Two robust remote user authentication protocols using smart cards

With the rapid growth of electronic commerce and enormous demand from variants of Internet based applications, strong privacy protection and robust system security have become essential requirements for an authentication scheme or universal access control mechanism. In order to reduce implementation complexity and achieve computation efficiency, design issues for efficient and secure password based remote user authentication scheme have been extensively investigated by research community in these two decades. Recently, two well-designed password based authentication schemes using smart cards are introduced by Hsiang and Shih (2009) and Wang et al. (2009), respectively. Hsiang et al. proposed a static ID based authentication protocol and Wang et al. presented a dynamic ID based authentication scheme. The authors of both schemes claimed that their protocol delivers important security features and system functionalities, such as mutual authentication, data security, no verification table implementation, freedom on password selection, resistance against ID-theft attack, replay attack and insider attack, as well as computation efficiency. However, these two schemes still have much space for security enhancement. In this paper, we first demonstrate a series of vulnerabilities on these two schemes. Then, two enhanced protocols with corresponding remedies are proposed to eliminate all identified security flaws in both schemes.     

面向多网关的无线传感器网络多因素认证协议

无线传感器网络作为物联网的重要组成部分,广泛应用于环境监测、医疗健康、智能家居等领域.身份认证为用户安全地访问传感器节点中的实时数据提供了基本安全保障,是保障无线传感器网络安全的第一道防线;前向安全性属于系统安全的最后一道防线,能够极大程度地降低系统被攻破后的损失,因此一直被学术及工业界视为重要的安全属性.设计面向多网关的可实现前向安全性的无线传感器网络多因素身份认证协议是近年来安全协议领域的研究热点.由于多网关无线传感器网络身份认证协议往往应用于高安全需求场景,一方面需要面临强大的攻击者,另一方面传感器节点的计算和存储资源却十分有限,这给如何设计一个安全的多网关无线传感器网络身份认证协议带来了挑战.近年来,大量的多网关身份认证协议被提出,但大部分都随后被指出存在各种安全问题.2018年,Ali等人提出了一个适用于农业监测的多因素认证协议,该协议通过一个可信的中心(基站)来实现用户与外部的传感器节点的认证;Srinivas等人提出了一个通用的面向多网关的多因素身份认证协议,该协议不需要一个可信的中心,而是通过在网关之间存储共享秘密参数来完成用户与外部传感器节点的认证.这两个协议是多网关无线传感器网络身份认证协议的典型代表,分别代表了两类实现不同网关间认证的方式:1)基于可信基站,2)基于共享秘密参数.分析指出这两个协议对离线字典猜测攻击、内部攻击是脆弱的,且无法实现匿名性和前向安全性.鉴于此,本文提出一个安全增强的可实现前向安全性的面向多网关的无线传感器网络多因素认证协议.该协议采用Srinivas等协议的认证方式,即通过网关之间的共享秘密参数完成用户与外部传感器节点的认证,包含两种典型的认证场景.对新协议进行了BAN逻辑分析及启发式分析,分析结果表明该协议实现了双向认证,且能够安全地协商会话密钥以及抵抗各类已知的攻击.与相关协议的对比结果显示,新协议在提高安全性的同时,保持了较高的效率,适于资源受限的无线传感器网络环境.     

基于SM9算法的移动互联网身份认证方案研究

移动互联网单服务器环境下传统身份认证方案存在用户需要针对不同的服务器记忆相应的不同口令,以及传统认证方式中的口令泄漏等安全问题.为解决以上问题,文章提出一种移动互联网单服务器环境下基于SM9算法的身份认证方案.用户针对不同的应用系统,仅需记忆统一的标识和口令,即可在不同的应用系统中通过身份认证,从而获得应用服务和访问资...     

一种改进的智能卡远程用户匿名认证方案

针对Sonwanshi提出的远程用户认证方案存在会话密钥安全性差、不能抵御扮演攻击和离线口令猜测攻击的缺陷,提出了一种改进方案,主要在注册和登录阶段增加了安全性能。在注册阶段,用户口令直接在智能卡内进行相应运算,不再提交给服务器。这不仅降低了服务器对口令存储、维护的开销,而且避免了服务器对用户的攻击,提高了安全性能。在登录阶段,采用随机数的挑战应答方式取代原方案的时间戳方式,消除了时钟不同步导致的认证失败。对原方案、改进方案和其他同类方案进行安全性和效率分析的结果表明,改进方案不仅弥补了原方案的缺陷,而且相对同类方案,降低了时间复杂度,适用于安全需求高、处理能力低的设备。     

Implementation and evaluation of a remote authentication system using touchless palmprint recognition

When a cellular phone is lost or stolen, it may be used improperly or the personal information may be stolen from it by a malicious user. Biometric authentication such as palmprint recognition is the strongest of the personal authentication technologies designed to prevent such misuse. In biometric authentication, when compared with a local authentication model, a remote authentication model has several advantages such as direct authentication and authentication levels. Ito et al. proposed several palmprint recognition schemes using correspondence matching based on the phase-only correlation. However, these schemes require a palmprint image to be captured with the hand touching the dedicated device, while palmprint images must be captured without such physical contact when using cellular phones. Thus, these schemes cannot be applied to cellular phones since there are large positioning gaps and large differences in brightness and distortion between the images. Furthermore, they have not been implemented in cellular phones and their performances have not been evaluated either. In this paper, we adopt a remote authentication model from the two types of biometric authentication incorporating the above advantages and propose a remote system between a cellular phone and an authentication server. We implement the proposed system using two different types of Android terminal as the terminal on the user side. We also show the validity of the proposed system by examining and confirming the accuracy and processing time. We furthermore discuss the problem of an impersonation attack on the proposed system and consider solutions to this problem from the viewpoints of security and usability. Then, we adopt a palmprint recognition scheme as a biometric authentication scheme and, in particular, use a palmprint recognition algorithm that incorporates Yörük et al.’s preprocessing technique to Ito et al.’s and Iitsuka et al.’s schemes.     

基于切比雪夫混沌映射的车联网高效认证方案

车联网在智能交通系统构建中发挥重要作用,消息认证方案能够为车联网的实际应用提供可靠性和安全性保障,但现有认证方案多数存在计算效率低下的问题,为此,提出一种基于切比雪夫混沌映射的车联网认证方案。利用切比雪夫多项式的半群性质构建对称密钥,以实现车辆节点与路边设施单元（RSU）的密钥协商。车辆节点使用由RSU分发的时效性共享密钥完成车辆间的匿名消息认证,无须为每个消息签名验证一个较大的撤销列表,车辆的撤销也不会影响群组性能。分析结果表明,该方案可以满足车联网的安全需求并抵御多种安全攻击,同时提供条件隐私保护,其密钥协商与消息认证阶段的计算效率较高,通信开销较低。     

Dynamic ID-based remote user password authentication schemes using smart cards: A review

Remote user authentication is a mechanism, in which the remote server verifies the legitimacy of a user over an insecure communication channel. Until now, there have been ample of remote user authentication schemes published in the literature and each published scheme has its own merits and demerits. A common feature among most of the published schemes is that the user's identity (ID) is static in all the transaction sessions, which may leak some information about that user and can create risk of identity theft during the message transmission. To overcome this risk, many researchers have proposed dynamic ID based remote user authentication schemes. In this paper, we have defined all the security requirements and all the goals an ideal password authentication scheme should satisfy and achieve. We have presented the results of our survey through six of the currently available dynamic ID based remote user authentication schemes. All the schemes are vulnerable to guessing attack except Khan et al.'s scheme, and do not meet the goals such as session key agreement, secret key forward secrecy. In the future, we hope an ideal dynamic ID based password authentication scheme, which meets all the security requirements and achieves all the goals can be developed.     

An efficient non-interactive deniable authentication scheme based on trapdoor commitment schemes

Deniable authentication scheme is one of useful tools for secure communications. The scheme allows a sender to prove the authenticity of a message to a specified receiver without permitting the receiver to prove that the message was authenticated by the sender. Non-interactive schemes are more attractive than interactive schemes in terms of communication overhead, and thus several non-interactive deniable authentication scheme have been proposed. In this paper, we propose an efficient non-interactive deniable authentication scheme based on trapdoor commitment scheme. We construct an efficient trapdoor commitment scheme which provides very efficient commitment evaluation operation. Then we design an efficient non-interactive deniable authentication scheme by using the trapdoor commitment scheme. We also prove the security of our scheme under firmly formalized security model.     

An anonymous authentication and secure data transmission scheme for the Internet of Things based on blockchain

With the widespread use of network infrastructures such as 5G and low-power wide-area networks, a large number of the Internet of Things (IoT) device nodes are connected to the network, generating massive amounts of data. Therefore, it is a great challenge to achieve anonymous authentication of IoT nodes and secure data transmission. At present, blockchain technology is widely used in authentication and s data storage due to its decentralization and immutability. Recently, Fan et al. proposed a secure and efficient blockchain-based IoT authentication and data sharing scheme. We studied it as one of the state-of-the-art protocols and found that this scheme does not consider the resistance to ephemeral secret compromise attacks and the anonymity of IoT nodes. To overcome these security flaws, this paper proposes an enhanced authentication and data transmission scheme, which is verified by formal security proofs and informal security analysis. Furthermore, Scyther is applied to prove the security of the proposed scheme. Moreover, it is demonstrated that the proposed scheme achieves better performance in terms of communication and computational cost compared to other related schemes.     

A strong user authentication scheme with smart cards for wireless communications

Seamless roaming over wireless network is highly desirable to mobile users, and security such as authentication of mobile users is challenging. Recently, due to tamper-resistance and convenience in managing a password file, some smart card based secure authentication schemes have been proposed. This paper shows some security weaknesses in those schemes. As the main contribution of this paper, a secure and light-weight authentication scheme with user anonymity is presented. It is simple to implement for mobile user since it only performs a symmetric encryption/decryption operation. Having this feature, it is more suitable for the low-power and resource-limited mobile devices. In addition, it requires four message exchanges between mobile user, foreign agent and home agent. Thus, this protocol enjoys both computation and communication efficiency as compared to the well-known authentication schemes. As a special case, we consider the authentication protocol when a user is located in his/her home network. Also, the session key will be used only once between the mobile user and the visited network. Besides, security analysis demonstrates that our scheme enjoys important security attributes such as preventing the various kinds of attacks, single registration, user anonymity, no password/verifier table, and high efficiency in password authentication, etc. Moreover, one of the new features in our proposal is: it is secure in the case that the information stored in the smart card is disclosed but the user password of the smart card owner is unknown to the attacker. To the best of our knowledge, until now no user authentication scheme for wireless communications has been proposed to prevent from smart card breach. Finally, performance analysis shows that compared with known smart card based authentication protocols, our proposed scheme is more simple, secure and efficient.     

无线传感器网络中具有匿名性的用户认证协议

对He等人提出的无线传感器网络用户认证协议(Ad-Hoc Sensor Wireless Networks, 2010, No.4)进行研究,指出该协议无法实现用户匿名性,不能抵抗用户仿冒攻击和网关节点旁路攻击,并利用高效的对称密码算法和单向hash函数对其进行改进。理论分析结果证明,改进协议可以实现用户匿名性、不可追踪性及实体认证,抵抗离线字典攻击、用户仿冒攻击和网关节点旁路攻击,与同类协议相比,计算效率更高。     

基于动态信任值的智能手机隐式认证方案

在智能手机隐私安全领域,隐式认证具有高安全性、友好交互体验等优点,但存在行为特征采集不便、认证模型复杂的问题。提出一种基于动态信任值的分级隐式认证方案。利用机器学习方法进行模型训练,提取用户划屏行为特征作为前级认证数据,并将前级输出概率经信任值检测作为后级认证数据,进而得到最终认证结果。同时基于真实用户历史认证变化的稳定性和连续性,通过计算一定时间窗口内的认证概率均值作为动态信任更新值,使信任值在真实用户认证结果变化范围内波动。实验结果表明,该方案的分类准确率达到98.63%,等错误率仅为3.43%,与只包含前级认证的方案相比准确性更高,并且能够有效阻挡冒名者非法使用手机。     

A secure and robust temporal credential-based three-factor user authentication scheme for wireless sensor networks

User authentication is one of the most important security services required for the resource-constrained wireless sensor networks (WSNs). In user authentication, for critical applications of WSNs, a legitimate user is allowed to query and collect the real-time data at any time from a sensor node of the network as and when he/she demands for it. In order to get the real-time information from the nodes, the user needs to be first authenticated by the nodes as well as the gateway node (GWN) of WSN so that illegal access to nodes do not happen in the network. Recently, Jiang et al. proposed an efficient two-factor user authentication scheme with unlinkability property in WSNs Jiang (2014). In this paper, we analyze Jiang et al.’s scheme. Unfortunately, we point out that Jiang et al.’s scheme has still several drawbacks such as (1) it fails to protect privileged insider attack, (2) inefficient registration phase for the sensor nodes, (3) it fails to provide proper authentication in login and authentication phase, (4) it fails to update properly the new changed password of a user in the password update phase, (5) it lacks of supporting dynamic sensor node addition after initial deployment of nodes in the network, and (6) it lacks the formal security verification. In order to withstand these pitfalls found in Jiang et al.’s scheme, we aim to propose a three-factor user authentication scheme for WSNs. Our scheme preserves the original merits of Jiang et al.’s scheme. Our scheme is efficient as compared to Jiang et al.’s scheme and other schemes. Furthermore, our scheme provides better security features and higher security level than other schemes. In addition, we simulate our scheme for the formal security analysis using the widely-accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool. The simulation results clearly demonstrate that our scheme is also secure.     

基于EPC-C1G2标准的RFID认证机制

分析EPC-C1G2标准认证机制和现有改进方案,针对超高频射频识别(RFID)认证机制存在的安全缺陷,提出一种轻量级RFID认证方案。该方案实现了读写器和标签的双向认证,其轻量级加密算法能在一定程度上保证消息的安全传输。分析结果表明该方案具有较高安全性,能满足超高频RFID的安全需求。     

Enhanced Dynamic Authentication Scheme (EDAS)

With non-stop growth in network environments, communication security is necessary. A strong protocol guarantees that users and service providers are secure against many kinds of attacks, such as impersonation and replay attack. Sood et al. proposed an authentication scheme based on dynamic identity to prevent transactions from being intercepted by malicious users. Although they claimed that their scheme has advantages over previous schemes with the same approach, we prove that their scheme is vulnerable to impersonation attack and stolen verification attack, and can be affected by clock synchronization. Therefore we propose a novel authentication scheme to enhance security and overcome limitations existing in Sood’s scheme. Our security analysis shows that our proposed method can efficiently resist known types of attacks. Experimental results also show that the method can be implemented and processed in real-time thus applicable for not only regular computers but also mobile devices.     

基于区块链技术的生物特征和口令双因子跨域认证方案

为解决传统跨域认证方式不多且方案复杂的问题,提出了基于区块链技术的生物特征和口令双因子跨域认证方案。首先,使用模糊提取技术提取生物特征的随机密钥参与认证,解决了生物特征泄露导致永久不可用的问题;其次,利用不易篡改的区块链存储生物特征公开信息,解决了模糊提取技术易受主动攻击威胁的问题;最后,基于区块链的分布式存储功能与联盟链架构,实现了用户在本地和异地环境下的双因子跨域认证。安全性分析和效率分析的结果表明,在安全性方面,所提方案具有抗中间人攻击、抗重放攻击等安全属性;在效率与可用性方面,该方案效率适中,用户无需携带智能卡,系统的可扩展性强。     

更安全的匿名三因子多服务器身份认证协议研究

多服务器架构下的身份认证协议是远程认证的关键,但许多现有方案都存在潜在的攻击,未实现三因子安全性,忽略了匿名性。因此,需要指出其中的错误,并提出一个匿名的三因子方案。通过攻击者模型,攻击了温翔等人的方案,检验了新方案;使用椭圆曲线密码,保障认证阶段的核心安全性;使用模糊提取器与验证器,保护生物特征与口令;经与同类协议比较,分析了新协议的优势。分析表明,温翔等人的方案不能抵抗服务器仿冒用户,不具匿名性等。而新协议能有效防范智能卡丢失攻击、仿冒攻击等更多样的攻击,实现了匿名性、前向安全性等更全面的功能,计算效率也比前人提高了约14.8%。因此,可以应用于对安全性、可靠性要求较高的多服务器认证网络。     

Dual-Stage Biometrics-Based Password Authentication Scheme Using Smart Cards

This paper proposes a dual-stage biometrics-based authentication mechanism using smart card. It is considered the improvement over the conventional single-stage biometrics-based authentication mechanism, which exploits only one server for authentication, whereas the proposed scheme exploits two servers. The user authentication is performed in one server and hence it is called an authentication server. The credentials of the authentication server are stored in the second server, called the master server. The master server facilitates the authentication by providing required credentials to the authentication server. Both the security analysis and complexity analysis are conducted between the proposed and the conventional schemes. The analysis results show that the proposed scheme is secure than the conventional schemes with negligible computational complexity.     

Robust biometrics-based multi-server authentication with key agreement scheme for smart cards on elliptic curve cryptosystem

Conventional single-server authentication schemes suffer a significant shortcoming. If a remote user wishes to use numerous network services, he/she must register his/her identity and password at these servers. It is extremely tedious for users to register numerous servers. In order to resolve this problem, various multi-server authentication schemes recently have been proposed. However, these schemes are insecure against some cryptographic attacks or inefficiently designed because of high computation costs. Moreover, these schemes do not provide strong key agreement function which can provide perfect forward secrecy. Based on these motivations, this paper proposes a new efficient and secure biometrics-based multi-server authentication with key agreement scheme for smart cards on elliptic curve cryptosystem (ECC) without verification table to minimize the complexity of hash operation among all users and fit multi-server communication environments. By adopting the biometrics technique, the proposed scheme can provide more strong user authentication function. By adopting the ECC technique, the proposed scheme can provide strong key agreement function with the property of perfect forward secrecy to reduce the computation loads for smart cards. As a result, compared with related multi-serve authentication schemes, the proposed scheme has strong security and enhanced computational efficiency. Thus, the proposed scheme is extremely suitable for use in distributed multi-server network environments such as the Internet and in limited computations and communication resource environments to access remote information systems since it provides security, reliability, and efficiency.     

Cryptanalysis of Arshad et al.’s ECC-based mutual authentication scheme for session initiation protocol

Session Initiation Protocol (SIP) has been widely used in the current Internet protocols such as Hyper Text Transport Protocol (HTTP) and Simple Mail Transport Protocol (SMTP). However, the original SIP authentication scheme was insecure and many researchers tried to propose schemes to overcome the flaws. In the year 2011, Arshad et al. proposed a SIP authentication protocol using elliptic curve cryptography (ECC), but their scheme suffered from off-line password guessing attack along with password change pitfalls. To conquer the mentioned weakness, we proposed an ECC-based authentication scheme for SIP. Our scheme only needs to compute four elliptic curve scale multiplications and two hash-to-point operations, and maintains high efficiency. The analysis of security of the ECC-based protocol shows that our scheme is suitable for the applications with higher security requirement.