Mobile Client-server Environment Research Articles

A New Mutual Authentication and Key Agreement Protocol for Mobile Client—Server Environment

Mobile devices are becoming an essential part of many users’ lives. Users exchange sometimes very sensitive data with remote servers. This raises a security problem in terms of the confidentiality and integrity of these data, and users’ privacy. Mutual authentication protocols allow a user and a server to confirm each other’s legitimacy and share a session key to encrypt subsequent communications. Several protocols have been proposed to achieve this goal. However, these have certain weaknesses, such as impersonation, lack of anonymity, the use of additional hardware, and the synchronization problem associated with the use of timestamps. In this paper, we propose a mutual authentication protocol based on elliptic curve cryptography for mobile client – server environments, which addresses the above problems. This protocol is intended to be lightweight as it is designed for resource constrained mobile devices. Moreover, we present a formal and informal analysis of the security of the proposed protocol. This latter has security attributes, such as session key security, perfect forward secrecy, user anonymity, resistance to impersonation, replay and insider attacks. Performance evaluation shows that we outperform similar protocols. Therefore, the proposed protocol is secure, efficient and suitable for mobile environments.

Ideal Lattice-Based Anonymous Authentication Protocol for Mobile Devices

The rapid advances of wireless communication technologies along with the popularity of mobile devices are enabling users to access various web services anywhere and anytime. Due to the openness of wireless communications, security becomes a vital issue. To provide secure communication, many anonymous authentication protocols in mobile client–server environments based on classical mathematical hard assumptions (i.e., discrete logarithm problem or integer factorization problem) have been presented in last two decades. However, both of the two assumptions can be solved by postquantum computers in polynomial time, which means these protocols are never secure in the postquantum era. To mitigate such types of attacks, we propose an ideal lattice-based anonymous authentication protocol for mobile client–server environments. A detailed security proof shows that our proposed protocol is provably secure under a random oracle model based on the difficulty of the ring learning with errors problem. Furthermore, the informal security analysis and experimental implementation show that our proposed protocol is practical for real-world mobile client–server environments.

An ameliorated two-factor anonymous key exchange authentication protocol for mobile client-server environment

An ameliorated two-factor anonymous key exchange authentication protocol for mobile client-server environment

A heterogeneous user authentication and key establishment for mobile client–server environment

In a mobile client–server environment, a low-power mobile device wants to access a strong server to get some kind of services. User authentication and key establishment are two basic security requirements for this environment. Without the user authentication, an unauthorized user can access the server and gets the services. Without the key establishment, the communication between the user and the server will be disclosed. Recently, some user authentication and key establishment protocols were designed. However, all of them are homogeneous since the client and the server belong to the same cryptosystem. That is, both the client and the server belong to public key infrastructure or identity-based cryptosystem or self-certified cryptosystem. Such design does not comply with the characteristic of mobile client–server application. In this paper, we design a heterogeneous user authentication and key establishment protocol using a signcryption scheme. In this protocol, the client uses identity-based cryptosystem and the server uses the public key infrastructure. As compared with existing works, our protocol has the lowest cost in computation and communication.

Remote user authentication and key agreement for mobile client–server environments on elliptic curve cryptography

In recent years, with the rapid advance of wireless mobile networks, secure and efficient authentication mechanisms that can operate over insecure wireless channels have become increasingly essential. To improve the efficiency in the energy-limited mobile devices, many authentication schemes using elliptic curve cryptography (ECC) have been presented. However, these schemes are still inefficient in terms of computation cost and communication overhead. Moreover, they suffer from various attacks, making them impractical due to their inherent design. To address their weaknesses, we propose a more efficient ID-based authentication scheme on ECC for mobile client–server environments with considering security requirements. The proposed scheme not only provides mutual authentication but also achieves session key agreement between the client and the server. Through a rigorous formal security proof under random oracle model, it has been indicated that the proposed protocol is secure against security threats. The informal security analysis shows that our scheme can resist well-known attacks and provides user anonymity. Performance analysis and comparison results demonstrate that our scheme outperforms the related competitive works and is more suitable for practical application in mobile client–server environments.

An efficient certificateless user authentication and key exchange protocol for client-server environment

Identity-based user authentication protocols have been presented to be applicable to resource-constrained devices such as mobile phones. Unfortunately, the previous protocols have the drawback of the key escrow problem. A new protocol of a user authenticated key exchange for the mobile client-server environment is presented based on certificateless public key cryptography (CL-PKC). Our protocol solves the key escrow problem in user authentication schemes based on identity-based public key cryptography (ID-PKC). In addition, the proposed protocol is resisted to both adversaries’ types I and II and achieves perfect forward secrecy. The security of the proposed protocol has been proved using computational Diffie-Hellman (CDH) assumption in the random oracle model. Experimental results show that our scheme is better than He et al. and Tsai et al. schemes respectively in communication cost.

A Secure and Efficient Multi-Factor Mutual Certificateless Authentication with Key Agreement Protocol for Mobile Client-Server Environment on ECC without the third-party

Authentication with key agreement (AKA) protocols are implemented to provide identity authentication and session keys for communication entities. In order to reduce the heavy trust reliance on key generator center (KGC) in identity based AKA protocols, a certificateless based AKA (CLAKA) protocol for client-server environment without the third-party (i.e., KGC) is introduced in this paper. The proposed protocol is constructed based on elliptic curve cryptosystem (ECC) and multi-factor protections (such as password, biometrics, and smart card). Moreover, security proof based on BAN-logic is carried out and shows that our protocol can provide mutual authentication, user anonymity, dynamic identity and perfect forward security, and resist to user impersonation attack, server spoofing attack and privileged insider attack. Meanwhile, security and efficiency analysis shows that our proposed protocol outperforms the previous related ones.

A Novel ID-Based Authentication and Key Exchange Protocol Resistant to Ephemeral-Secret-Leakage Attacks for Mobile Devices

With the rapid development in wireless communications and cloud computing technologies, clients (users) often use handheld mobile devices to access remote servers via open network channels. To provide authentication and confidentiality between clients and servers, a large number of ID-based authentication and key exchange (ID-AKE) protocols have been proposed for mobile client-server environments. However, most of the existing ID-AKE protocols adopt the precomputation technique so that they become vulnerable to the ephemeral-secret-leakage (ESL) attacks, in the sense that an adversary could use the ephemeral secrets to reveal the private keys of clients from the corresponding exchange messages. In the paper, we propose a new ESL-secure ID-AKE protocol for mobile client-server environments. We formally prove that the proposed protocol satisfies the security requirements of both mutual authentication and key exchange while resisting the ESL attacks. When compared with previously proposed ID-AKE protocols, our protocol has higher security and retains computational performance, since it requires no bilinear pairing operation for mobile clients. Finally, we mention the possibility of adopting our protocol as an authentication method of the extensible authentication protocol (EAP) for wireless networks.

A novel remote user authentication and key agreement scheme for mobile client-server environment

Recently, many identity (ID)-based user authentication and key agreement schemes for mobile client-server environment were proposed. However, these schemes are subjected to an inherent design weakness, namely, the server knows all users' private keys. Under this problem, these schemes cannot provide insider attack resistance or mutual authentication. Furthermore, some of these schemes cannot simultaneously provide user anonymity, perfect forward secrecy, or leakage of session temporary secrets resistance. In this paper, we propose a strongly secure remote user authentication and key agreement scheme to solve these security weaknesses. Security proof shows that the proposed scheme can achieve mutual authentication and key agreement, and provide perfect forward secrecy. Further security analysis shows that the proposed scheme can provide user anonymity, insider attack resistance and leakage of session temporary secrets resistance. In addition, the proposed sche me possesses low computation cost and low power consumption. Thus the proposed scheme is more suitable for mobile client-server environment.

Cryptanalysis of a remote user authentication scheme for mobile client–server environment based on ECC

Understanding security failures of cryptographic protocols is the key to both patching existing protocols and designing future schemes. The design of secure remote user authentication schemes based on elliptic curve crypto-graphy (ECC) for mobile applications is still quite a challenging problem, though many schemes have been published lately. In this paper, we analyze an efficient ID-based scheme for mobile client–server environment without the MapToPoint function introduced by He et al. in 2012. This proposal attempts to overcome many of the well known security and efficiency shortcomings of previous schemes, and it also carries a claimed proof of security in the random oracle model. However, notwithstanding its formal security arguments, we show that He et al.’s protocol even cannot attain the basic goal of mutual authentication by demonstrating its vulnerabilities to reflection attack and parallel session attack. Besides these two security vulnerabilities, their scheme also suffers from some practical pitfalls such as user anonymity violation and clock synchronization problem. In addition, we carry out an investigation into their security proof and propose some changes to the scheme so that it can achieve at least its basic security goal, in the hope that similar mistakes are no longer made in the future.

스마트폰 배터리 효율을 위한 모바일 뷰의 활용

최근 정보 기술의 가장 큰 변화 중 하나인 스마트폰은 다양한 정보 및 서비스를 손쉽게 제공하므로 기업의 여러 분야에 활용될 수 있다. 특히 의사결정을 위해 구축된 방대한 데이터를 검색하는 시스템의 경우에 스마트폰으로 서버에 질의를 요청하여 결과를 제공받을 수 있다. 스마트폰의 경우 4G 방식을 사용하여 빠른 속도로 통신할 수 있으나 배터리 소모가 매우 심하다는 것이 큰 단점이다. 본 논문에서는 모바일기기인 클라이언트와 서버로 구성된 모바일환경에서 배터리의 소모를 줄이기 위해 모바일 뷰를 제안한다. 모바일 뷰는 질의처리 시 실체화 뷰를 이용하여 서버와의 통신을 줄임으로써 배터리 소모를 줄인다. 또한 소스 변경에 따라 모바일 뷰의 일관성을 제어하기 위한 방법을 분류하고 제시된 배터리소모 비용 모델을 기반으로 각 방법의 비용을 제시한다. A smart phone which is one of the new IT technologies can be viable on various enterprise applications since it provides easily information and services. Especially, a smart phone can request queries to a server which finds massive data for decision making and receive the results of the queries from the server. However, a smart phone has a drawback that its battery is consumed easily due to the 4G communication. In this paper, we propose mobile views in order to reduce the easy consumption of a battery on mobile client-server environment. The proposed mobile view scheme reduces the number of communication which is leading to power consumption using materialized views for processing queries. We also classify the methods to control the consistency of the mobile view as the sources of the view are changed and present the cost of each method based on the cost model of battery consumption.

An efficient remote user authentication and key agreement protocol for mobile client–server environment from pairings

With the continue evaluation of mobile devices in terms of the capabilities and services, security concerns increase dramatically. To provide secured communication in mobile client–server environment, many user authentication protocols from pairings have been proposed. In 2009, Goriparthi et al. proposed a new user authentication scheme for mobile client–server environment. In 2010, Wu et al. demonstrated that Goriparthi et al.’s protocol fails to provide mutual authentication and key agreement between the client and the server. To improve security, Wu et al. proposed an improved protocol and demonstrated that their protocol is provably secure in random oracle model. Based on Wu et al.’s work, Yoon et al. proposed another scheme to improve performance. However, their scheme just reduces one hash function operation at the both of client side and the server side. In this paper, we present a new user authentication and key agreement protocol using bilinear pairings for mobile client–server environment. Performance analysis shows that our protocol has better performance than Wu et al.’s protocol and Yoon et al.’s protocol. Then our protocol is more suited for mobile client–server environment. Security analysis is also given to demonstrate that our proposed protocol is provably secure against previous attacks.

An improved ID-based client authentication with key agreement scheme on ECC for mobile client-server environments

In wireless mobile networks, a client can move between different locations while staying connected to the network and access the remote server over the mobile networks by using their mobile devices at anytime and anywhere. However, the wireless network is more prone to some security attacks, as it does not have the ingrained physical security like wired networks. Thus, the client authentication is required while accessing the remote server through wireless network. Based on elliptic curve cryptosystem (ECC) and identity-based cryptography (IBC), Debiao et al. proposed an ID-based client authentication with key agreement scheme to reduce the computation and communication loads on the mobile devices. The scheme is suitable for mobile client-server environments, is secure against different attacks and provides mutual authentication with session key agreement between a client and the remote server as they claimed. Unfortunately, this paper demonstrates that Debiao et al.' scheme is vulnerable some cryptographic attacks, and proposed an improved ID-based client authentication with key agreement scheme using ECC. The proposed scheme is secure based on Elliptic Curve Discrete Logarithm Problem (ECDLP) and Computational Diffie- Helmann Problem (CDHP). The detail analysis shows that our scheme overcomes the drawbacks of Debiao et al.'s scheme and achieves more functionality for the client authentication with lesser computational cost than other schemes.

Mobile Client-Server System for Real-time Continuous Query of Moving Objects

In this paper, a Mobile Continuous Query Processing System (MCQPS) is designed to solve problems related to database hoarding, maintenance of shared data consistency, and optimization of logging. These problems are caused by weak connectivity and disconnection of wireless networks inherent in mobile database systems under mobile client-server environments. We show the superiority of the proposed MCQPS by comparing its performance to the Client-Intercept-Server (C-I-S) model. In addition, several experimental results show the effectiveness of our proposed indexing structure and methodology for real-time continuous queries.

An ID-based client authentication with key agreement protocol for mobile client–server environment on ECC with provable security

Recently, lots of remote user authentication schemes are implemented on elliptic curve cryptosystem (ECC) to reduce the computation loads for mobile devices. However, most of those remote user authentication schemes on ECC suffer from different attacks and can not provide provable security. Therefore, we propose an ID-based remote mutual authentication with key agreement scheme on ECC in this paper. The proposed scheme not only provides mutual authentication but also supports a session key agreement between the user and the server. The scheme also provides the known session key security, the perfect forward secrecy, the no key-compromise impersonation, the no unknown key-share and the no key control. Compared with the related works, the proposed scheme is more efficient and practical for mobile devices. We also give a security proof under the random oracle.

An efficient user authentication and key exchange protocol for mobile client–server environment

Considering the low-power computing capability of mobile devices, the security scheme design is a nontrivial challenge. The identity (ID)-based public-key system with bilinear pairings defined on elliptic curves offers a flexible approach to achieve simplifying the certificate management. In the past, many user authentication schemes with bilinear pairings have been proposed. In 2009, Goriparthi et al. also proposed a new user authentication scheme for mobile client-server environment. However, these schemes do not provide mutual authentication and key exchange between the client and the server that are necessary for mobile wireless networks. In this paper, we present a new user authentication and key exchange protocol using bilinear pairings for mobile client-server environment. As compared with the recently proposed pairing-based user authentication schemes, our protocol provides both mutual authentication and key exchange. Performance analysis is made to show that our presented protocol is well suited for mobile client-server environment. Security analysis is given to demonstrate that our proposed protocol is provably secure against previous attacks.

모바일 데이터베이스 환경의 신뢰성 보장 질의처리 시스템 설계

무선 네트워크(Wireless Network)의 약한 연결성 및 접속단절, 모바일 클라이언트의 이동성, 모바일 클라이언트의 휴대성으로 인해 발생하는 모바일 데이터베이스 시스템(Mobile Database System) 관련 이슈들과 이 문제들을 해결하기 위한 연구들도 한창이다 이동 컴퓨팅은 언제 어디서나 원하는 모든 정보를 이용할 수 있는 사용자의 편의성이나 성능 면에서의 요구를 만족시키고 있지만, 데이터 관리 측면에서는 해결되어야만 하는 많은 문제점들을 안고 있다. 본 논문은 모바일 클라이언트-서버(Mobile Client-Server) 환경에서 모바일 데이터베이스 시스템 특성상 가질 수 있는 무선 네트워크의 약한 연결성 및 접속성 단절로 인한 데이터베이스 비축(Database Hoarding)과 관련된 문제, 공유 데이터(Shared Data)의 일관성(Consistency)유지 문제, 그리고 로그(Log) 최적화 문제를 해결하기 위한 모바일 질의 처리 시스템(MQPS : Mobile Query Processing System)을 설계하는데 목적이 있다. 또한, MQPS의 효율성 증명을 위해 C-I-S(Client-Intercept-Server) 모델과의 성능비교를 통해 제안한 시스템이 우수하다는 것을 입증하였다. Many researches are going on with regard to issues and problems related to mobile database systems, which are caused by the weak connectivity of wireless networks, the mobility and the Portability of mobile clients. Mobile computing satisfies user's demands for convenience and Performance to use information at any time and in any Place, but it has many Problems to be solved in the aspect of data management. The purpose of our study is to design Mobile Query Processing System(MQPS) to solve problems related to database hoarding, the maintenance of shared data consistency and the optimization of logging, which are caused by the weak connectivity and disconnection of wireless networks inherent in mobile database systems under mobile client-server environments. In addition, we proved the superiority of the proposed MQPS by comparing its performance to the C-I-S(Client-Intercept- Server) model.

Algorithms for supporting disconnected write operations for wireless Web access in mobile client-server environments

In a wireless mobile client-server environment, a mobile user may voluntarily disconnect itself from the Web server to save its battery life and avoid high communication prices. To allow Web pages to be updated while the mobile user is disconnected from the Web server, updates can be staged in the mobile host and propagated back to the Web server upon reconnection. In this paper, we analyze algorithms for supporting disconnected write operations for wireless Web access and develop a performance model to identify the optimal length of the disconnection period under which the cost of update propagation is minimized. The analysis result is particularly applicable to Web applications which allow wireless mobile users to modify Web contents while on the move. We show how the result can be applied to real-time Web applications such that the mobile user can determine the longest disconnection period such that it can still propagate updates to the server before the deadline so that a minimum communication cost is incurred.

PRO-MOTION: Support for mobile database access

In order to provide data consistency in the presence of failures and concurrency, database methods will continue to be important to the processing of shared information in a mobile computing environment. It is important, therefore, that we develop transaction processing systems that accommodate the limitations of mobile computing, such as frequent disconnection, limited battery life, low-bandwidth communication and reduced storage capacity, so that we can migrate existing database applications to mobile environments. In this paper, motivated by these needs, we propose a mobile transaction processing system that supports disconnected transaction processing in a mobile client-server environment. The proposed system employs compacts, which encapsulate access methods, state information and consistency constraints, to allow for local management of database transactions on mobile computers.