Authentication Key Agreement Research Articles

An Integrated Two-Stage Medical Pre-Checkup and Subsequent Validation Key Agreement Authentication Mechanism

In the global village era, several competitions require pre-checkups for the participants who are qualified to participate that must be passed before the competition, so the accuracy of the checkup data must be confirmed and must not be leaked or tampered with. This is a new challenge to the accuracy of medical checkups data in the information and communication era. How to protect the rights of participants and the non-repudiation of participants are the main issues of this study. We have designed a two-phase user identity embedding and authentication scheme for pre-checkups and subsequent validations. A participant’s private key is added to the physical examination data, and the identity of the examinations data is confirmed by the contestant before the competitions. Our work integrates lightweight Exclusive-OR (XOR) operations, fuzzy extractor biometric personal passwords, and a fixed-length hash operation accords with post-quantum operations to solve the problem of two-stage medical pre-checkup and subsequent validation key agreement authentication. The random oracle authentication mechanism proves the security of the protocols, and the security analysis proves that the protocols can resist the vulnerability attacks.

A Robust IoT-Based Three-Factor Authentication Scheme for Cloud Computing Resistant to Session Key Exposure

With the development of Internet of Things (IoT) technologies, Internet-enabled devices have been widely used in our daily lives. As a new service paradigm, cloud computing aims at solving the resource-constrained problem of Internet-enabled devices. It is playing an increasingly important role in resource sharing. Due to the complexity and openness of wireless networks, the authentication protocol is crucial for secure communication and user privacy protection. In this paper, we discuss the limitations of a recently introduced IoT-based authentication scheme for cloud computing. Furthermore, we present an enhanced three-factor authentication scheme using chaotic maps. The session key is established based on Chebyshev chaotic-based Diffie–Hellman key exchange. In addition, the session key involves a long-term secret. It ensures that our scheme is secure against all the possible session key exposure attacks. Besides, our scheme can effectively update user password locally. Burrows–Abadi–Needham logic proof confirms that our scheme provides mutual authentication and session key agreement. The formal analysis under random oracle model proves the semantic security of our scheme. The informal analysis shows that our scheme is immune to diverse attacks and has desired features such as three-factor secrecy. Finally, the performance comparisons demonstrate that our scheme provides optimal security features with an acceptable computation and communication overheads.

A novel authentication and key‐agreement scheme for satellite communication network

SummaryIn these days, satellite communication networks are playing a significant role in facilitating the crucial infrastructural services that include environmental monitoring, electronic surveillance, public safety, intelligence operations for law enforcement, government agencies, and the military. However, security researchers have uncovered that many protocols for these satellite communication networks have some vulnerabilities and flaws that can allow remote attackers to intercept, block, and manipulate critical communication over the network. Therefore, in this article, we introduce an efficient and simple authentication key agreement protocol for securing mobile satellite communication systems. Our proposed protocol resists against denial of service, smart‐card stolen, replay, user impersonation, and stolen verifier attack. Furthermore, our protocol provides various functionality features like perfect‐forward secrecy, mutual‐authentication, dynamic identity, and session‐key agreement. Moreover, the performance analysis of our protocol shows that the communication and computation cost of the proposed protocol is far less than the existing protocols. Hence, our proposed protocol offers simple, efficient, secure authentication, and key agreement for mobile satellite systems.

Secure communication in CloudIoT through design of a lightweight authentication and session key agreement scheme

SummaryInternet of Things (IoT) is a newly emerged paradigm where multiple embedded devices, known as things, are connected via the Internet to collect, share, and analyze data from the environment. In order to overcome the limited storage and processing capacity constraint of IoT devices, it is now possible to integrate them with cloud servers as large resource pools. Such integration, though bringing applicability of IoT in many domains, raises concerns regarding the authentication of these devices while establishing secure communications to cloud servers. Recently, Kumari et al proposed an authentication scheme based on elliptic curve cryptography (ECC) for IoT and cloud servers and claimed that it satisfies all security requirements and is secure against various attacks. In this paper, we first prove that the scheme of Kumari et al is susceptible to various attacks, including the replay attack and stolen‐verifier attack. We then propose a lightweight authentication protocol for secure communication of IoT embedded devices and cloud servers. The proposed scheme is proved to provide essential security requirements such as mutual authentication, device anonymity, and perfect forward secrecy and is robust against security attacks. We also formally verify the security of the proposed protocol using BAN logic and also the Scyther tool. We also evaluate the computation and communication costs of the proposed scheme and demonstrate that the proposed scheme incurs minimum computation and communication overhead, compared to related schemes, making it suitable for IoT environments with low processing and storage capacity.

An Improved SIP Authenticated Key Agreement Based on Dongqing et al.

The IP multimedia subsystem represents an architectural framework to support multimedia-based services using internet protocol over wired and wireless media. These IP-based multimedia services rely on session initiation protocol (SIP) for creating, maintaining and terminating the communicative sessions, which underscores the efficiency and security of SIP protocol. Many SIP based authentication schemes have been put forward in the last decade, however with many limitations. Recently, Lu et al. and Chaudhary et al. presented SIP based authentication protocols. Then, Dongqing et al. discovered limitations in Lu et al. and Chaudhary et al. schemes, and presented an improved SIP authentication protocol. Nonetheless, we ascertain that Dongqing et al.’s protocol is prone to privileged insider attack, denial of service attack, and session specific ephemeral secret-leakage attack. Besides, this protocol assumes a strictly time synchronized system, which limits the practical effectiveness of the protocol for a real environment. We also propose an improved SIP authentication protocol that covers the limitations of Dongqing et al. protocol. Our scheme is formally proved as secure using BAN logic analysis. The performance analysis illustrates the comparison for related schemes with proposed scheme, which depicts the efficiency and robustness of the scheme over previous schemes.

A provably secure and efficient authenticated key agreement scheme for Energy Internet based Vehicle-to-Grid technology framework

The energy Internet (EI)-based vehicle-to-grid (V2G) technology facilitates the electric vehicles not only to distribute additional electricity into grid systems, but also support receiving back from the power grid in the form of charging. The secure key establishment is quite significant to initiate the bidirectional electricity power delivery into and from the system. To effectively implement any EI-based V2G communication, the authentication protocol must be free from cyber attacks. In this article, we not only explore the drawbacks of several smart grid-based authentication protocols but also bring forth the limitations of a recently presented EI-based V2G scheme by Gope and Sikdar. The examined drawbacks in this protocol may disrupt its proper functioning, since it faces desynchronization problems while logging into the mobile device bearing registration parameters. The scheme is also vulnerable to replay attack and man-in-the-middle attack. The user is also unable to validate session key in the protocol. Considering these limitations, we propose a novel and efficient V2G protocol framework enabling the vehicles to communicate or recharge at desired recharging stations. The results of the proposed framework are compared with several contemporary schemes, and its security features are validated by random oracle model-based formal analysis.

BAKMP-IoMT: Design of Blockchain Enabled Authenticated Key Management Protocol for Internet of Medical Things Deployment

The Internet of Medical Things (IoMT) is a kind of connected infrastructure of smart medical devices along with software applications, health systems and services. These medical devices and applications are connected to healthcare systems through the Internet. The Wi-Fi enabled devices facilitate machine-to-machine communication and link to the cloud platforms for data storage. IoMT has the ability to make accurate diagnoses, with fewer mistakes and lower costs of care. IoMT with smartphone applications permits the patients to exchange their health related confidential and private information to the healthcare experts (i.e., doctors) for the better control of diseases, and also for tracking and preventing chronic illnesses. Due to insecure communication among the entities involved in IoMT, an attacker can tamper with the confidential and private health related information for example an attacker can not only intercept the messages, but can also modify, delete or insert malicious messages during communication. To deal this sensitive issue, we design a novel blockchain enabled authentication key agreement protocol for IoMT environment, called BAKMP-IoMT. BAKMP-IoMT provides secure key management between implantable medical devices and personal servers and between personal servers and cloud servers. The legitimate users can also access the healthcare data from the cloud servers in a secure way. The entire healthcare data is stored in a blockchain maintained by the cloud servers. A detailed formal security including the security verification of BAKMP-IoMT using the widely-accepted Automated Validation of Internet Security Protocols and Applications (AVISPA) tool is performed to demonstrate its resilience against the different types of possible attack. The comparison of BAKMP-IoMT with relevant existing schemes is conducted which identifies that the proposed system furnishes better security and functionality, and also needs low communication and computational costs as compared to other schemes. Finally, the simulation of BAKMP-IoMT is conducted to demonstrate its impact on the performance parameters.

An Improved Key Agreement Authentication Scheme Based on an Anonymous Password

An Improved Key Agreement Authentication Scheme Based on an Anonymous Password

A Lightweight Key Agreement and Authentication Scheme for Satellite-Communication Systems

Mobile satellite communication is becoming a crucial component for broadcast and broadband coverage in professional, commercial, military and emergency scenarios. Mobile devices and network control center (NCC) are the basic components of Low-Earth-Orbit (LEO) satellites which communicate with each other with the help of gateways. The communication between these components needs high security. The various existing protocols for the environment of mobile satellite communication are insecure against numerous attacks and can be easily attacked by an adversary. So, there is an indispensable requirement of a reliable protocol which can offer efficient and secure communication for mobile satellite system. Therefore, a robust key agreement authentication scheme for mobile satellite environment is proposed in this article. The proposed protocol is developed according to the major security demands in the satellite communication networks. Our protocol provides mutual-authentication, session-key agreement and correct notion of user anonymity. The performance analysis for evaluation shows that the storage, communication and computation cost of the proposed protocol is less than many of existing protocols. Moreover, our protocol offers additional security features than that are available in the existing protocols. Hence, our protocol offers a secure authentication and key agreement for mobile satellite systems.

An Efficient and Provably Secure Authenticated Key Agreement Protocol for Fog-Based Vehicular Ad-Hoc Networks

The maturity of cloud computing, the Internet of Things technology, and intelligent transportation system has promoted the rapid development of vehicular ad-hoc networks (VANETs). To keep pace with real-world demands (mobility, low latency, etc.) in a practical VANETs deployment, there have been attempts to integrate fog computing with VANETs. To facilitate secure interaction in fog-based VANETs, we design a new authenticated key agreement protocol without bilinear pairing. This protocol achieves mutual authentication, generates a securely agreed session key for secret communication, and supports privacy protection. We also give a strict formal security proof and demonstrate how the proposed protocol meets the security requirements in the fog-based VANETs. We then evaluate the efficiency of the proposed protocol, and it shows the practicality of the protocol.

Anonymous authentication key agreement scheme with pairing-based cryptography for home-based multi-sensor Internet of Things

Home-based multi-sensor Internet of Things, as a typical application of Internet of Things, interconnects a variety of intelligent sensor devices and appliances to provide intelligent services to individuals in a ubiquitous way. As families become more and more intelligent, complex, and technology-dependent, there is less and less need for human intervention. Recently, many security attacks have shown that Internet home-based Internet of Things have become a vulnerable target, leading to personal privacy problems. For example, eavesdroppers can acquire the identity of specific devices or sensors through public channels, which is not secure, to infer individual public life in the home area network. Authentication is the essential portion of many secure systems processing of verifying and declaring identity. Before providing confidential information, home-based-Internet of Things service authenticates users and devices. The communication and processing capabilities of intelligent devices are limited. Therefore, in home-based Internet of Things, lightweight authentication and key agreement technology are very important to resist known attacks. This article proposes an anonymous authenticated key agreement protocol using pairing-based cryptography. The protocol proposed in this article provides lightweight computation and ensures the security of communication between home-based multi-sensor Internet of Things network and Internet network.

Enhanced authentication and key management scheme for securing data transmission in the internet of things

The Internet of Things (IoT), with its smartness and intelligence, is gradually changing human life by allowing everyday objects to be connected to the Internet. With the prevalence of the IoT, wireless sensor networks (WSNs) are attracting worldwide attention, because they cover a wide range of IoT applications. The sensors collect data from the physical world and communicate with each other through wireless links. Ensuring the security and privacy of WSNs’ communication is challenging. Recently, a secure authentication and key management scheme was proposed to secure data transmission in WSNs. In this paper, we show that this scheme has various security flaws, such as replay attack, denial of service attack, impersonation attack, and lack of mutual authentication and session key agreement. Then, we propose an enhanced scheme to overcome the identified security weaknesses. The security of the enhanced scheme is formally verified using the Burrows–Abadi–Needham logic and the Automated Validation of Internet Security Protocols and Applications tool. Our proposed scheme is more secure, efficient, and suitable for WSN-based IoT applications than recent related methods.

PSE-AKA: Performance and security enhanced authentication key agreement protocol for IoT enabled LTE/LTE-A networks

In the mobile telecommunication network, Long term Evolution (LTE) is the most successful technological development for the industrial services and applications. The Evolved Packet System based Authentication and Key Agreement (EPS-AKA) was the first protocol proposed to authenticate the communication entities in the LTE network. But, the EPS-AKA protocol suffers from the single key exposure problem and is susceptible to various security attacks. Also, the protocol incurs high bandwidth consumption and computation overhead over the communication network. Moreover, the protocol doesn’t support the Internet of Things (IoT) based applications and has several security issues such as the privacy violation of the user identity and key set identifier (KSI). To resolve the above problems, various AKA protocols were proposed by the researchers. Unfortunately, none of the protocols succeeded to overcome the privacy preservation and single key exposure problem from the communication network. In this paper, we propose the performance and security enhanced (PSE-AKA) protocol for IoT enabled LTE/LTE-A network. The proposed protocol follows the cocktail therapy to generate the authentication vectors that improves the performance in terms of computation and communication overhead. The protocol preserves the privacy of objects, protects the KSI and avoids the identified attacks from the communication network. The formal verification and security analysis of the proposed protocol is carried out using the BAN logic and AVISPA tool respectively. The security analysis shows that the protocol achieves the security goals and secure against various known attacks. Finally, the performance analysis shows that the proposed protocol generates the less overhead and reduces the bandwidth consumption from the network.

Smart Card Based Password Authenticated Key Agreement in Distributed Systems

International Journal of Computer Sciences and Engineering (A UGC Approved and indexed with DOI, ICI and Approved, DPI Digital Library) is one of the leading and growing open access, peer-reviewed, monthly, and scientific research journal for scientists, engineers, research scholars, and academicians, which gains a foothold in Asia and opens to the world, aims to publish original, theoretical and practical advances in Computer Science,Information Technology, Engineering (Software, Mechanical, Civil, Electronics & Electrical), and all interdisciplinary streams of Computing Sciences. It intends to disseminate original, scientific, theoretical or applied research in the field of Computer Sciences and allied fields. It provides a platform for publishing results and research with a strong empirical component. It aims to bridge the significant gap between research and practice by promoting the publication of original, novel, industry-relevant research.

A Provably Secure Biometrics-Based Authentication Scheme for Multiserver Environment

With the rapid development of mobile services, multiserver authentication protocol with its high efficiency has emerged as an indispensable security mechanism for mobile services. Recently, Ali et al. introduced a biometric-based multiserver authentication scheme and claimed the scheme is resistant to various attacks. However, after a careful examination, we find that Ali et al.’s scheme is vulnerable to various security attacks, such as user impersonation attack, server impersonation attack, privileged insider attack, denial of service attack, fails to provide forward secrecy and three-factor secrecy. To overcome these weaknesses, we propose an improved biometric-based multiserver authentication scheme using elliptic curve cryptosystem. Formal security analysis under the random oracle model proves that our scheme is provably secure. Furthermore, BAN (Burrows-Abadi-Needham) logic analysis demonstrates our scheme achieves mutual authentication and session key agreement. In addition, the informal analysis proves that our scheme is secure against all current known attacks and achieves desirable features. Besides, the performance and security comparison shows that our scheme is superior to related schemes.

A provable and secure mobile user authentication scheme for mobile cloud computing services

SummaryThe mobile cloud computing (MCC) has enriched the quality of services that the clients access from remote cloud‐based servers. The growth in the number of wireless users for MCC has further augmented the requirement for a robust and efficient authenticated key agreement mechanism. Formerly, the users would access cloud services from various cloud‐based service providers and authenticate one another only after communicating with the trusted third party (TTP). This requirement for the clients to access the TTP during each mutual authentication session, in earlier schemes, contributes to the redundant latency overheads for the protocol. Recently, Tsai et al have presented a bilinear pairing based multi‐server authentication (MSA) protocol, to bypass the TTP, at least during mutual authentication. The scheme construction works fine, as far as the elimination of TTP involvement for authentication has been concerned. However, Tsai et al scheme has been found vulnerable to server spoofing attack and desynchronization attack, and lacks smart card‐based user verification, which renders the protocol inapt for practical implementation in different access networks. Hence, we have proposed an improved model designed with bilinear pairing operations, countering the identified threats as posed to Tsai scheme. Additionally, the proposed scheme is backed up by performance evaluation and formal security analysis.

Robust Privacy-Preserving Mutual Authenticated Key Agreement Scheme in Roaming Service for Global Mobility Networks

Security and privacy are desired core issues to secure communication for the roaming service in global mobility network (GLOMONET). Authentication mechanism is an essential technology to establish a shared secret key between two or more participants who wish to encrypt sensitive data. How to design an ideal authenticated key agreement (AKA) that satisfies different security requirements is a very challenging task due to a handshake between participants is performed over an open channel. Multiple papers on AKA are currently available. We review a recently GLOMONET-oriented AKA released by Gope–Hwang. We point out that their scheme has various security problems. Specifically, their AKA is vulnerable to known session-specific temporary information attack. More seriously, the password renewal phase of their scheme is wrong, thus leading to the mobile user login failed and even the server rejects service. So the paper attempts to eliminate three security loopholes troubled in Gope–Hwang's scheme. Our objective is to propose an elliptic curve cryptography (ECC) based AKA to achieve secure implementation in GLOMONET. By performing informal and formal analyses, we demonstrate that our scheme overcomes some disadvantages in Gope–Hwang's scheme while possessing more excellent security attributes.

An efficient eCK secure certificateless authenticated key agreement scheme with security against public key replacement attacks

Authenticated Key Agreement (AKA) protocol enables two communicating entities to mutually establish a session key, in such a way that each entity is assured of the authenticity of its peer. Certificateless AKA (CL-AKA) protocols are widely researched, since, it eliminates the key escrow problem in Identity based systems and the cumbersome certificate management overheads associated with the Public Key Infrastructure (PKI) model. However, AKA protocols in the Certificateless setting suffer from public key replacement attacks, since, the user public keys cannot be validated explicitly by certificates. Our investigations reveal that the existing eCK- secure CL-AKA protocols are vulnerable to basic impersonation attacks and Man-in-the-middle attacks by the Key Generation Center (KGC). Moreover, public key replacement attacks by other malicious users can prevent communicating entities from ever agreeing upon a valid session key. In order to mitigate the aforementioned vulnerabilities, we propose the first eCK secure CL-AKA scheme with security against public key replacement attacks by the KGC, as well as, the external adversaries. Contrary to the conventional CL-AKA protocols, the proposed scheme does not have a partial private key escrow at the KGC and does not require secure authenticated channels for the transmission of the partial private keys from the KGC to individual users. Furthermore, we cryptanalyze two of the most recently proposed CL-AKA protocols, to illustrate their lack of eCK security and discuss the flaws in their security proofs. Comparative analysis of the proposed scheme with other CL-AKA protocols in the literature reveals that the proposed scheme offers better efficiency and security.

Flexible and Efficient Authenticated Key Agreement Scheme for BANs Based on Physiological Features

In Body Area Networks (BANs), bio-sensors can collect personal health information and cooperate with each other to provide intelligent health care services for medical users. Since personal health information is highly privacy-sensitive, the flourish of BANs still faces critical security challenges, especially secure communication between bio-sensors. In this paper, we propose a flexible and efficient authenticated key agreement scheme (PBAKA) to provide secure communication for BANs. Specifically, we employ a control unit (e.g., smart phone) to launch authentication based on physiological features collected from BANs, and integrate bilinear pairings to negotiate session keys for bio-sensors. Since physiological features can be collected from various kinds of bio-sensors in real time, PBAKA is flexible for adding new bio-sensors without pre-distributed keys. Meanwhile, PBAKA is computationally efficient by offloading authentication burden from resource-limited bio-sensors to the control unit. Security analysis demonstrates that PBAKA is provably secure under the decisional bilinear Diffie-Hellman assumption. Extensive experimental results validate efficient communication, computation and energy consumption of our scheme when compared with several existing solutions.

An Anonymous and Efficient Multiserver Authenticated Key Agreement With Offline Registration Centre

Multiserver authentication (MSA) architecture permits its registered users to get the services of various service providers without performing separate registrations with each server. Since, a single registration from registration authority, a trusted third party, is sufficient to get mutually authenticated with service providers, onwards. In this paper, we have emphasized only on the MSA-based schemes that do not require online registration authority for mutual authentication. While, considering those MSA schemes, to date, there is no secure and efficient MSA protocol in our observation that is free of all four limitations at the same time, such as 1) free of the hassle of storage of server-based parameters in users’ smart card by registration authority, 2) free of the transmission of user-based identities to all servers in a network, 3) free of a single secret key distribution to all servers as assumed in a trusted system, and 4) free from employing costly bilinear pairing operations. In view of those shortcomings, we present an anonymous MSA protocol that nearly counters all those problems using elliptic curve cryptography and escaping costly pairing operations. Our scheme also demonstrates the scheme's robustness using formal security analysis employing random oracle model and automated tool analysis.