Authentication And Key Agreement Research Articles

5G wireless P2MP backhaul security protocol: an adaptive approach

5G has introduced various emerging demands for new services and technologies that raised the bar for quality of service, latency, handovers, and data rates. Such diverse and perplexing network requirements bring numerous issues, among which security stands in the first row. The backhaul, which can be implemented as a wired or wireless solution, serves as a bridge between the radio access and core networks assuring connectivity to end users. The recent trends in backhaul usage rely on wireless technologies implemented using point-to-point (PTP) or point-to-multipoint (P2MP) configurations. Unfortunately, due to the nature of the transmission medium, the wireless backhaul is vulnerable and exposed to more various security threats and attacks than the wired one. In order to protect the backhaul, there have been several researches, whose authentication and key exchange scheme mainly depends on the existing security standards such as transport layer security (TLS), Internet Key Exchange version 1 (IKEv1), IKEv2, Host Identity Protocol (HIP), and Authentication and Key Agreement (AKA). However, such security standards cannot completely fulfil the security requirements including security policy update, key update, and balancing between security and efficiency, which are necessary for the emerging 5G networks. This is basically the motive behind why we study and propose a new security protocol for the backhaul link of wireless access network based on P2MP model. The proposed protocol is designed to be 5G-aware, and provides mutual authentication, perfect forward secrecy, confidentiality, integrity, secure key exchange, security policy update, key update, and balancing trade-off between efficiency and security while preventing resource exhaustion attacks. The protocol’s correctness is formally verified by the well-known formal security analysis tools: BAN-logic and Scyther. Moreover, the derived lemmas prove that the security requirements are satisfied. Finally, from a comparison analysis, it is shown that the proposed protocol is better than other standard protocols.

Enhanced authentication and key exchange for end to end security in mobile commerce using wireless public key infrastructure

PurposeThe purpose of the study is to develop a secure, efficient, and enhanced user authentication mechanism to achieve reliable and authenticated connection. In online transactions, users and resources are located at different places, and the sensitive information is to be protected and transferred using the suitable, reliable mechanism.Design/methodology/approachOne of the latest approach to handle the requirement is by a Public Key Infrastructure (PKI) or its variant Wireless Public Key Infrastructure (WPKI). Fundamental management techniques are required to be very secure and vital since they are one of the points of attack in public key cryptosystem. Entity authentication and key agreement (AKA) is a critical cryptographic problem in wireless communication, where a mutual entity authentication plays a vital role in the establishment of the secure and authentic connection. This paper proposes an efficient and enhanced AKA scheme (EAKA) with the end-to-end security and verifies the proposed system for protection using automated validation of internet security protocols and applications. An efficient way for the implementation of an enhanced version of the protocol is proposed using a lattice-based cryptographic algorithm.FindingsThe time consumed for the proposed research work shows that it is practical and acceptable.Originality/valueThe proposed research work is an efficient and enhanced user authentication mechanism.

Development of an Enhanced Secured Authentication and Key Agreement Procedure for UMTS Network

Universal Mobile Telecommunication Systems Authentication and Key Agreement (UMTS-AKA) protocol is an enhanced Authentication and Key Agreement (AKA) protocol of Global System for Mobile (GSM) communications. The UMTS-AKA has weaknesses in bandwidth consumption, authentication message overhead and mutual authentication. This paper analyzes UMTS-AKA protocol and proposes a new Enhanced Secured Universal Mobile Telecommunication System Authentication and Key Agreement (ESUMTS-AKA) protocol with additional security features. All the messages exchanged between different entities with International Mobile Subscriber Identity (IMSI) are encrypted so that it would be less vulnerable to attacks. Private keys and public keys of different entities are used during encryption of messages. A temporary key in the proposed ESUMTS-AKA protocol reduces the bandwidth consumption between different entities. The computation of hash functions in Home Network (HN) decreases by increasing the hash functions generated in Serving Network (SN). The proposed ESUMTS-AKA protocol is more secured due to Combined Cipher Key (CCiK) and Combined Integrity Key (CInK). Analysis and simulated results prove that the proposed ESUMTS-AKA protocol is more enhanced and highly protected.

Side-Channel Analysis for the Authentication Protocols of CDMA Cellular Networks

Time-division multiple access (TDMA) and code-division multiple access (CDMA) are two technologies used in digital cellular networks. The authentication protocols of TDMA networks have been proven to be vulnerable to side-channel analysis (SCA), giving rise to a series of powerful SCA-based attacks against unprotected subscriber identity module (SIM) cards. CDMA networks have two authentication protocols, cellular authentication and voice encryption (CAVE) based authentication protocol and authentication and key agreement (AKA) based authentication protocol, which are used in different phases of the networks. However, there has been no SCA attack for these two protocols so far. In this paper, in order to figure out if the authentication protocols of CDMA networks are sufficiently secure against SCA, we investigate the two existing protocols and their cryptographic algorithms. We find the side-channel weaknesses of the two protocols when they are implemented on embedded systems. Based on these weaknesses, we propose specific attack strategies to recover their authentication keys for the two protocols, respectively. We verify our strategies on an 8-bit microcontroller and a real-world SIM card, showing that the authentication keys can be fully recovered within a few minutes with a limited number of power measurements. The successful experiments demonstrate the correctness and the effectiveness of our proposed strategies and prove that the unprotected implementations of the authentication protocols of CDMA networks cannot resist SCA.

SRGH: A secure and robust group‐based handover AKA protocol for MTC in LTE‐A networks

SummaryMachine‐type communication (MTC) is defined as an automatic aggregation, processing, and exchange of information among intelligent devices without humans intervention. With the development of immense embedded devices, MTC is emerging as the leading communication technology for a wide range of applications and services in the Internet of Things (IoT). For achieving the reliability and to fulfill the security requirements of IoT‐based applications, researchers have proposed some group‐based handover authentication and key agreement (AKA) protocols for mass MTCDs in LTE‐A networks. However, the realization of secure handover authentication for the group of MTCDs in IoT enabled LTE‐A network is an imminent issue. Whenever mass MTCDs enter into the coverage area of target base‐station simultaneously, the protocols incur high signaling congestion. In addition, the existing group‐based handover protocols suffer from the huge network overhead and numerous identified problems such as lack of key forward/backward secrecy, privacy‐preservation. Moreover, the protocols fail to avoid the key escrow problem and vulnerable to malicious attacks. To overcome these issues, we propose a secure and robust group‐based handover (SRGH) AKA protocol for mass MTCDs in LTE‐A network. The protocol establishes the group key update mechanism with forward/backward secrecy. The formal security proof demonstrates that the protocol achieves all the security properties including session key secrecy and data integrity. Furthermore, the formal verification using the AVISPA tool shows the correctness and informal analysis discusses the resistance from various security problems. The performance evaluation illustrates that the proposed protocol obtains substantial efficiency compared with the existing group‐based handover AKA protocols.

Privacy Protection for Telecare Medicine Information Systems with Multiple Servers Using a Biometric-based Authenticated Key Agreement Scheme

Telecare medical information systems (TMIS) allow patients remotely login medical service providers to acquire their medical information and track their health status through unsecured public networks. Hence, the privacy of patients is vulnerable to various types of security threats and attacks, such as the leakage of medical records or login footprints and the forgery attacks. Many anonymous three-factor authentication and key agreement (AKA) schemes have been proposed for TMIS with single server, but none of them is suited for TMIS with multiple servers. In this paper, we propose a biometric-based three-factor AKA scheme to protect user anonymity and untraceability in TMIS with multiple servers. We will construct a security model of a three-factor AKA scheme with user anonymity in TMIS with multiple servers, and give a formal security proof of the proposed scheme. The security of the proposed scheme is based on the elliptic curve decisional Diffie-Hellman problem assumption and hash function assumption. We will show that the proposed scheme is efficient enough for low-power mobile devices.

An Authentic-Based Privacy Preservation Protocol for Smart e-Healthcare Systems in IoT

Emerging technologies rapidly change the essential qualities of modern societies in terms of smart environments. To utilize the surrounding environment data, tiny sensing devices and smart gateways are highly involved. It has been used to collect and analyze the real-time data remotely in all Industrial Internet of Things (IIoT). Since the IIoT environment gathers and transmits the data over insecure public networks, a promising solution known as authentication and key agreement (AKA) is preferred to prevent illegal access. In the medical industry, the Internet of Medical Things (IoM) has become an expert application system. It is used to gather and analyze the physiological parameters of patients. To practically examine the medical sensor-nodes, which are imbedded in the patient’s body. It would in turn sense the patient medical information using smart portable devices. Since the patient information is so sensitive to reveal other than a medical professional, the security protection and privacy of medical data are becoming a challenging issue of the IoM. Thus, an anonymity-based user authentication protocol is preferred to resolve the privacy preservation issues in the IoM. In this paper, a Secure and Anonymous Biometric Based User Authentication Scheme (SAB-UAS) is proposed to ensure secure communication in healthcare applications. This paper also proves that an adversary cannot impersonate as a legitimate user to illegally access or revoke the smart handheld card. A formal analysis based on the random-oracle model and resource analysis is provided to show security and resource efficiencies in medical application systems. In addition, the proposed scheme takes a part of the performance analysis to show that it has high-security features to build smart healthcare application systems in the IoM. To this end, experimental analysis has been conducted for the analysis of network parameters using NS3 simulator. The collected results have shown superiority in terms of the packet delivery ratio, end-to-end delay, throughput rates, and routing overhead for the proposed SAB-UAS in comparison to other existing protocols.

Novel 5G Authentication Protocol to Improve the Resistance Against Active Attacks and Malicious Serving Networks

The security of mobile communication largely depends on the strength of the authentication key exchange protocol. The 3rd Generation Partnership Project (3GPP) Group has standardized the 5G AKA (Authentication and Key Agreement) protocol for the next generation of mobile communications. It has been recently shown that the current version of this protocol still contains several weaknesses regarding user localization, leakage of activity, active attackers, and in the presence of malicious serving networks, leading to potentially major security leaks. We propose a new version of the 5G AKA protocol to overcome all the currently identified weaknesses in the protocol. In the new protocol, we replace the sequence numbers with random numbers, making it possible to drastically reduce the number of required communication phases and steps in the protocol. The usage of random numbers for the 5G AKA protocol is possible since the current Universal Subscriber Identity Modules (USIMs) are now capable of performing randomized asymmetric encryption operations. Moreover, the proposed protocol provides two additional security features, i.e., post-compromise security and forward security, not present in the current 5G AKA protocol. Finally, we evaluate the performance, both computation and communication efficiency, of the proposed AKA protocol and show its improvements compared to the current 5G AKA protocol.

An Enhanced Three-Factor Authentication Scheme With Dynamic Verification for Medical Multimedia Information Systems

The medical multimedia information system (MMIS), which integrates all available multimedia sources (such as videos of endoscopes, CT scans) to support diagnosis, inspection, surgery, and reporting, has greatly facilitated users (including patients and healthcare providers). What's more, MMIS enables patients to obtain diagnostic information at home and eliminates geographical restrictions between patients and hospitals. However, a large amount of sensitive medical multimedia information in MMIS, such as surgical video, may be leaked during the transmission on the public channel. Therefore, authentication and key agreement (AKA) protocols are urgently needed to provide protection for MMIS. Specifically, authentication can prevent illegal users from accessing the MMIS, while key agreement can derive session keys to protect the sensitive data in transit from eavesdropping and interception. Recently, Zhang et al. presented a dynamic three-factor AKA scheme for privacy protection in the healthcare system which provides user untraceability by dynamic identity. However, we find that Zhang et al.'s scheme cannot withstand offline password guessing attacks and denial of service attacks. Besides, their scheme does not provide password and biometric change phase. To address these shortcomings, an enhanced scheme using Rabin cryptosystem and fuzzy verifier is proposed for MMIS. The analysis of both security and performance demonstrates that the enhanced AKA scheme is better than previous schemes proposed for MMIS.

PSEH: A provably secure and efficient handover AKA protocol in LTE/LTE-A network

In order to accomplish the increasing security demands of handover-based applications such as mobile multimedia services and transportation system, various handover Authentication and Key Agreement (AKA) protocols were proposed by the researchers in Long Term Evolution-Advanced (LTE-A) network. However, these AKA protocols fail to preserve the privacy of communication entities and suffer from numerous attacks. In addition, these protocols incur high network overhead which doesn’t suit for the resource-constrained mobile devices in LTE/LTE-A network. Also, the protocols can’t establish the key forward/backward secrecy (KFS/KBS) and overcome the key escrow problem. To avoid the above-mentioned security issues, we propose the provably secure and efficient handover (PSEH)-AKA protocol based on double-trapdoor chameleon hash function. The PSEH-AKA protocol is proven secure under random oracle model to obtain the mutual authentication, session key secrecy, integrity and resistance from malicious attacks. The proposed handover protocol accommodates all the security demands such as KFS/KBS, privacy-preservation and establishes the secure session key between the communication entities. Furthermore, the formal verification using Automated Validation of Internet Security Protocols and Applications (AVISPA) tool shows the correctness and informal analysis shows the security properties of the protocol. The performance evaluation of the PSEH-AKA protocol is carried out with existing handover AKA protocols in terms of storage, communication, and computation overhead. The evaluation results show that the protocol achieves substantial efficiency and secure against the identified attacks.

Cryptanalysis of the Anonymous Authentication with Key Agreement Scheme in Wireless Sensor Networks

User authentication and key agreement are important secure services required for wireless sensornetworks (WSNs). For this purpose, there have been a large number of proposed authentication andkey agreement scheme for WSNs. Recently in 2017, Jung et al. proposed an efficient and security enhancedanonymous authentication with key agreement scheme by employing biometrics informationas the third authentication factor. They claimed that their scheme resists on various security attacksand satisfies basic security requirements. However, in this paper, we reveal security weaknesses ofJung et al.’s scheme (i.e., insecurity of the secret key of gateway node, session key compromise,user tracking attack, information leakage attack, and user impersonation attack). We present simplecountermeasures against the security weaknesses we have found.

CDAKA: A Provably-Secure Heterogeneous Cross-Domain Authenticated Key Agreement Protocol with Symptoms-Matching in TMIS.

Telecare Medical Information System (TMIS) provides the flexible and convenient e-health care. It helps the patients to gain health monitoring information and provides patients to share their experience wirelessly. Traditional authentication and key agreement (AKA) protocols in TMIS are mostly considered in same-domain environment. However, future generation network may integrate various of wireless mesh networks under various domain. What's more, patients heterogeneous cross-domain service has become an inevitable trend. However, there is still no heterogeneous cross-domain authenticated protocol between PKI-domain and IBC-domain in TMIS. In this paper, we propose a heterogeneous cross-domain AKA protocol with symptoms-matching in TMIS (short for CDAKA). It not only keeps good security features, but also truly provides patients' anonymity to protect sensitive information from illegal interception. It still provides patients in two different domains to share their experience, broaden their understanding of illness by using their mobile device freely. Besides, it can realize AKA with extremely low computing cost and communication cost. What's more, it is proved to be secure against known possible attacks under the Elliptic Curve Computable Diffie-Hellman problem (ECDHP) assumption in the random oracle model. Hence, these features make CDAKA protocol very suitable for mobile application scenarios, where resource is severely constrained and security is particularly concerned.

ELAKA: Energy-Efficient and Lightweight Multi-Server Authentication and Key Agreement Protocol Based on Dynamic Biometrics

Authentication and key agreement (AKA) provides flexible and convenient sercices. Most traditional AKA protocols are designed to apply in single-server environment, where a user has to register at different servers to access different types of network services and the user have to remember or manage a large number of usernames and passwords. Later, multi-server AKA protocols resolve the repeated registration problem of single-server AKA protocols, where a user can access different servers to get different services using a single registration and the same username and password. Recently, in 2015, Lu et al proposed a light-weight ID based authentication and key agreement protocol for multi-server architecture, referred to as LAKA protocol. They claimed their protocol can overcome all shortcomings which existed in Xue et al’s protocol. Unfortunately, our further research shows that LAKA protocol still suffers from server spoofing attack, stolen smart card attack etc. To overcome the weakness of LAKA protocol, an energy-efficient and lightweight authentication and key agreement protocol for multi-server architecture is proposed (abbreviated to ELAKA). The ELAKA protocol not only provides the security features declared by LAKA protocol, but also has some other advantages. First, the ELAKA protocol can realize authentication and key agreement just by three handshakes with extremely low communication cost and computation cost between users and servers, which can achieve a delicate balance of security and performance. Second, ELAKA protocol can enable the user enjoy the remote services with privacy protection. Finally the ELAKA protocol is proved secure against known possible attacks by using BAN logic. As a result, these features make ELAKA protocol is very suitable for computation-limited mobile devices (such as smartphone, PAD, tablets) in comparison to other related existing protocols.

Trusted Authority Assisted Three‐Factor Authentication and Key Agreement Protocol for the Implantable Medical System

The application of implantable medical devices (IMDs), which solves the problems of geographical distance limitation and real‐time health monitoring that plague patients and doctors, has caused great repercussions in the medical community. Despite the great potential of wide application, it also brings some security and privacy issues, such as the leakage of health data and unauthorized access to IMDs. Although a number of authentication and key agreement (AKA) schemes have been developed, we find that some subtle attacks still remain to be addressed. Then we propose an improved AKA scheme which achieves strong security features including user anonymity and known key security. It is formally proved to be secure under the Real‐or‐Random model. Moreover, a comprehensive security analysis shows that our scheme can resist various attacks and satisfy the desired requirements. Finally, the performance analysis shows the superiority of our protocol which is suitable for the implantable medical system.

SEGB: Security Enhanced Group Based AKA Protocol for M2M Communication in an IoT Enabled LTE/LTE-A Network

Nowadays machine to machine (M2M) communication and its applications are growing tremendously around the globe as millions of devices are communicating with each other in an Internet of Things (IoT)-enabled long term evolution (LTE)/LTE-advanced (LTE-A) network. These applications are effective and secure only after the successful verification of machine type communication devices (MTCDs). Hence, various group-based authentication and key agreement (AKA) protocols were proposed in the literature to achieve the authentication. These protocols fulfill all the security requirements such as privacy preservation, mutual authentication, integrity, and confidentiality. But, none of them have the credential to overcome the single key problem in the communication network. In addition, they do not have the efficacy to maintain the group key unlink-ability and are susceptible to the identified attacks. In some of the protocols, each MTCD needs to authenticate independently to simultaneously access the communication network that generates network congestion overhead. In view of these problems, we propose the security enhanced groupbased (SEGB) AKA protocol for M2M communication in an IoT-enabled LTE/LTE-A network. The SEGBAKA protocol solves the problem of the single key during the authentication process and achieves the key forward/backward secrecy. The protocol overcomes the problem of signaling congestion and high bandwidth consumption. The formal security analysis of the protocol is carried out by the automated Internet security protocols and applications tool. The security analysis shows that the protocol achieves the security goals and is free from various known attacks. Moreover, the performance of the proposed SEGB-AKA protocol is analyzed with the existing group-based AKA protocols. The analysis shows that the protocol has better results in terms of network overheads and fulfills all the security requirements of M2M communication.

DGBES: Dynamic Group Based Efficient and Secure Authentication and Key Agreement Protocol for MTC in LTE/LTE-A Networks

The machine to machine communication (MTC) has grown into one of the fastest expansion in the area of Information and Communication Technology and is one of the important aspect of the Internet of Things. It allows millions of devices to connect with each other over the internet. MTC has a huge market and massive strength to obtain numerous application scenarios. The applications of MTC are reliable and effective only after a successful authentication of MTC devices. Hence, there are several group based authentication and key agreement (AKA) protocols were proposed by researchers. Whenever a number of MTC devices simultaneously generate the access request to the LTE/LTE-A network, each MTC device needs a separate authentication process to access the core network that leads to genuine signaling congestion problem. In addition, the existing group based AKA protocols did not equip with the group management scheme efficiently and also vulnerable to various known attacks. To avoid the aforesaid problems and mitigate the authentication complexity of the earlier schemes, we propose a dynamic group based efficient and secure (DGBES-AKA) protocol for MTC in LTE/LTE-A network. The proposed protocol consists the group key update scheme with key forward and backward secrecy. The formal verification using ProVerif and security analysis of the proposed protocol represent the security against malicious attacks. Finally, we show the qualitative and quantitative analysis of the DGBES-AKA protocol with the existing protocols. The analysis shows that the proposed protocol has improved results in terms of communication and computation overhead.

Hierarchical Group Based Mutual Authentication and Key Agreement for Machine Type Communication in LTE and Future 5G Networks

In view of the exponential growth in the volume of wireless data communication among heterogeneous devices ranging from smart phones to tiny sensors across a wide range of applications, 3GPP LTE-A has standardized Machine Type Communication (MTC) which allows communication between entities without any human intervention. The future 5G cellular networks also envisage massive deployment of MTC Devices (MTCDs) which will increase the total number of connected devices hundredfold. This poses a huge challenge to the traditional cellular system processes, especially the traditional Mutual Authentication and Key Agreement (AKA) mechanism currently used in LTE systems, as the signaling load caused by the increasingly large number of devices may have an adverse effect on the regular Human to Human (H2H) traffic. A solution in the literature has been the use of group based architecture which, while addressing the authentication traffic, has their share of issues. This paper introduces Hierarchical Group based Mutual Authentication and Key Agreement (HGMAKA) protocol to address those issues and also enables the small cell heterogeneous architecture in line with 5G networks to support MTC services. The aggregate Message Authentication Code based approach has been shown to be lightweight and significantly efficient in terms of resource usage compared to the existing protocols, while being robust to authentication message failures, and scalable to heterogeneous network architectures.

A privacy preserving biometric-based three-factor remote user authenticated key agreement scheme

Advancement in Internet of Things (IOT) and remote user communication is facilitated, where a user need not be physically present. However, security and privacy challenges arrive as client–server communication is done via public network. To lower down the security and privacy threats, authentication and key agreement (AKA) protocols are being designed and analyzed. AKA protocols' goal is to ensure authorized and secure access of recourses. Recently, Li et al. proposed a biometric based three-factor remote user authentication scheme for client–server environment. Their scheme uses biometric identifier to resist guessing attacks. In this article, we discussed the security of Li et al.'s scheme, and show its vulnerability to known session specific temporary information attack. Additionally, it does not provide three-factor authentication and user's privacy. It also has some flows in authentication phase. We proposed a novel AKA protocol, which can overcome the weaknesses of Li et al.'s scheme without losing its original merits. Through the analysis, we show that our scheme is secure against various known attacks including the attacks found in Li et al.'s scheme. Furthermore, we demonstrate the validity of the proposed scheme using the BAN (Burrows, Abadi, and Needham) logic. Our scheme is also comparable in terms of computation overheads with Li et al.'s scheme and other related schemes.

An Energy Efficient Mutual Authentication and Key Agreement Scheme Preserving Anonymity for Wireless Sensor Networks.

WSNs (Wireless sensor networks) are nowadays viewed as a vital portion of the IoTs (Internet of Things). Security is a significant issue in WSNs, especially in resource-constrained environments. AKA (Authentication and key agreement) enhances the security of WSNs against adversaries attempting to get sensitive sensor data. Various AKA schemes have been developed for verifying the legitimate users of a WSN. Firstly, we scrutinize Amin-Biswas’s currently scheme and demonstrate the major security loopholes in their works. Next, we propose a lightweight AKA scheme, using symmetric key cryptography based on smart card, which is resilient against all well known security attacks. Furthermore, we prove the scheme accomplishes mutual handshake and session key agreement property securely between the participates involved under BAN (Burrows, Abadi and Needham) logic. Moreover, formal security analysis and simulations are also conducted using AVISPA(Automated Validation of Internet Security Protocols and Applications) to show that our scheme is secure against active and passive attacks. Additionally, performance analysis shows that our proposed scheme is secure and efficient to apply for resource-constrained WSNs.

Security Enhancement for LTE Authentication Protocol (EPS-AKA)

In Long Term Evolution (LTE) networks Extensible Authentication Protocol (EAP) is an authentication framework, not a specific authentication mechanism. EAP-AKA is one of the methods of EAP which uses the Authentication and Key Agreement (AKA) mechanism based on challenge-response mechanisms, EAP-AKA is used in the 3rd generation mobile networks then modified and inherited to 4th generation mobile networks (LTE) as Evolved Packet System Authentication and Key Agreement (EPS-AKA) mechanism. EPS-AKA vulnerabilities are disclosure of the user identity, Man in the Middle attack and Denial of Services (DoS) attacks so a robust authentication mechanism must replace EPS-AKA to avoid such attacks. In this paper, Modified Evolved Packet System Authentication and Key Agreement (MEPS-AKA) protocol based on Simple Password Exponential Key Exchange (SPEKE) is proposed to solve these problems. Scyther tool is used to verify the efficiency of the proposed protocol against the mentioned attacks. EPS-AKA and MEPS-AKA are simulated using C programming language to calculate the execution time for both algorithms.