Dynamic ID-based Remote User Authentication Research Articles

An efficient dynamic ID-based remote user authentication scheme using self-certified public keys for multi-server environments.

Recently, Li et al. proposed a novel smart card and dynamic ID-based remote user authentication scheme for multi-server environments. They claimed that their scheme can resist several types of attacks. However, through careful analysis, we find that Li et al.’s scheme is vulnerable to stolen smart card and off-line dictionary attacks, replay attacks, impersonation attacks and server spoofing attacks. By analyzing other similar schemes, we find that a certain type of dynamic ID-based multi-server authentication scheme in which only hash functions are used and whereby no registration center participates in the authentication and session key agreement phase faces difficulties in providing perfectly efficient and secure authentication. To compensate for these shortcomings, we propose a novel dynamic ID-based remote user authentication scheme for multi-server environments based on pairing and self-certified public keys. Security and performance analyses show that the proposed scheme is secure against various attacks and has many excellent features.

Security Analysis of Improved User Authentication Schemes Using Smart Cards

Smart card based remote user authentication is a broadly adopted method of authentication within insecure communication channels. Recently, Wen and Li proposed a dynamic ID-based remote user authentication protocol with key agreement. Unfortunately, Kim, Nam and Won pointed out that Wen and Li’s authentication protocol suffers from leakage of some key information to an adversary and a man-in-the-middle attack. Kim et al. proposed an improved ID-based remote user authentication scheme. In this work, we revisit Kim et al.’s protocol. Our results indicate that their scheme is vulnerable to smart card loss attack, stolen verifier attack and privileged insider attack. Furthermore, the authentication protocol cannot provide perfect forward secrecy and user anonymity. These weaknesses also exist in Wen and Li’s authentication scheme.

Esquema de autenticación de usuario remoto basado en un identificador dinamico utilizando el sistema de cifrado ElGamal

We propose a new dynamic ID-based remote user authentication scheme using smart cards, which it is based on one-way hash function, ElGamal’s public key cryptosystem and nonce. The scheme achieves the following security requirements: 1) users can choose and change their password freely, 2) mutual authentication between the user and the server, 3) the user and the server establish a session key after successful authentication process, 4) the server does not maintain a verification table, 5) the login request message does not contain the user’s identity, and 6) the authentication phase does not require time-synchronization, making it more secure than previous schemes. In order to verify the security characteristics of our protocol, we have modelled and analysed the proposal using High-level Protocol Specification Language (HLPSL) and Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. The results demonstrate that our protocol achieves more security requirements than previous works.

An enhanced dynamic ID-based authentication scheme for telecare medical information systems

The authentication schemes for telecare medical information systems (TMIS) try to ensure secure and authorized access. ID-based authentication schemes address secure communication, but privacy is not properly addressed. In recent times, dynamic ID-based remote user authentication schemes for TMIS have been presented to protect user’s privacy. The dynamic ID-based authentication schemes efficiently protect the user’s privacy. Unfortunately, most of the existing dynamic ID-based authentication schemes for TMIS ignore the input verifying condition. This makes login and password change phases inefficient. Inefficiency of the password change phase may lead to denial of service attack in the case of incorrect input in the password change phase. To overcome these weaknesses, we proposed a new dynamic ID-based authentication scheme using a smart card. The proposed scheme can quickly detect incorrect inputs which makes the login and password change phase efficient. We adopt the approach with the aim to protect privacy, and efficient login and password change phases. The proposed scheme also resists off-line password guessing attack and denial of service attack. We also demonstrate the validity of the proposed scheme by utilizing the widely-accepted BAN (Burrows, Abadi, and Needham) logic. In addition, our scheme is comparable in terms of the communication and computational overheads with relevant schemes for TMIS.

Secure and Efficient Smart-Card-Based Remote User Authentication Scheme for Multiserver Environment

The growth of the Internet and telecommunication technology has facilitated remote access. During the last decade, many secure dynamic identity (ID)-based remote user authentication schemes have been proposed for the multiserver environment using smart cards. Recently, Li et al. point that the Lee et al. scheme is vulnerable to forgery attack, server spoofing attack, improper authentication, and unfriendly and inefficient password change. To overcome these security weaknesses, Li et al. propose a novel smart-card- and dynamic ID-based remote user authentication scheme for multiserver environments. In this paper, we show that the Li et al. scheme is also vulnerable to offline password guessing attack, stolen smart-card attack, forgery attack, and poor reparability. Their scheme does not also provide two-factor security. To provide a secure remote user authentication scheme for the multiserver environment and to overcome the security weaknesses, we propose an enhanced scheme. Our scheme is aimed at logically securing the data stored in the smart card and improving the dynamic property of the ID using password randomization for each session. Our scheme resists forgery attack, replay attack, stolen smart-card attack, offline password guessing attack, and spoofing attack. Our scheme's efficiency has been established analytically and confirmed through simulation.

An Efficient Dynamic ID-based User Authentication Scheme using Smart Cards without Verifier Tables

Smart-card based user authentication schemes provide that legal users conveniently and securely access remote services with smart cards through unsecure networks. Lee recently showed that the dynamic ID-based remote user authentication scheme proposed by Das et al. cannot resist password guessing attacks and impersonation attacks. In order to solve these weaknesses, Lee also presented an improved authentication scheme and claimed that the proposed scheme can resist modification, password guessing, imper sonation and smart-card-theft attacks. However, this investigation in dicates that the authentication scheme of Lee cannot resist the above attacks and violates users' untracibility. Additionally, this invest igation also develops an efficient and secure dynamic ID-bas ed user authentication scheme based on the quadratic residues. The proposed scheme not only avoids the weakness in the previous schemes, but also does not require verifier tables in the authentication server and sti ll retains low computational cost in clients.

An Improved Bilateral Remote User Authentication Scheme that Preserves User Anonymity using Symmetric Cryptology

In recent 2012, Wen and Li.'s has presented a dynamic ID-based remote user authentication with key agreement scheme. They claimed that their scheme can resisted insider attack and provide anonymity for the users. However, Juan Qu and Li-min Zou., described that Wen and Li.'s scheme could not withstand insider attack, does not provide anonymity for the users, and inefficiency for error password login. A different approach to symmetric cryptology is taken in this study to resolve the fore was made Compared to Juan Qu and Li-min Zou scheme, a different approach was made with symmetric cryptology in this study to supplement the forementioned weak points. We propose an enhanced authentication scheme, which covers all the identified weakness of Wen and Li.'s scheme and an efficient user authentication scheme that preserve perfect anonymity to both the outsider and remote server.

Attacks on Young-Hwa An’s Improved Dynamic ID-Based Remote User Authentication Scheme

In 2011, Khan et al. analyzed and improved an enhanced secure dynamic ID-based remote user authentication scheme to overcome the weakness of Wang et al.’s scheme. In 2013, Young-Hwa An showed that Khan et al.’s scheme is not secure because Khan et al.’s scheme can not resist password guessing attack, forgery attack and does not provide user anonymity. After that he proposed a security improvement of dynamic ID-based remote user authentication scheme with session key agreement to remedy the weakness in Khan et al.’s scheme. Recently, through our study, we have found that Young-Hwa An’s mechanism is not secure enough. There still exists insider user’s attack, anonymity attack and forgery attack.

Efficient and secure dynamic ID‐based remote user authentication scheme for distributed systems using smart cards

In a distributed environment, a fundamental concern is authentication of local and remote users in insecure communication networks. Absolutely, legitimate users are more powerful attackers, since they possess internal system information not available to an intruder. Therefore many remote user authentication schemes for distributed systems have been proposed. These schemes claimed that they could resist various attacks. However, they were found to have some weaknesses later. Lee et al . proposed a secure dynamic ID-based remote user authentication scheme for the multi-server environment using smart cards and claimed that their scheme could protect against masquerade attacks, server spoofing attack, registration server spoofing attack and insider attack. In this study, the authors show that Lee et al .'s scheme is still vulnerable to password guessing attack, server spoofing attack and masquerade attack. To propose a viable authentication scheme for distributed systems, we remedy the flaws of Lee et al .'s scheme and propose an efficient improvement over Lee et al .'s scheme. Furthermore, we compare the proposed scheme with related ones to prove that the computation cost, security and efficiency of the proposed scheme are well suitable for practical applications in a distributed system.

Analysis of the Dynamic ID-Based Remote User Authentication Schemes Using Smart Card for Multi-Server Environments

In this paper, we analyze and point out several weaknesses in the dynamic ID-based remote user authentication schemes using smart card for multi-server environments, and present the countermeasures to enhance the security of the schemes. Taking Li et al.'s scheme for instance, we demonstrate that their scheme does not provide forward secrecy and key privacy for the session keys, and cannot resist offline password guessing attack. Furthermore, the reasons of these security weaknesses are analyzed through extending the attacks to its predecessors. Finally, the improved ideas of local verification and authenticated Diffie-Hellman key agreement are presented to overcome the weaknesses mentioned above.

Cryptanalysis and improvement of Chen-Hsiang- Shih’s remote user authentication scheme using smart cards

Recently, Chen-Hsiang-Shih proposed a new dynamic ID-based remote user authentication scheme. The authors claimed that their scheme was more secure than previous works. However, this paper demonstrates that theirscheme is still unsecured against different kinds of attacks. In order to enhance the security of the scheme proposed by Chen-Hsiang-Shih, a new scheme is proposed. The scheme achieves the following security goals: without verification table, each user chooses and changes the password freely, each user keeps the password secret, mutual authentication, the scheme establishes a session key after successful authentication, and the scheme maintains the user's anonymity. Security analysis and comparison demonstrate that the proposed scheme is more secure than Das-Saxena-Gulati's scheme, Wang et al.'s scheme and Chen-Hsiang-Shih.

On the Privacy of Khan et al.'s Dynamic ID-Based Remote Authentication Scheme with User Anonymity

Very recently, Khan, Kim, and Alghathbar [6] proposed a dynamic ID-based remote user authentication scheme and claimed that their scheme can provide user anonymity. However, in this article, the authors demonstrate that either a malicious user or an adversary with a valid smart card can trace any user by eavesdropping on his normal authentication session over the public channel. Therefore, Khan et al.'s scheme fails to provide the privacy service as claimed. Hence, the authors present an improved scheme to overcome its flaw and examine the privacy of the improved scheme by using the smart card-based privacy model. In addition, the security and efficiency of the improved scheme are scrutinized. The conclusive result is that the design of the improved scheme is reasonable in not only both privacy and security aspects but also the performance aspect.

Security Improvement of Two Dynamic ID-based Authentication Schemes by Sood-Sarje-Singh

In 2010, Sood-Sarje-Singh proposed two dynamic ID-based remote user authentication schemes. The first schemeis a security improvement of Liao et al.’s scheme and the second scheme is a security improvement of Wang etal.’s scheme. In both cases, the authors claimed that their schemes can resist many attacks. However, we find thatboth schemes have security flaws. In addition, their schemes require a verification table and time-synchronization,making the schemes unfeasible and unsecured for electronic services. In order to remedy the security flaws ofSood et al.’s schemes, we propose a robust scheme which resists the well-known attacks and achieves all thedesirable security goals.

Improvement of a Dynamic ID-Based Remote User Authentication Scheme for Multi-Server Environment Using Smart Card

In 2011, Lee et al. analyzed the security weaknesses of Hsiang et al.s scheme and proposed a security dynamic ID-based multi-server remote user authentication scheme. They claimed that their protocol is secure and efficient. However, we observe that Lee et al.'s scheme is still vulnerable to stolen smart card attack, malicious server attack. To remedy these security weaknesses, we propose an improved dynamic ID-based remote user authentication scheme for multi-server environment. Besides, security analysis and performance analysis show that compared with other remote user authentication schemes, the proposed scheme is more secure and possesses lower computation cost. As a result, the proposed scheme seems to be more practical for users with portable mobile devices in multi-server environment.

An extended chaotic maps based user authentication and privacy preserving scheme against DoS attacks in pervasive and ubiquitous computing environments

As the era of pervasive and ubiquitous computing comes close, hand-held and smart devices are expected to achieve the dream of all time everywhere computing. Remote user authentication is important to verify the legitimacy of a login user over an insecure communication channel. Furthermore, in order to protect user privacy such that others cannot trace login users by eavesdropping the communication messages, several researchers proposed some dynamic ID-based remote user authentication schemes for providing user anonymity. On the other hand, the denial-of-service (DoS) attacks may make legal users unable to access a remote server by intercepting the authentication message which a login user sends to the remote server. It will make the latest user identities kept by login user and the remote server differ from each other. To ensure user anonymity and prevent such DoS attacks, we propose an extended chaotic map and dynamic ID-based user authentication scheme against DoS attacks. The proposed scheme is suitable for use in pervasive computing environments such as online financial authentication since it can ensure security while maintaining efficiency.

A New Two-factor Dynamic ID-based Remote User Authentication Scheme

A New Two-factor Dynamic ID-based Remote User Authentication Scheme

An Improved Dynamic ID-Based Remote User Authentication with Key Agreement Scheme

In recent years, several dynamic ID-based remote user authentication schemes have been proposed. In 2012, Wen and Li proposed a dynamic ID-based remote user authentication with key agreement scheme. They claimed that their scheme can resist impersonation attack and insider attack and provide anonymity for the users. However, we will show that Wen and Li's scheme cannot withstand insider attack and forward secrecy, does not provide anonymity for the users, and inefficiency for error password login. In this paper, we propose a novel ECC-based remote user authentication scheme which is immune to various known types of attack and is more secure and practical for mobile clients.

Cryptanalysis of a Dynamic ID-Based Remote User Authentication Scheme with Access Control for Multi-Server Environments

Cryptanalysis of a Dynamic ID-Based Remote User Authentication Scheme with Access Control for Multi-Server Environments

An Efficient and Secure Dynamic ID-based Authentication Scheme for Telecare Medical Information Systems

The rapidly increased availability of always-on broadband telecommunication environments and lower-cost vital signs monitoring devices bring the advantages of telemedicine directly into the patient's home. Hence, the control of access to remote medical servers' resources has become a crucial challenge. A secure authentication scheme between the medical server and remote users is therefore needed to safeguard data integrity, confidentiality and to ensure availability. Recently, many authentication schemes that use low-cost mobile devices have been proposed to meet these requirements. In contrast to previous schemes, Khan et al. proposed a dynamic ID-based remote user authentication scheme that reduces computational complexity and includes features such as a provision for the revocation of lost or stolen smart cards and a time expiry check for the authentication process. However, Khan et al.'s scheme has some security drawbacks. To remedy theses, this study proposes an enhanced authentication scheme that overcomes the weaknesses inherent in Khan et al.'s scheme and demonstrated this scheme is more secure and robust for use in a telecare medical information system.

Improvements in Dynamic ID-based Remote User Authentication Schemes

Improvements in Dynamic ID-based Remote User Authentication Schemes