Insecure Communication Channel Research Articles

Smart Card Based Remote User Authentication Schemes: A Survey

In recent years, a new technology has come into picturefor remote user authentication (RUA) in which the remote server verifies the legitimacy and authenticity of a user over an insecure communication channel using biometrics. Because of their computational cost and convenient portability for thepurpose of authentication, remote user authentication scheme based on smart cards is widely adopted. Mutual authentication and communication privacy are considered as the essential requirements in today's client-server architecture. Therefore in this paper, a survey on RUA scheme is done by analyzing and classifying the existing schemes accordingly. The existing schemes have several security pitfalls and are vulnerable to many attacks. Thus they fail to serve all the purposes of an ideal RUA scheme. An ideal RUA scheme should inherit all the security advantages of the existing schemes. In this paper, all possible goals and attacks are defined that an ideal RUA scheme should achieve and withstand respectively. Thus the main contribution of the paper is to come up with an ideal RUA scheme while keeping the merits of the well-known smart card based authentication schemes.

Password Authentication Based on Fractal Coding Scheme

Password authentication is a mechanism used to authenticate user identity over insecure communication channel. In this paper, a new method to improve the security of password authentication is proposed. It is based on the compression capability of the fractal image coding to provide an authorized user a secure access to registration and login process. In the proposed scheme, a hashed password string is generated and encrypted to be captured together with the user identity using text to image mechanisms. The advantage of fractal image coding is to be used to securely send the compressed image data through a nonsecured communication channel to the server. The verification of client information with the database system is achieved in the server to authenticate the legal user. The encrypted hashed password in the decoded fractal image is recognized using optical character recognition. The authentication process is performed after a successful verification of the client identity by comparing the decrypted hashed password with those which was stored in the database system. The system is analyzed and discussed from the attacker’s viewpoint. A security comparison is performed to show that the proposed scheme provides an essential security requirement, while their efficiency makes it easier to be applied alone or in hybrid with other security methods. Computer simulation and statistical analysis are presented.

An enhanced biometrics-based remote user authentication scheme using mobile devices

Remote user authentication is a mechanism, in which the remote server verifies the legitimacy of a user over an insecure communication channel. Recently, Wang and Li proposed a fingerprint-based remote user authentication scheme using mobile devices. We demonstrate that their scheme is vulnerable and susceptible to many attacks and has some practical pitfalls. To solve these problems, we propose an efficient fingerprint-based remote user authentication scheme using mobile devices. Proposed scheme not only overcomes all the drawbacks and problems of Wang and Li's scheme, but also provides secure and user-friendly fingerprint-based remote user authentication over insecure networks.

Role of Multiple Encryption in Secure Electronic Transaction

Security of electronic transaction over insecure communication channel is a challenging task that includes many critical areas as secure communication channel, strong data encryption technique and trusted third party to maintain the electronic database. The conventional methods of encryption in Secure Electronic Transaction can only maintain the data security. The confidential information of customer could be accessed by the unauthorized user for malicious purpose. Therefore, it is necessary to apply effective encryption methods to enhance data security as well as authentication of data communication. The multiple encryption technique provides sufficient security for electronic transactions over wireless network. In this research paper, the needs of multiple encryption technique in Secure Electronic Transaction are proposed to enhance the security of confidential data. This technique increases the data security in such a manner that unauthorized user can not access any part of information over wireless network as internet.

Attacks on and Countermeasures for an RFID Mutual Authentication Scheme in Pervasive Computing Environment

We show that two protocols for RFID mutual authentication in pervasive computing environments, recently proposed by Kang et al, are vulnerable to several attacks. First, we show these protocols do not preserve the privacy of users’ location. Once a tag is authenticated successfully, we show several scenarios where legitimate or illegitimate readers can trace the location of that tag without any further information about the tag’s identifier or initial private key. Second, since the communication between readers and the database takes place over an insecure communication channel and in the plaintext form, we show scenarios where a compromised tag can gain access to confidential information that the tag is not supposed get access to. Finally, we show that these protocols are also vulnerable to the replay and denial-of-service attacks. While some of these attacks are due to simple flaws and can be easily fixed, others are more fundamental and are due to relaxing widely accepted assumptions in the literature. We examine this issue, apply countermeasures, and re-evaluate the protocols overhead after taking these countermeasures into account and compare them to other work in the literature.

Secure remittance transaction to bankless consumers in a fragmented applications market

This paper proposes a novel electronic monetary transaction scheme that provides secure access to a set of mobile payment services for “unbanked” consumers equipped with mobile handsets. It considers a realistic scenario of a remittance service, i.e., a user-to-user transfer of funds, in which users do not necessarily trust intermediate parties (called agents) or their infrastructures and therefore require end-to-end security and privacy protection. Since the payment solutions market is very fragmented, we also assume that users and agents are subscribed to different payment solution providers. The paper proposes a holistic approach to securing payment services by focusing on securing the transaction rather than requiring users to authenticate with unknown agent infrastructures and by using a mechanism of delegation of trust. It also proposes a novel security approach for securing payment transactions over insecure communication channels based on the Identity Based Authenticated Key Exchange (IBAKE).

ID 검색 개선을 위한 비보호채널상의 RFID 상호인증 프로토콜

본 논문에서는 데이터베이스, 리더 그리고 태그 간의 모든 통신 채널이 안전하지 않은 비보호 채널(insecure channel)임을 가정하여 비보호 채널상의 안전한 RFID 상호인증 프로토콜을 제안했다. 제안한 프로토콜은 안전한 단방향 해쉬함수를 사용했고, DB에서 태그 ID를 검색하는데 걸리는 시간과 해쉬 연산량의 부담을 개선하는 것이 목적이다. 또한, RFID 상호인증 프로토콜이 보장해야 할 기본적인 보안사항들뿐만 아니라 전방향 안전성(Forward Security)도 함께 제공하며, 태그에서 난수를 생성하지 않음으로써, 태그에서의 처리량의 부담을 줄이고자 한다. In this paper, we proposed a new secure RFID(Radio Frequency IDentification) mutual authentication protocol on insecure communication channel which assumed that all communication channels between the database, the reader and the tag are insecure communication channels. The proposed protocol used a secure one-way hash function and the goal is to improve search time of a tag ID and overload of hash calculational load in DB. In addition, the proposed protocol supports not only basic security requirements to be provided by RFID mutual authentication protocol but also forward secrecy, and the tag does not generate a random number to reduce overload of processing capacity in it.

Security enhancement on an improvement on two remote user authentication schemes using smart cards

With the current level of development of network technologies, various business activities take place on the Internet, and therefore how to assure the security of these activities over an insecure communication channel has become one of the most important issues. Authentication is the first step to protect users. Recently, Wang et al. proposed a remote user authentication scheme using smart cards to provide users with secure activities over an insecure Internet environment. Wang et al. claimed that their scheme is secured against guessing attacks, forgery attacks and denial of service (DoS) attacks which Ku et al.’s and Yoon et al.’s schemes suffered from. In this paper, we state that Wang et al.’s scheme is still vulnerable to the impersonation attack and parallel session attack. Furthermore, we propose an enhancement of Wang et al.’s scheme and provide the criteria of authentication scheme which secures a user against the risk of attack over an insecure Internet environment, for instance, session key agreement, mutual authentication and perfect forward secrecy. Moreover, we analyze the security of our scheme and prove that ours is suitable for applications with high security requirements.

Challenge-response-based biometric image scrambling for secure personal identification

This paper presents a challenge/response-based biometric image scrambling scheme which attempts to overcome the liveness and retransmission issues of biometric image transmission over insecure communication channel. An intelligent biometric sensor is proposed which has computational power to receive challenges from authentication server and generates response against the challenge with encrypted biometric image. The fractional Fourier transform (FRT) has been used for a biometric image encryption process with its scaling factors and random phase masks as the secret keys. The random phase masks of FRT are chaotically generated by piecewise linear chaotic map (PWLCM) to further improve the encryption security. Experimental and simulation results have demonstrated that the proposed system is secure, robust, and deters the risks of attacks for secure biometric image transmission.

Cryptanalysis and security enhancement of a ‘more efficient & secure dynamic ID-based remote user authentication scheme’

Remote user authentication is a method, in which remote server verifies the legitimacy of a user over an insecure communication channel. Currently, smart card-based remote user authentication schemes have been widely adopted due to their low computational cost and convenient portability for the authentication purpose. Recently, Wang et al. proposed a dynamic ID-based remote user authentication scheme using smart cards. They claimed that their scheme preserves anonymity of user, has the features of strong password chosen by the server, and protected from several attacks. However, in this paper, we point out that Wang et al.’s scheme has practical pitfalls and is not feasible for real-life implementation. We identify that their scheme: does not provide anonymity of a user during authentication, user has no choice in choosing his password, vulnerable to insider attack, no provision for revocation of lost or stolen smart card, and does provide session key agreement. To remedy these security flaws, we propose an enhanced authentication scheme, which covers all the identified weaknesses of Wang et al.’s scheme and is more secure and efficient for practical application environment.

Authenticated and Secure End-To-End Communication Channel Using SMS Messages

One of the key issues of modern cryptography is the problem of establishing a secure end-to-end communication over an insecure communication channel. Short Message Service (SMS) is a hugely popular and easily adopted communications technology for mobile devices. Users conduct business, disclose passwords and receive sensitive notification reports from systems using this communication technology. SMSs by default are sent in clear text form within the serving GSM (Global System for Mobile communications) network, Over The Air (OTA), and potentially over the public Internet in a predictable format. This allows anyone accessing the GSM system to read, and or modify the SMS content even on the fly. In this paper, we present an approach mainly consists of two steps, first, SHA-1 authentication is used to generate a message digest that is combined with previous message digest and a shared secret key to form an initial key stream. Secondly, this key will be used as input to a mathematical equation derived in prefix notation from randomly selected set of operators and functions supported by the software platform extracted from special table. The final key stream is the output of this equation which is

A study on secure RFID mutual authentication scheme in pervasive computing environment

RFID, a core technology that can be used to create a ubiquitous society, is a non-contact recognition system in which a small chip attached to various types of products transmits and processes information regarding the product and the surrounding environment via wireless communication. As a wireless recognition technology, RFID consumes little power, is small, and allows one to communicate in virtually any environment. It is thus expected to be very convenient. However, due to these characteristics of RFID systems, it may also pose a serious threat to privacy. A number of studies are currently being conducted to address this problem. Most of these studies use secure communication channels between a database and a reader, and insecure communication channels between a reader and a tag. However, this paper proposes a secure authentication protocol to provide information to an authorized entity by applying recognition technology in an insecure communication channel even for the communication between the database and the reader.

Password-Based Authentication: Preventing Dictionary Attacks

Password-based authentication is susceptible to attack if used on insecure communication channels like the Internet. Researchers have engineered several protocols to prevent attacks, but we still need formal models to analyze and aid in the effective design of acceptable password protocols geared to prevent dictionary attacks.

Technical Guidelines for Enhancing Privacy and Data Protection in Modern Electronic Medical Environments

Raising awareness and providing guidance to on-line data protection is undoubtedly a crucial issue worldwide. Equally important is the issue of applying privacy-related legislation in a coherent and coordinated way. Both these topics gain extra attention when referring to medical environments and, thus, to the protection of patients' privacy and medical data. Electronic medical transactions require the transmission of personal and medical information over insecure communication channels like the Internet. It is, therefore, a rather straightforward task to capture the electronic medical behavior of a patient, thus constructing "patient profiles," or reveal sensitive information related to a patient's medical history. The consequence is clearly a potential violation of the patient's privacy. We performed a risk analysis study for a Greek shared care environment for the treatment of patients suffering from beta-thalassemia, an empirically embedded scenario that is representative of many other electronic medical environments; we capitalized on its results to provide an assessment of the associated risks, focusing on the description of countermeasures, in the form of technical guidelines that can be employed in such medical environments for protecting the privacy of personal and medical information.

Enhancing Privacy and Data Protection in Electronic Medical Environments

Raising awareness and providing guidance to on-line data protection is by all means a crucial issue worldwide. Equally important is the issue of applying privacy-related legislation in a coherent and coordinated way. Both these topics become even more critical when referring to medical environments and thus to the protection of patients' privacy and medical data. Electronic medical transactions require the transmission of personal and medical information over insecure communication channels like the Internet. It is therefore a rather straightforward task to construct "patient profiles " that capture the electronic medical behavior of a patient, or even reveal sensitive information in regard with her/his medical history. Clearly, the consequence from maintaining such profiles is the violation of the patient's privacy. This paper studies medical environments that can support electronic medical transactions or/and the provision of medical information through the Web. Specifically it focuses on the countermeasures that the various actor categories can employ for protecting the privacy of personal and medical data transmitted during electronic medical transactions.

Secret-key agreement over unauthenticated public channels-part II: the simulatability condition

For pt.I see ibid., vol.49, no.4, p.822-31(2003). In the first part, we showed that when two parties, willing to generate a secret key, but connected only by a completely insecure communication channel, have access to independent repetitions of some random experiment, then the possibility of secret-key agreement depends on a certain property, called simulatability, of the probability distribution modeling the parties' initial knowledge. More generally, the simulatability condition is important in the context of identification and authentication among parties sharing some correlated but not necessarily identical partially secret keys. Unfortunately, this condition is a priori not very useful since it is not clear how to decide efficiently whether it is satisfied or not for a given distribution P/sub XYZ/. We introduce a new formalism, based on a mechanical model for representing the involved quantities, that allows for dealing with discrete joint distributions of random variables and their manipulations by noisy channels. We show that this representation leads to a simple and efficient characterization of the possibility of secret-key agreement secure against active adversaries.