Authentication Flaw Research Articles

A Full Lifecycle Authentication Scheme for Large-scale Smart IoT Applications

The rapid development of IoT (Internet of Things) brings great convenience to people through the utilization of IoT applications, but also brings huge security challenges. Existing IoT security breaches show that many IoT devices have authentication flaws. Although many IoT authentication schemes were proposed, they are not applicable to recent smart IoT applications covering IoT device, back-end sever, and user-end mobile applications. To build the first line of defense for trending IoT systems, this paper proposes a new authentication scheme. The proposed scheme first models the entire life cycle of the IoT device for real-world scenarios of smart IoT systems, which contains factory manufacturing, daily usage, and system resetting. For each stage in the life cycle, the proposed scheme employs efficient symmetric key mechanisms to achieve the authentication between IoT device, back-end server, and mobile application. The proposed scheme supports both server-free local area network communication and sever-involved remote public area communication. Formal security verification shows that the proposed scheme resists existing attacks. The open-source experimental evaluations also show that the proposed scheme is efficient and promising for practical usage.

Orchestration or Automation: Authentication Flaw Detection in Android Apps

Passwords are pervasively used to authenticate users’ identities in mobile apps. To secure passwords against attacks, protection is applied to the password authentication protocol (PAP). The implementation of the protection scheme becomes an important factor in protecting PAP against attacks. We focus on two basic protection in Android, i.e., SSL/TLS-based PAP and timestamp-based PAP. Previously, we proposed an automated tool, <small>GLACIATE</small> , to detect authentication flaws. We were curious whether orchestration (i.e., involving manual-effort) works better than automation. To answer this question, we propose an orchestrated approach, <small>AuthExploit</small> and compare its effectiveness <small>GLACIATE</small> . We study requirements for correct implementation of PAP and then apply <small>GLACIATE</small> to identify protection enhancements automatically. Through dependency analysis, <small>GLACIATE</small> matches the implementations against the abstracted flaws to recognise defective apps. To evaluate <small>AuthExploit</small> , we collected 1,200 Android apps from Google Play. We compared <small>AuthExploit</small> with the automation tool, <small>GLACIATE</small> , and two other orchestration tools, <inline-formula><tex-math notation="LaTeX">${\sf MalloDroid}$</tex-math></inline-formula> and <inline-formula><tex-math notation="LaTeX">${\sf SMV-Hunter}$</tex-math></inline-formula> . The results demonstrated that orchestration tools detect flaws more precisely although the F1 score of <small>GLACIATE</small> is higher than <small>AuthExploit</small> . Further analysis of the results reveals that highly popular apps and e-commerce apps are not more secure than other apps.

SATMC: a SAT-based model checker for security protocols, business processes, and security APIs

We present SATMC 3.0, a SAT-based bounded model checker for security-critical systems that stems from a successful combination of encoding techniques originally developed for planning with techniques developed for the analysis of reactive systems. SATMC has been successfully applied in a variety of application domains (security protocols, security-sensitive business processes, and cryptographic APIs) and for different purposes (design-time security analysis and security testing). SATMC strikes a balance between general purpose model checkers and security protocol analyzers as witnessed by a number of important success stories including the discovery of a serious man-in-the-middle attack on the SAML-based single sign-on (SSO) for Google Apps, an authentication flaw in the SAML 2.0 Web Browser SSO Profile, and a number of attacks on PKCS#11 Security Tokens. SATMC is integrated and used as back-end in a number of research prototypes (e.g., the AVISPA Tool, Tookan, the SPaCIoS Tool) and industrial-strength tools (e.g., the Security Validator plugin for SAP NetWeaver BPM).

Off-line dictionary attack on password-based authenticated key exchange protocols

In 2010, Lee et al proposed two simple and efficient three-party password-authenticated key exchange protocols that had been proven secure in the random oracle model. They argued that the two protocols could resist offline dictionary attacks. Indeed, the provable approach did not provide protection against off-line dictionary attacks. This paper shows that the two protocols are vulnerable to off-line dictionary attacks in the presence of an inside attacker because of an authentication flaw. This study conducts a detailed analysis on the flaw in the protocols and also shows how to eliminate the security flaw.

An authentication flaw in browser-based Single Sign-On protocols: Impact and remediations

Browser-based Single Sign-On (SSO) protocols relieve the user from the burden of dealing with multiple credentials thereby improving the user experience and the security. In this paper we show that extreme care is required for specifying and implementing the prototypical browser-based SSO use case. We show that the main emerging SSO protocols, namely SAML SSO and OpenID, suffer from an authentication flaw that allows a malicious service provider to hijack a client authentication attempt or force the latter to access a resource without its consent or intention. This may have serious consequences, as evidenced by a Cross-Site Scripting attack that we have identified in the SAML-based SSO for Google Apps and in the SSO available in Novell Access Manager v.3.1. For instance, the attack allowed a malicious web server to impersonate a user on any Google application. We also describe solutions that can be used to mitigate and even solve the problem.

Cryptanalysis of two three-party encrypted key exchange protocols

Due to the simplicity of maintaining human memorable passwords without any assistant storage device, password-based three-party encrypted key exchange (3PEKE) protocol has become one of the most promising research fields on user authentication and secure communication. In 2008, Chen et al. and Yoon and Yoo both pointed that Chang and Chang's password-based 3PEKE scheme cannot resist against undetectable on-line password guessing attacks, and then respectively proposed an improved protocol to eliminate the security vulnerability. However, based on the security analyses conducted by us, we find that both of their protocols are still vulnerable against undetectable on-line password guessing attacks. Accordingly, we develop a novel 3PEKE protocol to remedy these authentication flaws. Moreover, our proposed protocol can achieve better performance efficiency by requiring only four message transmission rounds. In conclusion, we can claim that our proposed 3PEKE protocol is more secure and efficient in comparison with the protocols proposed by Chen et al. and Yoon and Yoo.

Cryptanalysis of simple three-party key exchange protocol

Recently, Lu and Cao published a novel protocol for password-based authenticated key exchanges (PAKE) in a three-party setting in Journal of Computers and Security, where two clients, each shares a human-memorable password with a trusted server, can construct a secure session key. They argued that their simple three-party PAKE (3-PAKE) protocol can resist against various known attacks. In this paper, we show that this protocol is vulnerable to a kind of man-in-the-middle attack that exploits an authentication flaw in their protocol and is subject to the undetectable on-line dictionary attack. We also conduct a detailed analysis on the flaws in the protocol and provide an improved protocol.

Static validation of security protocols

We methodically expand protocol narrations into terms of a process algebra in order to specify some of the checks that need to be made in protocol. We then apply static analysis technology to develop an automatic validation procedure for protocols. Finally, we demonstrate that these techniques suffice to identify several authentication flaws in symmetric and asymmetric key protocols such as Needham-Schroeder symmetric key, Otway-Rees, Yahalom, Andrew Secure RPC, Needham-Schroeder asymmetric key. and Beller-Chang-Yacobi MSR.

Improvement of Fan et al.’s deniable authentication protocol based on Diffie–Hellman algorithm

Recently, an efficient and non-interactive deniable authentication protocol based on the Diffie–Hellman key distribution protocol is presented by Fan et al. to enable a receiver to identify the source of a given message, but not prove the identity of the sender to a third party. In this paper, we point out that it suffers from an authentication flaw similar to that developed by Lowe to Intruder masquerades as other principals and inquisitor INQ can identify the source of the message unlike their claims. Accordingly, we propose an improved protocol to overcome the weaknesses.