Session Key Establishment Research Articles

Secure and Efficient User Authentication Scheme in Ubiquitous Wireless Sensor Networks

The user authentication scheme in ubiquitous wireless sensor networks (WSNs) is an important security mechanism that allows users to access sensors through wireless networks. Therefore, many user authentication schemes in ubiquitous WSNs have been proposed. However, many user authentication schemes are vulnerable to impersonation attacks, parallel session attacks, password guessing attacks, stolen smart card attacks, and so forth. In this paper, we propose a secure and efficient user authentication scheme for use in ubiquitous WSNs. Our proposed scheme is secure against various attacks and provides mutual authentication and session key establishment. Furthermore, our proposed scheme is efficient at using the hash function and exclusive-OR operation.

Cryptanalysis and security enhancement of Zhu's authentication scheme for Telecare medicine information system

ABSTRACTThe concept of Telecare medicine information systems (TMISs) has evolved to provide better health care to the masses. So the control of access to privileged services provided by TMIS is a crucial concern. Recently, Zhu proposed an authentication scheme for TMIS, which he claimed to be more suitable for TMIS environments than the scheme of Wei et al. especially regarding resistance to offline password guessing attack. However, this paper shows that Zhu's scheme still suffers from offline password guessing attack. We also show how an attacker can impersonate a legal user merely by intercepting a login request and how a legal user (patient) may often become victim of denial‐of‐service in crucial TMIS applications. We further show its vulnerability to online password guessing attack and smart card loss attack. To sort out these discrepancies from Zhu's scheme, we propose an improved scheme with session key establishment and user anonymity. Moreover, this improvement is achieved without adding any complex operation; even the communication cost of the proposed scheme is lesser than that in Zhu's scheme. Analysis shows the robustness as well as the simplicity of the proposed scheme. Copyright © 2014 John Wiley & Sons, Ltd.

An Efficient and Adaptive Mutual Authentication Framework for Heterogeneous Wireless Sensor Network-Based Applications

Robust security is highly coveted in real wireless sensor network (WSN) applications since wireless sensors' sense critical data from the application environment. This article presents an efficient and adaptive mutual authentication framework that suits real heterogeneous WSN-based applications (such as smart homes, industrial environments, smart grids, and healthcare monitoring). The proposed framework offers: (i) key initialization; (ii) secure network (cluster) formation (i.e., mutual authentication and dynamic key establishment); (iii) key revocation; and (iv) new node addition into the network. The correctness of the proposed scheme is formally verified. An extensive analysis shows the proposed scheme coupled with message confidentiality, mutual authentication and dynamic session key establishment, node privacy, and message freshness. Moreover, the preliminary study also reveals the proposed framework is secure against popular types of attacks, such as impersonation attacks, man-in-the-middle attacks, replay attacks, and information-leakage attacks. As a result, we believe the proposed framework achieves efficiency at reasonable computation and communication costs and it can be a safeguard to real heterogeneous WSN applications.

Freshness Consideration of Hierarchical Key Agreement Protocol in WSNs

Wireless sensor networks (WSNs) are often deployed in potentially adverse or even hostile environment so that there are concerns on security issues in these WSNs. Sensor nodes with resource-constrained make security applications a challenging problem. Key agreement is a fundamental security service in WSNs, which enables sensor nodes to communicate securely with each other using cryptographic techniques. However, due to the resource constraints on sensor nodes, it is infeasible to use traditional key management techniques such as public key cryptography and key distribution center. Recently, Kim proposed two efficient and noninteractive hierarchical key agreements in WSNs, which have good properties including noninteractive, hierarchical, resilient, etc. However, Kim’s protocols do not support freshness of the established session key that key agreement protocol should supports. Thereby, we propose two freshness preserving hierarchical key agreement protocols over the hierarchical WSNs, named as HKAP_FP. Our two HKAP_FPs inherit advantages from Kim’s protocols and well suited to the hierarchical WSNs.

Security Analysis and Improvement of an Anonymous Authentication Scheme for Roaming Services

An anonymous authentication scheme for roaming services in global mobility networks allows a mobile user visiting a foreign network to achieve mutual authentication and session key establishment with the foreign-network operator in an anonymous manner. In this work, we revisit He et al.'s anonymous authentication scheme for roaming services and present previously unpublished security weaknesses in the scheme: (1) it fails to provide user anonymity against any third party as well as the foreign agent, (2) it cannot protect the passwords of mobile users due to its vulnerability to an offline dictionary attack, and (3) it does not achieve session-key security against a man-in-the-middle attack. We also show how the security weaknesses of He et al.'s scheme can be addressed without degrading the efficiency of the scheme.

Security Enhanced Anonymous Multiserver Authenticated Key Agreement Scheme Using Smart Cards and Biometrics

An anonymous user authentication scheme allows a user, who wants to access a remote application server, to achieve mutual authentication and session key establishment with the server in an anonymous manner. To enhance the security of such authentication schemes, recent researches combined user's biometrics with a password. However, these authentication schemes are designed for single server environment. So when a user wants to access different application servers, the user has to register many times. To solve this problem, Chuang and Chen proposed an anonymous multiserver authenticated key agreement scheme using smart cards together with passwords and biometrics. Chuang and Chen claimed that their scheme not only supports multiple servers but also achieves various security requirements. However, we show that this scheme is vulnerable to a masquerade attack, a smart card attack, a user impersonation attack, and a DoS attack and does not achieve perfect forward secrecy. We also propose a security enhanced anonymous multiserver authenticated key agreement scheme which addresses all the weaknesses identified in Chuang and Chen's scheme.

On the security of SSL/TLS-enabled applications

SSL/TLS (Secure Socket Layer/Transport Layer Security)-enabled web applications aim to provide public key certificate based authentication, secure session key establishment, and symmetric key based traffic confidentiality. A large number of electronic commerce applications, such as stock trading, banking, shopping, and gaming rely on the security strength of the SSL/TLS protocol. In recent times, a potential threat, known as main-in-the-middle (MITM) attack, has been exploited by attackers of SSL/TLS-enabled web applications, particularly when naive users want to connect to an SSL/TLS-enabled web server. In this paper, we discuss about the MITM threat to SSL/TLS-enabled web applications. We review the existing space of solutions to counter the MITM attack on SSL/TLS-enabled applications, and then, we provide an effective solution which can resist the MITM attack on SSL/TLS-enabled applications. The proposed solution uses a soft-token based approach for user authentication on top of the SSL/TLS’s security features. We show that the proposed solution is secure, efficient and user friendly in comparison to other similar approaches.

Threshold-Based Privacy-Preserving Key Management Scheme for Vehicle-to-Grid Networks

The concept of vehicle-to-grid (V2G) is that electric vehicles (EVs) communicate with the smart grid to sell demand response services by delivering electricity into the grid. Due to the scale of the network, the speed of the vehicles, their geographic positions, and the very sporadic connectivity between them, V2G communications have the crucial requirements of fast session key establishment. In this paper, we propose a threshold-based privacy-preserving key management scheme for V2G networks, which utilizes the threshold-based secret sharing and symmetric key technique to protect the identities of the EV owners and to establish the shared session key between the aggregator and the vehicle. The proposed scheme can achieve the property of identity privacy, confidentiality of the communications, and known-key security.

Proximity-Based Security Techniques for Mobile Users in Wireless Networks

In this paper, we propose a privacy-preserving proximity-based security system for location-based services in wireless networks, without requiring any pre-shared secret, trusted authority, or public key infrastructure. In this system, the proximity-based authentication and session key establishment are implemented based on spatial temporal location tags. Incorporating the unique physical features of the signals sent from multiple ambient radio sources, the location tags cannot be easily forged by attackers. More specifically, each radio client builds a public location tag according to the received signal strength indicators, sequence numbers, and media access control (MAC) addresses of the ambient packets. Each client also keeps a secret location tag that consists of the packet arrival time information to generate the session keys. As clients never disclose their secret location tags, this system is robust against eavesdroppers and spoofers outside the proximity range. The system improves the authentication accuracy by introducing a nonparametric Bayesian method called infinite Gaussian mixture model in the proximity test and provides flexible proximity range control by taking into account multiple physical-layer features of various ambient radio sources. Moreover, the session key establishment strategy significantly increases the key generation rate by exploiting the packet arrival time of the ambient signals. The authentication accuracy and key generation rate are evaluated via experiments using laptops in typical indoor environments.

Robust Anonymous Two-Factor Authentication Scheme for Roaming Service in Global Mobility Network

Two-factor authentication scheme for roaming service in global mobility network enables the mobile user in possession of a password and a smart card to achieve mutual authentication and session key establishment with the foreign agent. In this paper, we first identify six properties of this type of schemes: (1) Anonymity and untraceability; (2) Robustness; (3) Authentication; (4) Session key security and fairness; (5) User friendliness; and (6) Efficiency, then propose a new scheme which satisfies all these requirements. Our result is validated applying the formal verification tool ProVerif based on applied pi calculus.

SECURITY IN WIRELESS SENSOR NETWORKS USING ASSYMETRIC KEY BASED TECHNIQUES

Wireless sensor networks (WSNs) have recently attracted a lot of interest in the research community due their wide range of applications in our lives ranging from military applications to civilian ones.. Due to distributed nature of these networks and their deployment in remote areas, these networks are vulnerable to numerous security threats that can adversely affect their proper functioning. This problem is more critical if the network is deployed for some mission-critical applications such as in a tactical battlefield. Random failure of nodes is also very likely in real-life deployment scenarios. Due to resource constraints in the sensor nodes, traditional security mechanisms with large overhead of computation and communication are infeasible in WSNs. Security in sensor networks is, therefore, a particularly challenging task. In this current paper, we fundamentally focus on the security issue of WSNs and propose a protocol based on public key cryptography for external agent authentication and session key establishment. The proposed protocol is efficient and secure in compared to other public key based protocols in WSNs.

A Novel Smart Card Authentication Scheme using Image Encryption

From the user point of view, security and efficiency are the two main factors for any authentication scheme. However, most of the smart card authentication schemes are vulnerable to one or the other possible attack. In this paper, highly secured smart card authentication scheme is proposed using image encryption that resists all the possible attacks and satisfies the needs of a user. Its security is based on encryption of text with a key image. Moreover, it provides mutual authentication, session key establishment and uses date and time as a timestamp to resist replay attack. Security analysis proves that the proposed scheme is more secure and practical.

Improved Security Patch on Secure Communication among Cell Phones and Sensor Networks

The communication between cell phones and sensor networks involves strong user authentication protocols to ensure the data and network security. Generally, in order to obtain the relevant information, cell phones interact with sensor networks via gateways. In 2009, according to Arjan Durresi and Vamsi Paruchuri scheme, this unique ability is used to provide better authentication and security protocols that can be used to establish secure communications among cell phones and sensor networks. In this paper, we show that their scheme is vulnerable to known attacks such as man-in-the-middle attack and reply attack, and it does not provide mutual authentication between gateway node and cell phone. In addition, it does not establish session key after the authentication phase. To fill this security gap, we proposed security patches and improvements, which overcome the weak features in the scheme of Arjan Durresi and Vamsi Paruchuri. Finally, we came out with results which show that our improved security patch establishes trust between the cell phone and gateway in the form of mutual authentication and provides the session key establishment after the authentication phase.

Handauth: Efficient Handover Authentication with Conditional Privacy for Wireless Networks

Existing mechanisms for handover authentication mainly focus on designing a secure authentication module, little attention has been paid to protect users' privacy when they are authenticated by the access points for data access. Further, most existing approaches do not support user revocation. In this paper, we present a secure and efficient authentication protocol named Handauth. Similar to the mechanisms of this field, Handauth provides user authentication and session key establishment. However, compared to other well-known approaches, Handauth not only enjoys both computation and communication efficiency, but also achieves strong user anonymity and untraceablility, forward secure user revocation, conditional privacy-preservation, AAA server anonymity, access service expiration management, access point authentication, easily scheduled revocation, dynamic user revocation and attack resistance. Experimental results show that the proposed approach is feasible for real applications.

Secure and Efficient Anonymous Authentication Scheme in Global Mobility Networks

In 2012, Mun et al. pointed out that Wu et al.’s scheme failed to achieve user anonymity and perfect forward secrecy and disclosed the passwords of legitimate users. And they proposed a new enhancement for anonymous authentication scheme. However, their proposed scheme has vulnerabilities that are susceptible to replay attack and man-in-the-middle attack. It also incurs a high overhead in the database. In this paper, we examine the vulnerabilities in the existing schemes and the computational overhead incurred in the database. We then propose a secure and efficient anonymous authentication scheme for roaming service in global mobility network. Our proposed scheme is secure against various attacks, provides mutual authentication and session key establishment, and incurs less computational overhead in the database than Mun et al.'s scheme.

PERFORMANCE EVALUATION OF MULTICRYPT ENCRYPTION MECHANISM

Multicast communication allows a single message packet to be routed to multiple nodes simultaneously. Membership in a multicast group is dynamic, allowing nodes to enter and leave the multicast session. Besides the benefits, multicast communication presents the challenge of securing the communication. In order to preserve confidentiality the general encryption mechanism used for point to point communications are used. A specific encryption mechanism rather a general one is needed to suit the multicast communication requirements wherein the life time of a secret key is very short and requires a frequent change. Moreover, the next generation wireless networks have very limited resources and need a light weight security mechanism. The proposed cipher, Multicrypt, is similar to the One Time Pad and Hill cipher based on a sub band coding scheme using the principle of Orthogonal Vectors. The proposed cipher is based on the assumption of Computational Diffie Hellman problem and insolvability of Hadamard conjecture. It is designed to have multiple keys to decrypt the message like asymmetric cryptosystem so that a (key) compromise of a member would not lead to compromise of the entire system, less computational and communicational overheads, less storage complexity and there is no need for state-full members. This study also presents an extensive security analysis and the performance analysis with RSA, a public key encryption mechanism used to establish session keys. With the help of security analysis the study proves that brute force attack does not compromise the system. Multicrypt cryptosystem has the capability of dynamically adding and revoking members. The performance of Multicrypt is relatively better in terms of key setup time, encryption time, decryption time, encryption throughput and decryption throughput than RSA in the simulated setup. The proposed cipher is also proved to be secure against IND-CPA and IND-CCA attacks.

안전한 원격사용자 인증스킴에 대한 취약성 분석

In 2011, C.-T. Li et al. proposed a secure user authentication scheme, which is an improvement over Kim et al.’s scheme to resolve several security flaws such as off-line password guessing attack and masquerading attack. C.-T. Li et al. claimed that their scheme prevents smart card security related attacks. Moreover, it provides mutual authentication and session key establishment. However, we found that their scheme is vulnerable to password guessing attack through password change phase, smart card forgery attack and stolen verifier attack. Moreover, C.-T. Li et al.’s scheme is not secure against password guessing attack as they claimed. In this paper, we also point out that their scheme is not practical to use.

Identity-based Authentication and Access Control in Wireless Sensor Networks

The application and usage of the wireless sensor network is rapidly growing. Wireless sensor networks are normally deployed into the unattended environment where the intended user can get access of the network. The sensor nodes collect data from this environment. If the data are valuable and confidential then some security measures are needed to protect the data from the unauthorized access. In this paper, I propose an identity-based user authentication and access control protocol based on the Identity-Based Signature (IBS) scheme where the ECC (Elliptic Curve Cryptography) based digital signature algorithm (DSA) is used for signing a message and verifying a message for a wireless sensor networks. This protocol accomplishes the registration of a new user, authentication of a user, session key establishment between sensor node and the user; and finally grants the appropriate data access to the user. User revocation is also handled in this proposed protocol. Compared with other conventional security solutions, this protocol provides confidentiality and integrity of the sensor data; and also achieves better computational, communicational performance and energy efficiency due to the use of more efficient IBS algorithms based on ECC than those based on RSA.

An Efficient Key Management Scheme for Hierarchical Wireless Sensor Networks

The recent advances in integrated circuit technologies, microprocessor hardware, wireless communications, embedded systems and technologies as well as the emergence of Ad-hoc networking, made up the concept of wireless sensor networks. Regarding the nature of sensors and the nature of the environment of deployment sensor networks are exposed to many attacks more than any other networks, therefore new strategies and protocols of security must be defined for these networks taking into consideration the characteristics of sensors as well as the architecture of the network. In this paper we propose a lightweight implementation of public key infrastructure called cluster based public infrastructure (CBPKI), CBPKI is based on the security and the authenticity of the base station for executing a set of handshakes intended to establish session keys between the base station and sensors over the network used for ensuring data confidentiality and integrity.

An efficient and secure multi-server authentication scheme with key agreement

Remote user authentication is used to validate the legitimacy of a remote log-in user. Due to the rapid growth of computer networks, many network environments have been becoming multi-server based. Recently, much research has been focused on proposing remote password authentication schemes based on smart cards for securing multi-server environments. Each of these schemes used either a nonce or a timestamp technique to prevent the replay attack. However, using the nonce technique to withstand the replay attack is potentially susceptible to the man-in-the-middle attack. Alternatively, when employing the timestamp method to secure remote password authentication, it will require the cost of implementing clock synchronization. In order to solve the above two issues, this paper proposes a self-verified timestamp technique to help the smart-card-based authentication scheme not only effectively achieve password-authenticated key agreement but also avoid the difficulty of implementing clock synchronization in multi-server environments. A secure authenticated key agreement should accomplish both mutual authentication and session key establishment. Therefore, in this paper we further give the formal proof on the execution of the proposed authenticated key agreement scheme.