical for mobile devices. We also give a security proof under the random oracle.     

Two ID-based authenticated schemes with key agreement for mobile environments

With the rapid development of electronic commerce transactions on mobile devices, achieving secure communications between communication parties is an important issue. The typical solutions are authenticated key agreement protocols, designed to efficiently implement secure channels for two or more parties communicating via a public network by providing them with a shared secret key, called a session key. In this paper, we propose two key agreement schemes based on elliptic curve cryptosystems suited for mobile environments. The first one is an identity-based remote mutual authentication with key agreement scheme, and it is used to establish a session key between the client and the server. In the second one, we extend the proposed two-party authentication key exchange scheme to develop an efficient three-party authenticated key agreement scheme for establishing a session key between two users with the help of a trusted server. Both our proposed schemes achieve efficiency, practicability, simplicity, and strong notions of security.     

An ID-based remote mutual authentication with key agreement scheme for mobile devices on elliptic curve cryptosystem

Recently, remote user authentication schemes are implemented on elliptic curve cryptosystem (ECC) to reduce the computation loads for mobile devices. However, most remote user authentication schemes on ECC are based on public-key cryptosystem, in which the public key in the system requires the associated certificate to prove its validity. Thus, the user needs to perform additional computations to verify the certificate in these schemes. In addition, we find these schemes do not provide mutual authentication or a session key agreement between the user and the remote server. Therefore, we propose an ID-based remote mutual authentication with key agreement scheme on ECC in this paper. Based upon the ID-based concept, the proposed scheme does not require public keys for users such that the additional computations for certificates can be reduced. Moreover, the proposed scheme not only provides mutual authentication but also supports a session key agreement between the user and the server. Compared with the related works, the proposed scheme is more efficient and practical for mobile devices.     

节点证书与身份相结合的HMIPv6 网络接入认证机制

接入认证是层次型移动IPv6(HMIPv6)网络安全的基本需求.构建了适于HMIPv6的分层认证框架,设计了一种节点证书与身份相结合的签名方案,并以此为基础提出了HMIPv6网络双向接入认证机制.该机制利用基于身份密码技术简化了公钥基础设施的复杂密钥管理过程;以节点证书为接入认证的主要依据,消除了接入网络与家乡网络间的消息交互;采用提出的层次化签名方案,实现了用户与接入网络的双向认证.机制经过简单扩展,能够支持多层HMIPv6网络的接入认证.性能与安全性分析表明,与传统的及其他基于身份的认证方案比较,所提出的机制拥有更高的认证效率和安全性.     

Remote user authentication and key agreement for mobile client–server environments on elliptic curve cryptography

In recent years, with the rapid advance of wireless mobile networks, secure and efficient authentication mechanisms that can operate over insecure wireless channels have become increasingly essential. To improve the efficiency in the energy-limited mobile devices, many authentication schemes using elliptic curve cryptography (ECC) have been presented. However, these schemes are still inefficient in terms of computation cost and communication overhead. Moreover, they suffer from various attacks, making them impractical due to their inherent design. To address their weaknesses, we propose a more efficient ID-based authentication scheme on ECC for mobile client–server environments with considering security requirements. The proposed scheme not only provides mutual authentication but also achieves session key agreement between the client and the server. Through a rigorous formal security proof under random oracle model, it has been indicated that the proposed protocol is secure against security threats. The informal security analysis shows that our scheme can resist well-known attacks and provides user anonymity. Performance analysis and comparison results demonstrate that our scheme outperforms the related competitive works and is more suitable for practical application in mobile client–server environments.     

一种移动互联网络匿名认证协议

针对移动互联网络安全性的匿名需求,论文在基于身份的公钥系统的基础上,设计了一个双向匿名认证协议,该协议提出移动互联网络通信中的匿名身份认证和密钥协商方案,实现了通信双方的相互认证,并使移动网络向移动用户提供匿名服务,保护用户身份信息,分析表明协议具有很强的匿名性,而且高效可行,满足移动互联网络匿名性的安全需求。     

具有消息恢复功能的椭圆曲线签名系统

通过对E1Gamal密码系统的签名方案进行分析,在保证签名算法安全性的前提下,对ECC签名方案中的求逆运算和消息恢复问题进行了优化,针对这两个问题构造了新的签名方案,解决了ECC签名方案中存在的需要求逆运算和不能实现消息恢复的问题,大大简化了运算的复杂程度。在该签名机制的基础上,提出了一般椭圆曲线签名系统无法实现的无信任限制的公钥密码系统和具有相互认证功能的一次传输密钥交换机制。     

New robust biometrics-based mutual authentication scheme with key agreement using elliptic curve cryptography

In this work, we demonstrate that Chaudhry et al.’s recent biometrics-based three factor authentication scheme is vulnerable to the denial of service attack, and it also fails to provide perfect forward secrecy because it only uses the lightweight symmetric key primitives to ensure security. To enhance the information security, this article presents a new robust biometrics-based mutual authentication scheme using elliptic curve cryptography for client-server architecture based applications in mobile environment. The proposed scheme supports session key agreement and flawless mutual authentication of participants, which is proved under the BAN logic. Moreover, the proposed scheme provides prefect security attributes and resists all known attacks, and it has perfect performance in communication cost. Thereby, the proposed scheme is more suitable for client-server architecture based applications.     

基于ECC的密钥协商及双向认证方案

针对当前移动通信系统中认证和密钥协商协议存在的安全缺陷,提出一种基于椭圆曲线密码体制的双向认证和密钥协商方案,用于移动网络中任意用户之间,或用户与网络之间进行双向认证和会话密钥的安全协商.该方案采用ECC技术,能够在更小的密钥量下提供更大的安全性,减少对带宽的需求,降低移动终端的计算负担和存储要求.     

An Efficient Authentication Scheme for Access Control in Mobile Pay-TV Systems

In a mobile pay-TV system, a large number of messages are exchanged for mutual authentication purposes. In traditional authentication schemes, with one-to-one delivery, one authentication message per request is delivered from a head end system to subscribers. This results in the delivery of a large quantity of messages and therefore is inefficient and costly. Moreover, since most traditional schemes use an RSA-based signature for identity validation and nonrepudiation of communication, they suffer from high communication costs. Due to its wireless nature, mobile pay-TV is vulnerable to attacks during hand-off. As traditional schemes do not support hand-off authentication, they are insecure during hand-off. With these shortcomings, they are not suitable for mobile pay-TV. In this paper, we propose an innovative authentication scheme, in which, by providing one-to-many facility, only one authentication message for multiple requests is broadcasted from the head end system to subscribers. By employing bilinear property of pairing and elliptic curve cryptography, our scheme provides one-to-many facility in the case of multiple requests for the same service in a short period of time. This new scheme achieves better broadcast efficiency and performance on communication costs than traditional ones. Additionally, this scheme provides a hand-off authentication mechanism to protect the access of services while preventing attacks during hand-off; therefore, the scheme is more secure to support access control. Moreover, to provide anonymous authentication for protecting identity privacy, the scheme adopts an identity-based scheme while traditional schemes do not apply. The scheme inherits advantages of the identity-based scheme that a public key does not need to be certificated, the certification authority mechanism will not be needed and the key exchange overhead can be reduced. With these advantages of our scheme, it is well suited for mobile pay-TV system.     

Cryptanalysis of Arshad et al.’s ECC-based mutual authentication scheme for session initiation protocol

Session Initiation Protocol (SIP) has been widely used in the current Internet protocols such as Hyper Text Transport Protocol (HTTP) and Simple Mail Transport Protocol (SMTP). However, the original SIP authentication scheme was insecure and many researchers tried to propose schemes to overcome the flaws. In the year 2011, Arshad et al. proposed a SIP authentication protocol using elliptic curve cryptography (ECC), but their scheme suffered from off-line password guessing attack along with password change pitfalls. To conquer the mentioned weakness, we proposed an ECC-based authentication scheme for SIP. Our scheme only needs to compute four elliptic curve scale multiplications and two hash-to-point operations, and maintains high efficiency. The analysis of security of the ECC-based protocol shows that our scheme is suitable for the applications with higher security requirement.     

MASHED: Security and privacy-aware mutual authentication scheme for heterogeneous and distributed mobile cloud computing services

ABSTRACT

Rapid development in mobile devices and cloud computing technologies has increased the number of mobile services from different vendors on the cloud platform. However, users of these services are facing different security and access control challenges due to the nonexistence of security solutions capable of providing secure access to these services, which are from different vendors, using a single key. An effective security solution for heterogeneous Mobile Cloud Computing (MCC) services should be able to guarantee confidentiality and integrity through single key-based authentication scheme. Meanwhile, a few of the existing authentication schemes for MCC services require different keys to access different services from different vendors on a cloud platform, thus increases complexity and overhead incurred through generation and storage of different keys for different services.

In this paper, an efficient mutual authentication scheme for accessing heterogeneous MCC services is proposed. The proposed scheme combines the user’s voice signature with cryptography operations to evolve efficient mutual authentication scheme devoid of key escrow problem and allows authorized users to use single key to access the heterogeneous MCC services at a reduced cost.     

Provably secure and pairing-free certificateless digital signature scheme using elliptic curve cryptography

A provably secure certificateless digital signature scheme using elliptic curve cryptography is presented in this paper. Since the certificateless public key cryptosystem removes the complex certificate management procedure and the private key escrow problem of traditional public key cryptography (PKC) and identity-based cryptosystem (IBC), respectively, and as a result, the proposed scheme is more efficient than IBC- and PKC-based signatures. Besides, the bilinear pairing and map-to-point hash function are time-consuming operations, and thus the signatures without these two operations are more attractive in real applications and the present work has been carried out in this direction. Based on the elliptic curve discrete logarithm assumption, it is shown that the proposed scheme is unforgeable under the adaptive chosen message and identity attacks in the random oracle model against variety of adversaries. Finally, our signature scheme is compared with a number of competitive schemes and the satisfactory performance has been achieved.     

基于身份的门限多重盲签名方案

利用椭圆曲线上的双线性映射、门限多重签名和签名盲化技术,提出一个基于身份的门限多重盲签名方案,分析了方案的盲性以及安全性。该方案具有盲性、不可伪造性等安全特征,可有效地阻止敌人窃取主密钥以及子秘密,并且能够利用多重签名的保证签名的不可否认性。     

面向MEC的V2G轻量级分层认证方案

现有的针对车辆到电网（vehicle to grid,V2G）网络的大多数身份认证方案无法适用于交互频繁的移动边缘计算（mobile edge computing,MEC）环境,存在认证机制不完善、认证延迟大、认证成本高等问题。为解决上述问题,基于椭圆曲线加密及哈希函数提出了一个适用于MEC环境的V2G轻量级分层身份认证方案。引入半可信实体,实现端、边、云三方实体间的两阶段双向认证,并设计了一个效用评判机制以减少认证交互轮次。随机预言模型下形式化的安全性分析证明所提方案具备较高的安全性,能够抵御信息泄露攻击等多种攻击威胁;性能评估分析表明,所提方案平均减少了大约16.25%的传输消息量,19.4%的计算成本及25.38%的通信开销,高度适用于多实体参与的MEC场景。     

Robust biometrics-based multi-server authentication with key agreement scheme for smart cards on elliptic curve cryptosystem

Conventional single-server authentication schemes suffer a significant shortcoming. If a remote user wishes to use numerous network services, he/she must register his/her identity and password at these servers. It is extremely tedious for users to register numerous servers. In order to resolve this problem, various multi-server authentication schemes recently have been proposed. However, these schemes are insecure against some cryptographic attacks or inefficiently designed because of high computation costs. Moreover, these schemes do not provide strong key agreement function which can provide perfect forward secrecy. Based on these motivations, this paper proposes a new efficient and secure biometrics-based multi-server authentication with key agreement scheme for smart cards on elliptic curve cryptosystem (ECC) without verification table to minimize the complexity of hash operation among all users and fit multi-server communication environments. By adopting the biometrics technique, the proposed scheme can provide more strong user authentication function. By adopting the ECC technique, the proposed scheme can provide strong key agreement function with the property of perfect forward secrecy to reduce the computation loads for smart cards. As a result, compared with related multi-serve authentication schemes, the proposed scheme has strong security and enhanced computational efficiency. Thus, the proposed scheme is extremely suitable for use in distributed multi-server network environments such as the Internet and in limited computations and communication resource environments to access remote information systems since it provides security, reliability, and efficiency.     

基于PANA的移动互联网匿名认证协议

针对移动互联网络的安全需求,在基于身份公钥系统的基础上,设计一种利用PANA的双向匿名AAA协议,该协议提出移动互联网络通信中基于网络层认证协议PANA的AAA方案,实现了通信双方的相互认证,并使移动互联网络向移动用户提供匿名服务,保护用户身份信息,具有较强的匿名性。试验结果表明,该协议高效可行,满足AAA下移动互联网络PANA协议匿名性的安全需求。     

A privacy preserving three-factor authentication protocol for e-Health clouds

E-Health clouds are gaining increasing popularity by facilitating the storage and sharing of big data in healthcare. However, such an adoption also brings about a series of challenges, especially, how to ensure the security and privacy of highly sensitive health data. Among them, one of the major issues is authentication, which ensures that sensitive medical data in the cloud are not available to illegal users. Three-factor authentication combining password, smart card and biometrics perfectly matches this requirement by providing high security strength. Recently, Wu et al. proposed a three-factor authentication protocol based on elliptic curve cryptosystem which attempts to fulfill three-factor security and resist various existing attacks, providing many advantages over existing schemes. However, we first show that their scheme is susceptible to user impersonation attack in the registration phase. In addition, their scheme is also vulnerable to offline password guessing attack in the login and password change phase, under the condition that the mobile device is lost or stolen. Furthermore, it fails to provide user revocation when the mobile device is lost or stolen. To remedy these flaws, we put forward a robust three-factor authentication protocol, which not only guards various known attacks, but also provides more desired security properties. We demonstrate that our scheme provides mutual authentication using the Burrows–Abadi–Needham logic.     

An efficient user authentication and key exchange protocol for mobile client–server environment

Considering the low-power computing capability of mobile devices, the security scheme design is a nontrivial challenge. The identity (ID)-based public-key system with bilinear pairings defined on elliptic curves offers a flexible approach to achieve simplifying the certificate management. In the past, many user authentication schemes with bilinear pairings have been proposed. In 2009, Goriparthi et al. also proposed a new user authentication scheme for mobile client–server environment. However, these schemes do not provide mutual authentication and key exchange between the client and the server that are necessary for mobile wireless networks. In this paper, we present a new user authentication and key exchange protocol using bilinear pairings for mobile client–server environment. As compared with the recently proposed pairing-based user authentication schemes, our protocol provides both mutual authentication and key exchange. Performance analysis is made to show that our presented protocol is well suited for mobile client–server environment. Security analysis is given to demonstrate that our proposed protocol is provably secure against previous attacks.     

可证安全的面向无线传感器网络的双因素认证方案

随着无线传感器网络的快速发展,对外部用户的身份进行确认已成为获取传感器网络中实时数据所要解决的关键问题。基于Nam提出的首个广泛适用于面向无线传感器网络的双因素认证方案的安全模型,设计了一个新的可证安全的用户认证密钥协商方案。该方案基于椭圆曲线密码体制,达到用户、网关节点及传感器节点之间的双向认证,满足匿名性并建立会话密钥,最后基于ECCDH困难性假设证明了新方案的安全性。与Nam提出的方案相比,在满足安全性的同时,将参与者的计算效率达到最优,更符合资源受限环境及现实应用。