ID-based User Authentication Scheme Research Articles

Secure and Efficient User Authentication Scheme Based on Password and Smart Card for Multiserver Environment

The rapid development of information and network technologies motivates the emergence of various new computing paradigms, such as distributed computing, cloud computing, and edge computing. This also enables more and more network enterprises to provide multiple different services simultaneously. To ensure these services can only be accessed conveniently by authorized users, many password and smart card based authentication schemes for multiserver architecture have been proposed. Recently, Truong et al. introduced an identity based user authentication scheme on elliptic curve cryptography in multiserver environment and claimed that their scheme is secure against popular attacks. However, in this paper, we point out that their scheme suffers from offline password guessing and impersonation attack and fails to achieve security requirements of this kind of authentication scheme. Moreover, we put forward a new scheme to conquer security pitfalls in the above scheme. Security analysis indicates that the proposed scheme can be free from well-known attacks. Performance discussion demonstrates that our scheme has advantages in terms of both security property and computation efficiency and thus is more desirable for practical applications in multiserver environment.

Provable Identity Based User Authentication Scheme on ECC in Multi-server Environment

With non-stop development of e-commerce and different internet-based applications’ demands, service providers include many physical servers scattering all over the world. If some users would like to use various services, they have to repeatedly register. Therefore, they must remember all these information such as, user-names or passwords. To solve this problem, many authentication schemes in multi-server environment are proposed. Furthermore, to prevent the adversary from keeping track of another user when he or she logins, many schemes apply dynamic identity, but they have some limitations with popular kinds of attacks such as, replay attack, impersonation attack, or man-in-the-middle attack... In 2014, Yeh (Department of Information Management, National Dong Hwa University) proposed multi-server scheme using Rivest–Shamir–Adleman (RSA). However, we discover this scheme cannot achieve two basic properties, mutual authentication and session-key agreement. In this paper, we concretely demonstrate that discovery and propose a different provable version using elliptic curve cryptosystem in multi-server environment which overcomes the limitation of Yeh’s scheme and satisfies security and efficiency.

A New Dynamic ID-Based User Authentication Scheme Using Mobile Device: Cryptanalysis, the Principles and Design

The remote user authentication scheme is an important security technology, which provides authentication service before a user accesses the service provided by the remote server. In this paper, we analyze the security and design flaws of a recently proposed dynamic ID authentication and key agreement scheme by Lin. We find Lin's scheme is totally cannot be used in real applications because of the following weaknesses: it has some design drawbacks such as it does not have the wrong password detection mechanism and its password change phase is incorrect; the user can login to the server using any wrong identity or password because of the inherent defects in the design of the authentication message; at the same time, Lin's scheme is vulnerable to the mobile device loss attack and denial of service attack. For security considerations, we propose some principles which should be followed in the design of the user authentication schemes. According to these design principles, we design a new dynamic ID-based user authentication scheme using mobile device. We formally analyze the security features of the proposed scheme using BAN logic, and give the provable security analysis in random oracle model. Besides, we also discuss our scheme can resist other well known attacks. The functionality and performance comparisons shown that the proposed scheme enhances the security features and keeps the efficiency at the same time.

An Efficient Dynamic ID-based User Authentication Scheme using Smart Cards without Verifier Tables

Smart-card based user authentication schemes provide that legal users conveniently and securely access remote services with smart cards through unsecure networks. Lee recently showed that the dynamic ID-based remote user authentication scheme proposed by Das et al. cannot resist password guessing attacks and impersonation attacks. In order to solve these weaknesses, Lee also presented an improved authentication scheme and claimed that the proposed scheme can resist modification, password guessing, imper sonation and smart-card-theft attacks. However, this investigation in dicates that the authentication scheme of Lee cannot resist the above attacks and violates users' untracibility. Additionally, this invest igation also develops an efficient and secure dynamic ID-bas ed user authentication scheme based on the quadratic residues. The proposed scheme not only avoids the weakness in the previous schemes, but also does not require verifier tables in the authentication server and sti ll retains low computational cost in clients.

Cryptanalysis of a New Dynamic ID-based User Authentication Scheme to Resist Smart-Card-Theft Attack

In a recent paper (AMIS, 6(2S), 2012), Lee proposed a dynamic ID-based user authentication scheme based on smart card which is believed to have many abilities to resist a range of network attacks. I n this paper, we analyze the security of Lee's scheme and show that the scheme is in fact insecure against insider-assisted attack, even if the adversary doesn't know the secret information stored in the smart card. In addition, the adversary can perform off-line gue ssing attack and impersonation attack if the secret information stored in the smart card is compromised.

Modified Dynamic ID-based User Authentication Scheme Resisting Smart-Card-Theft Attack

Wireless environments such as GSM, 3G, and 4G are more and more popular. Consequently, communications in such networks need to be guarded. It is necessary to have a secure mutual authentication scheme to defend transactions between user and service provider against illegitimate adversaries. Especially, users are those vulnerable to attacks and there are many authentication schemes with smart-card proposed to protect them. Recently, Yung-Cheng Lee has suggested a dynamic identity based user authentication scheme to resist smart-card-theft attack. Nevertheless, he assumed that smart-card is tamperproof. In our opinion, this is not appropriate because Kocher and Messerges pointed that smart-card's confidential information could be extracted by physically monitoring its power consumption. Therefore, design of Yung-Cheng Lee cannot withstand this kind of attack. In addition, anyone who is a legal member can masquerade server or other legal users in his scheme. Moreover, legitimacy verification only starting from server side truly makes Lee's scheme be impractical. In this paper, we present an improvement to his scheme to isolate such problems.

Cryptanalysis of modified dynamic ID-based user authentication scheme resisting smart-card-theft attack

Cryptanalysis of modified dynamic ID-based user authentication scheme resisting smart-card-theft attack

An extended chaotic maps based user authentication and privacy preserving scheme against DoS attacks in pervasive and ubiquitous computing environments

As the era of pervasive and ubiquitous computing comes close, hand-held and smart devices are expected to achieve the dream of all time everywhere computing. Remote user authentication is important to verify the legitimacy of a login user over an insecure communication channel. Furthermore, in order to protect user privacy such that others cannot trace login users by eavesdropping the communication messages, several researchers proposed some dynamic ID-based remote user authentication schemes for providing user anonymity. On the other hand, the denial-of-service (DoS) attacks may make legal users unable to access a remote server by intercepting the authentication message which a login user sends to the remote server. It will make the latest user identities kept by login user and the remote server differ from each other. To ensure user anonymity and prevent such DoS attacks, we propose an extended chaotic map and dynamic ID-based user authentication scheme against DoS attacks. The proposed scheme is suitable for use in pervasive computing environments such as online financial authentication since it can ensure security while maintaining efficiency.

ID-Based User Authentication Scheme for Cloud Computing

In cloud computing environments, user authentication is an important security mechanism because it provides the fundamentals of authentication, authorization, and accounting (AAA). In 2009, Wang et al. proposed an identity-based (ID-based) authentication scheme to deal with the user login problem for cloud computing. However, Wang et al.'s scheme is insecure against message alteration and impersonation attacks. Besides, their scheme has large computation costs for cloud users. Therefore, we propose a novel ID-based user authentication scheme to solve the above mentioned problems. The proposed scheme provides anonymity and security for the user who accesses different cloud servers. Compared with the related schemes, the proposed scheme has less computation cost so it is very efficient for cloud computing in practice.

Smart Card and Dynamic ID Based Electric Vehicle User Authentication Scheme

Smart grid can two-way communication using ICT(Information & Communication Technology). Also, smart grid can supply to dynamic power that grafted to electric vehicle can activate to electric vehicle charging infrastructure and used to storage battery of home. Storage battery of home can resale to power provider. These electric vehicle charging infrastructure locate fixed on home, apartment, building, etc charging infrastructure that used fluid on user. If don't authentication for user of fluid user use to charging infrastructure, electric charging service can occurred to illegal use, electric charges and leakgage of electric information. In this paper, we propose smartcard and dynamic ID based user authentication scheme for used secure to electric vehicle service in smart grid environment.

A Privacy-Preserving Dynamic ID-Based Remote User Authentication Scheme with Access Control for Multi-Server Environment

Since the number of server providing the facilities for users is usually more than one, remote user authentication schemes used for multi-server architectures, rather than single server circumstance, is considered. As far as security is concerned, privacy is the most important requirements, though some other properties are also desirable in practice. Recently, a number of dynamic ID-based user authentication schemes have been proposed. However, most of those schemes have more or less weaknesses and/or security flaws. In the worst case, user privacy cannot be achieved since malicious servers or users can mount some attacks, i.e., server spoofing attack and impersonation attack, to identify the unique identifier of users and masquerade of one entity as some other. In this paper, we analyze two latest research works and demonstrate that they cannot achieve true anonymity and have some other weaknesses. We further propose the improvements to avoid those security problems. Besides user privacy, the key features of our scheme are including no verification table, freely chosen password, mutual authentication, low computation and communication cost, single registration, session key agreement, and being secure against the related attacks.