Authentication Scheme For Multi-server Environment Research Articles

A secure dynamic ID based remote user authentication scheme for multi-server environment using smart cards

Recently, Hsiang et al. pointed out that Liao-Wang’s dynamic ID based remote user authentication scheme for multi-server environment is vulnerable to insider attack, masquerade attack, server spoofing attack, registration center attack and is not easily reparable. Besides, Liao-Wang’s scheme cannot achieve mutual authentication. For this, Hsiang et al. proposed an improved scheme to overcome these weaknesses and claimed that their scheme is efficient, secure, and suitable for the practical application environment. However, we observe that Hsiang et al.’s scheme is still vulnerable to a masquerade attack, server spoofing attack, and is not easily reparable. Furthermore, it cannot provide mutual authentication. Therefore, in this paper we propose an improved scheme to solve these weaknesses.

Improvement on A Password Authentication Scheme for Multi-server Environments

Since each user needs to have different passwords with different remote servers in the multi-server environment, it is impossible to apply the authentication methods in a single server environment to the multi-server environment. Recently, Ren-Chiun Wang, Wen-Shenq Juang, and Chin-Laung Lei proposed an ID based remote user authentication scheme for multi-server environments. However, we demonstrate that their ID based authentication scheme lacks the authenticity of the Registration Center to the server. Moreover, their ID based authentication scheme does not satisfy perfect forward security. In this paper, an improved multi-server password based smart card authentication scheme is proposed. Our scheme can remove their security flaws. Compared with the previous password based smart card authentication schemes for the multi-server environments, our proposed scheme can hold more security advantages.

Efficient and Secure Dynamic ID-Based Remote User Authentication Scheme with Session Key Agreement for Multi-Server Environment

In 2007, Liao-Wang proposed a dynamic ID-based remote user authentication scheme for multi-server environment using smart cards. However, Hsiang-Shih demonstrated that Liao-Wang’s scheme has security flaws. Moreover, Hsiang-Shih proposed an improvement scheme which resolves the security flaws of Liao-Wang scheme. In this paper, we propose an enhanced remote user authentication scheme which maintains the merits of Hsiang-Shih’s scheme. Performance evaluation demonstrated the efficiency of the proposed scheme over related works. Security analysis proved that the proposed scheme is secure against known attacks.

Weaknesses of a Secure Dynamic ID Based Remote User Authentication Scheme

In 2009, Liao and Wang proposed a secure dynamic ID based remote user authentication scheme for multi-server environments. They achieved user anonymity by using secure dynamic IDs instead of static IDs. Recently, Hsiang and Shih proposed an improved scheme to fix the security flaws found in Liao-Wang’s scheme. Hsiang and Shih claimed that their scheme maintains the benefits and increases the security of Liao-Wang’s scheme, while providing mutual authentication that Liao-Wang’s scheme lacks. In this paper, however, it is shown that Hsiang-Shih’s scheme cannot withstand user and server impersonation attacks. Their scheme is thus vulnerable to malicious users and insecure for practical applications.

Improvement of the secure dynamic ID based remote user authentication scheme for multi-server environment

Recently, Liao and Wang proposed a secure dynamic ID based remote user authentication scheme for multi-server environment, and claimed that their scheme was intended to provide mutual authentication, two-factor security, replay attack, server spoofing attack, insider and stolen verifier attack, forward secrecy and user anonymity. In this paper, we show that Liao and Wang's scheme is still vulnerable to insider's attack, masquerade attack, server spoofing attack, registration center spoofing attack and is not reparable. Furthermore, it fails to provide mutual authentication. To remedy these flaws, this paper proposes an efficient improvement over Liao–Wang's scheme with more security. The computation cost, security, and efficiency of the improved scheme are well suited to the practical applications environment.

A secure dynamic ID based remote user authentication scheme for multi-server environment

Since the number of server providing the facilities for the user is usually more than one, the authentication protocols for multi-server environment are required for practical applications. Most of password authentication schemes for multi-server environment are based on static ID, so the adversary can use this information to trace and identify the user's requests. It is unfavorable to be applied to special applications, such as e-commerce. In this paper, we develop a secure dynamic ID based remote user authentication scheme to achieve user's anonymity. The proposed scheme only uses hashing functions to implement a robust authentication scheme for the multi-server environment. It provides a secure method to update password without the help of third trusted party. The proposed scheme does not only satisfy all requirements for multi-server environment but also achieve efficient computation. Besides, our scheme provides complete functionality to suit with the real applications.

A simple password authentication using a polynomial

Traditional remote password authentication schemes allow a user to submit his identity and its corresponding password. Then, through a specific algorithm, the server authenticates its users alone. Because these schemes are independent and each scheme develops a specific algorithm by itself, the development cost and computing cost are very high. To avoid the rise in costs, we present a simple password authentication scheme for multi-server environments. The scheme can generate a public polynomial that contains a specific Access Right (<i>AR</i>). The <i>AR</i> means the legal users have different level of authorization based on which server in the multi-server environment in used. Furthermore, the scheme can verify the authorization without a password table. The scheme can authorize many servers at one time so that the users who have registered with various servers do not need to remember different login passwords for each. The scheme also allows users to choose their passwords freely and update it off-line.

A remote password authentication scheme for multiserver architecture using neural networks

Conventional remote password authentication schemes allow a serviceable server to authenticate the legitimacy of a remote login user. However, these schemes are not used for multiserver architecture environments. We present a remote password authentication scheme for multiserver environments. The password authentication system is a pattern classification system based on an artificial neural network. In this scheme, the users only remember user identity and password numbers to log in to various servers. Users can freely choose their password. Furthermore, the system is not required to maintain a verification table and can withstand the replay attack.