Efficient Remote User Authentication Scheme Research Articles

A Multi-server Environment with Secure and Efficient Remote User Authentication Scheme Based on Dynamic ID Using Smart Cards

The growth of the Internet and telecommunication technology has facilitated remote access. During the last decade, numerous remote user authentication schemes based on dynamic ID have been proposed for the multi-server environment using smart cards. Recently, Shunmuganathan et al. pointed out that Li et al.’s scheme is defenseless in resisting the password guessing attack, stolen smart card attack and forgery attack. Furthermore, they showed the poor repairability and no two-factor security in Li et al.’s scheme. To surmount these security disadvantages, Shunmuganathan et al. proposed a remote user authentication scheme using smart card for multi-server environment and claimed that their scheme is secure and efficient. In this paper, we show that Shunmuganathan et al.’s scheme is also defenseless in resisting the password guessing attack, stolen smart card attack, user impersonation attack, forgery attack, forward secrecy and session key secrecy. Moreover, the two-factor security is also not preserved in their scheme. In our proposed scheme, a user is free to choose his/her login credentials such as user id and password. And also a user can regenerate the password any time. Simultaneously the proposed scheme preserves the merits of Shunmuganathan et al.’s scheme and also provides better functionality and security features, such as mutual authentication, session key agreement and perfect forward secrecy. The security analysis using the widely accepted Burrows–Abadi–Needham logic shows that the proposed scheme provides the mutual authentication proof between a user and a server. Through the rigorous formal and informal security analysis, we show that the proposed scheme is secure against possible known attacks. In addition, we carry out the simulation of the proposed scheme using the most-widely accepted and used Automated Validation of Internet Security Protocols and Applications tool and the simulation results clearly indicate that our scheme is secure.

A secure and robust password-based remote user authentication scheme using smart cards for the integrated EPR information system.

An integrated EPR (Electronic Patient Record) information system of all the patients provides the medical institutions and the academia with most of the patients' information in details for them to make corrective decisions and clinical decisions in order to maintain and analyze patients' health. In such system, the illegal access must be restricted and the information from theft during transmission over the insecure Internet must be prevented. Lee et al. proposed an efficient password-based remote user authentication scheme using smart card for the integrated EPR information system. Their scheme is very efficient due to usage of one-way hash function and bitwise exclusive-or (XOR) operations. However, in this paper, we show that though their scheme is very efficient, their scheme has three security weaknesses such as (1) it has design flaws in password change phase, (2) it fails to protect privileged insider attack and (3) it lacks the formal security verification. We also find that another recently proposed Wen's scheme has the same security drawbacks as in Lee at al.'s scheme. In order to remedy these security weaknesses found in Lee et al.'s scheme and Wen's scheme, we propose a secure and efficient password-based remote user authentication scheme using smart cards for the integrated EPR information system. We show that our scheme is also efficient as compared to Lee et al.'s scheme and Wen's scheme as our scheme only uses one-way hash function and bitwise exclusive-or (XOR) operations. Through the security analysis, we show that our scheme is secure against possible known attacks. Furthermore, we simulate our scheme for the formal security verification using the widely-accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool and show that our scheme is secure against passive and active attacks.

An anonymous and efficient remote biometrics user authentication scheme in a multi server environment

As service demands rise and expand single-server user authentication has become unable to satisfy actual application demand. At the same time identity and password based authentication schemes are no longer adequate because of the insecurity of user identity and password. As a result biometric user authentication has emerged as a more reliable and attractive method. However, existing biometric authentication schemes are vulnerable to some common attacks and provide no security proof, some of these biometric schemes are also either inefficient or lack sufficient concern for privacy. In this paper, we propose an anonymous and efficient remote biometric user authentication scheme for a multi-server architecture with provable security. Through theoretical mathematic deduction, simulation implementation, and comparison with related work, we demonstrate that our approach can remove the aforementioned weaknesses and is well suited for a multi-server environment.

A Secure and Efficient Remote User Authentication Scheme for Multi-server Environments Using ECC

With the rapid growth of the communication technology, intelligent terminals (i.e. PDAs and smartphones) are widely used in many mobile applications. To provide secure communication in mobile environment, in recent years, many user authentication schemes have been proposed. However, most of these authentication schemes suffer from various attacks and cannot provide provable security. In this paper, we propose a novel remote user mutual authentication scheme for multi-server environments using elliptic curve cryptography (ECC). Unlike other ECC-based schemes, the proposed scheme uses ECC in combination with a secure hash function to protect the secure communication among the users, the servers and the registration center (RC). Through this method, the proposed scheme requires less ECC-based operations than the related schemes, and makes it possible to significantly reduce the computational cost. Security and performance analyses demonstrate that the proposed scheme can solve various types of security problems and can meet the requirements of computational complexity for low-power mobile devices.

An Improved Efficient Remote User Authentication Scheme in Multi-server Environment using Smart Card

In a single server environment, one server is responsible for providing services to all the authorized remote users. However, the problem arises if a user wishes to access several network services. To overcome this weakness, various multi-server authentication schemes have been proposed. In 2012, Taygi et al. [1] proposed a scheme for multi-server environment. But it is found that their proposed scheme is insecure against user impersonation attack, server masquerading attack, collaboration attack between a valid user and a server, smart card stolen attack, password guessing attack and password change attack. Then we propose an improved scheme can overcome possible attacks and also provides better computational cost as well as communication cost than related schemes published earlier.

An enhanced biometrics-based remote user authentication scheme using mobile devices

Remote user authentication is a mechanism, in which the remote server verifies the legitimacy of a user over an insecure communication channel. Recently, Wang and Li proposed a fingerprint-based remote user authentication scheme using mobile devices. We demonstrate that their scheme is vulnerable and susceptible to many attacks and has some practical pitfalls. To solve these problems, we propose an efficient fingerprint-based remote user authentication scheme using mobile devices. Proposed scheme not only overcomes all the drawbacks and problems of Wang and Li's scheme, but also provides secure and user-friendly fingerprint-based remote user authentication over insecure networks.

A New Fingerprint Biometric Remote User Authentication Scheme Using Chaotic Hash Function On Mobile Devices

Abstract ABSTRACT A remote user authentication is a mechanism to authenticate remote users over insecure communication networks. It is evident that, with the passage of time, the volume of mobile user authentication is increasing because of the ease in accessing resources from any remote location. In 2008, Khan et al. proposed an efficient and practical chaotic hash-based fmgerprint biometric remote user authentication scheme for mobile devices. The current paper, however, demonstrates that Khan et al.’s scheme is vulnerable to a privileged insider’s attack and impersonation attacks by using lost or stolen mobile devices. In order to isolate such problems, the current paper also presents an improved remote user authentication scheme based on Khan et al.’s scheme.

On security of efficient nonce-based remote user authentication scheme using Smart Card

Authentication is an issue of importance in computer communications,and password authentication protocols have been widely utilized due to their great convenience.Recently,Lee et al.proposed a nonce-based remote user authentication scheme using smart cards.In this paper,however,it is found that their scheme is not secure as claimed,and two attacks can be launched to break the scheme.

A user friendly remote authentication scheme with smart cards against impersonation attacks

In 2000, Sun proposed an efficient remote user authentication scheme using smart cards without requiring a password table. However, the password of a user is an un-human lengthy password instead of a human memorized password, since it is determined by the system. Recently, Wu and Chieu proposed a user friendly remote authentication scheme with smart cards to achieve the user friendliness that users can freely choose and change their human memorized passwords. This article, however, will show that Wu and Chieu's scheme is vulnerable to two impersonation attacks. We further propose an improvement to withstand the impersonation attacks and achieve Wu and Chieu's claimed security requirements.

Efficient nonce-based remote user authentication scheme using smart cards

This paper proposes an efficient remote user authentication scheme using smart cards, which does not require password verification tables. To withstand message replay attacks, the proposed scheme uses random nonces in place of timestamps. So, it does not require synchronized clocks. In our scheme, users are able to freely choose and change their passwords. Moreover, the proposed protocol is very efficient in computation cost because the security only relies on one-way hash functions and provides mutual authentication between two entities.

Cryptanalysis of a user friendly remote authentication scheme with smart cards

Recently, Sun proposed an efficient remote user authentication scheme by employing one-way hash function. In his scheme, the system does not need to maintain a password table and the communication cost of the scheme is low, but the user cannot freely choose a password. Therefore, Wu and Chieu improved Sun's scheme for enhancing the user's demand that the user can choose and change his password freely. However, in this paper, we point out that Wu and Chieu's improvement is vulnerable to the password guessing and forgery attacks.

Efficient remote user authentication scheme based on generalized elgamal signature scheme

Recently, Shen et al. proposed an improvement to Hwang-Li's scheme to prevent from forgery attack. However, Leung et al. pointed out that this improved scheme is still susceptible to forgery attack proposed by Chan and Cheng. Accordingly, the current paper presents an enhancement based on generalized ElGamal signature scheme to resolve such problems. As a result, the proposed scheme enables users to update their passwords freely without the help of a remote system, while also providing mutual authentication. In addition, the computational costs of this scheme are less than those of previously proposed schemes.

Improved efficient remote user authentication scheme using smart cards

In 2000, since Hwang and Li proposed a remote user authentication scheme without password table using smart cards based on ID-based cryptosystems, the related works have been done. In 2002, Chien et al. proposed an efficient and practical remote user authentication scheme providing the many merits. However, Hsu showed that Chien et al.'s scheme is vulnerable to the parallel session attack. This paper proposes an improved scheme to overcome the weakness while maintaining the advantages of Chien et al.'s scheme.

Improvement of Chien et al.'s remote user authentication scheme using smart cards

In 2000, Sun proposed an efficient remote user authentication scheme using smart cards. Later, Chien et al. pointed out that Sun's scheme does not provide the mutual authentication between the user and the server and allow users to freely choose password themselves. Chien et al. further proposed a new efficient and practical solution to solve the problems. However, Hsu showed that Chien et al.'s scheme is vulnerable to the parallel session attack. This paper proposes an improved scheme to overcome the weakness while maintaining the advantages of Chien et al.'s scheme.

Security of two remote user authentication schemes using smart cards

In 2000, Sun proposed an efficient remote user authentication scheme using smart cards (published in IEEE Transactions on Consumer Electronics, vol. 46, no. 4, 2000) Recently, Chien et al. pointed out that Sun's scheme only achieve the unilateral authentication. That is, only the authentication server can authenticate that of the remote user while the use cannot authenticate that of the server. Chien et al. further proposed a new efficient and practical solution to achieve the mutual user authentication (published in Computer & Security, vol. 21, No. 4 2002). This paper, however, will demonstrate that Sun's scheme is vulnerable to the off-line and on-line password guessing attacks and Chien et al.'s scheme is vulnerable to the parallel session attack.

Security of Chien et al.'s remote user authentication scheme using smart cards

In 2000, Sun proposed an efficient remote user authentication scheme using smart cards. Recently, Chien et al. pointed out that Sun's scheme only achieves the unilateral authentication and further proposed a new efficient and practical solution to achieve the mutual user authentication. This paper, however, will demonstrate that Chien et al.'s scheme is vulnerable to the parallel session attack.

A flexible remote user authentication scheme using smart cards

In 1999, Hwang and Li proposed a new user authentication scheme using smart cards. The scheme does not need any password or verification table. Later, Sun proposed an efficient remote use authentication scheme to improve the efficiency of the Hwang-Li scheme. However, these two schemes do not allow users to freely choose and change their passwords. In this article, we shall propose a simple and efficient remote user authentication scheme that allows users to freely choose and change their passwords without significantly increasing the computation cost.