Parallel Session Attack Research Articles

CSEF: Cloud-Based Secure and Efficient Framework for Smart Medical System Using ECC

Smart architecture is the concept to manage the facilities via internet utilization in a proper manner. There are various technologies used in smart architecture such as cloud computing, internet of things, green computing, automation and fog computing. Smart medical system (SMS) is one of the application used in architecture, which is based on communication networking along with sensor devices. In SMS, a doctor provides online treatment to patients with the help of cloud-based applications such as mobile device, wireless body area network, etc. Security and privacy are the major concern of cloud-based applications in SMS. To maintain, security and privacy, we aim to design an elliptic curve cryptography (ECC) based secure and efficient authentication framework for cloud-assisted SMS. There are six phases in the proposed protocol such as: patient registration phase, healthcare center upload phase, patient data upload phase, treatment phase, checkup phase and emergency phase. In CSEF, there are four entities like healthecare center, patient, cloud and doctor. In CSEF, mutual authentication establishes between healthcare center and cloud, patient and cloud, doctor and cloud, and patient and healthcare center by the using ECC and hash function. The CSEF is secure against security attacks, and satisfies many security attributes such as man-in-the-middle attack, impersonation attack, data non-repudiation, doctor anonymity, replay attack, known-key security property, message authentication, patient anonymity, data confidentiality, stolen-verifier attack, parallel session attack and session key security. Further, the CSEF is efficient in terms of computation and communication compared to others related frameworks. As a result, CSEF can be utilized in cloud-based SMS.

A hierarchical identity-based security for delay tolerant networks using lattice-based cryptography

Routing and secure communication are important concerns in Delay Tolerant Networks (DTNs). Previously designed security schemes utilize traditional public key cryptosystems for entity and data security that provide security under some hard problems like integer factorization and discrete logarithmic problems. These algorithms are vulnerable to Quantum attacks. In this paper lattice based cryptosystem has been used first time for DTN security. Lattice based cryptosystems utilize post-quantum cryptographic algorithms which are unbreakable by quantum attacks. First we present a novel Hierarchical structure for DTN having intracluster and intercluster communications. Then, we propose a security design to provide end-to-end security to DTN application data using lattice based cryptographic signature and encryption algorithms, secure under LWE hard problem over lattices. For securing intracluster and intercluster communication, three new schemes have been proposed: (i) Lattice based hierarchical identity-based key agreement scheme, based on lattice based Diffie-Hellman key agreement protocol, secure under LWE assumption but adapted to hierarchical structure. (ii) To derive new session keys, i.e. keys for new joining nodes and for key refreshment, a new lattice based hierarchical identity-based key update scheme has been proposed, which is based on Singh et al.’s lattice based forward secure identity-based encryption algorithm, (iii) A lattice based non-interactive key agreement scheme, based on schemes proposed by Agrawal et al. and Singh et al., has been proposed for generating a secret key for two communicating nodes in different clusters. This design can effectively resist man-in-the-middle attack, replay attack, dictionary attack, and parallel session attack and maintains forward and backward secrecy.

Review on Security Based Vehicular Ad-Hoc Network

VANET a vehicular ad-hoc network provides the security to vehicles. To provide security in VANET, we are using Elliptical curve cryptography. In this paper we are going to discuss various techniques of cryptography, the techniques such are Advanced Encryption Standard, Data Encryption Standard, and Triple Data Encryption Standard. These techniques are part of symmetric and asymmetric cryptography. In addition to this there are some attacks which we are discussing in this paper like, masquerade attack, replay attack, insider attack, mutual authentication attack, and parallel session attack. These attacks are on different layer. At the end we are comparing these attacks with each other and compare their quality of services.

Robot Identification and Authentication in a Robot Cloud Service System

In recent years, information technology has become a focus of attention. All hardware, software, and communication technologies are growing rapidly. Nowadays, we can’t live without technology. We use technology anywhere and anytime, and enjoy the convenience of technology. In particular, all kinds of network services and applications. These communication technologies and services constitute the concept of cloud computing. Cloud computing involves virtualization of service resources on the network; the entire service resources include scheduling, management, maintenance, and so on, which are carried out by specialized personnel. The goal of cloud computing is enabling users to use virtual resource pools maximally and handle large-scale computing problems anytime and anywhere via the network. Robotics is one of the rapidly developing technologies. Although there are numerous research teams working on cloud robots, research on cloud robot systems is still in its infancy and many problems have not yet been considered, such as the issues of robot privatization and communication security. Therefore, we propose a robot cloud service system and focus on four crucial issues: cloud platform central control, robot intelligence technology, robot privatization, and communication security. Finally, we use BAN logic to prove that the proposed scheme achieves mutual authentication and user anonymity. The proposed scheme can also defend against several kinds of attacks, like eavesdropping attack, impersonation attack, parallel session attack, man-in-the-middle attack, and replay attack.

An Improved Privacy-Aware Handoff Authentication Protocol for VANETs

Vehicles handover from one road-side unit to another is a common phenomenon in vehicular ad-hoc networks (VANETs). Authenticating vehicles effectively is the key to success of VANETs. Li and Liu et al. proposed a lightweight identity authentication protocol (LIAP) for VANTEs recently, which is based on the concept of dynamic session secret process instead of conventional cryptographic schemes. LIAP possesses many advantages of againsting major existing attacks and performing well at efficiency and low consumption. However, we have demonstrated that the protocol LIAP doesn’t provide user location privacy protection and the resistance of parallel session attack is weak. Therefore, to enhance security of the protocol LIAP, we concatenate the terminal’s pseudo-identity with a random number, then encrypt the connected information by using quadratic residues operation, the generated dynamic identity can against the user location tracking attack. Furthermore, in order to against the parallel session attack during the handover procedure, a new road side unit regenerated a new session secret sequence and computed a challenge sequence with the terminal user’s pseudo-identity through XOR encryption. Through security analysis and experiments, our scheme has higher efficiency and better performance to be applicable to VANETS compared with other existing schemes.

Strong Authentication Scheme Based on Hand Geometry and Smart Card Factors

In 2009, Xu et al. presented a safe, dynamic, id-based on remote user authentication method that has several advantages such as freely chosen passwords and mutual authentication. In this paper, we review the Xu–Zhu–Feng scheme and indicate many shortcomings in their scheme. Impersonation attacks and insider attacks could be effective. To overcome these drawbacks, we propose a secure biometric-based remote authentication scheme using biometric characteristics of hand-geometry, which is aimed at withstanding well-known attacks and achieving good performance. Furthermore, our work contains many crucial merits such as mutual authentication, user anonymity, freely chosen passwords, secure password changes, session key agreements, revocation by using personal biometrics, and does not need extra device or software for hand geometry in the login phase. Additionally, our scheme is highly efficient and withstands existing known attacks like password guessing, server impersonation, insider attacks, denial of service (DOS) attacks, replay attacks, and parallel-session attacks. Compared with the other related schemes, our work is powerful both in communications and computation costs.

Improvement of the ElGamal Based Remote Authentication Scheme Using Smart Cards

Nowadays, we can easily obtain variety of services through networks. But due to the open environment, networks arevulnerable to many security threats. The remote user authentication scheme is one of the most widely usedmechanisms for servers to authorize users to access the services. In 2009, Ramasamy and Muniyandi proposed adiscrete logarithm based remote authentication scheme with smart cards. Their scheme provides mutualauthentication and withstands the denial of service attack, forgery attack and parallel session attack. In this article, weshow that their scheme is not a practical solution for remote access. It lacks key agreement mechanism and userscannot choose or update passwords freely. Moreover, their scheme cannot resist the stolen-verifier attack, off-lineguessing attack, impersonation attack and smart-card-loss-attack. We propose an improved scheme to remedy thedrawbacks. The improved scheme has the merits of providing mutual authentication and key agreement, whileforward and backward secrecy are ensured as well. The users can choose and update their passwords freely.Furthermore, the scheme can also withstand many attacks such as the smart-card-loss-attack, the replay attack, theoff-line guessing attack, the insider attack, the impersonation attack and the parallel session attack.

Cryptanalysis of a chaotic map-based password-authenticated key agreement protocol using smart cards

Chaotic maps have been applied in the design of authenticated key agreement protocols, which allow communication parties to exchange session keys in an authentic and secure manner. Guo and Chang recently proposed a novel password-authenticated key agreement protocol using smart card based on chaotic maps. They claimed that the protocol achieves the security goal of mutual authentication, as well as other essential security requirements. In this paper, we show that this protocol is susceptible to key-compromise impersonation and parallel session attacks. We also identify two weaknesses in the password change phase of the protocol that leads to authentication with old password and denial of service, respectively.

Design guidelines for security protocols to prevent replay & parallel session attacks

This work is concerned with the design of security protocols. These protocols are susceptible to intruder attacks and their security compromised if weaknesses in the protocols' design are evident. In this paper a new analysis is presented on the reasons why security protocols are vulnerable to replay and parallel session attack and based on this analysis a new set of design guidelines to ensure resistance to these attacks is proposed. The guidelines are general purpose so as to encompass a wide spectrum of security protocols.Further, an empirical study on the effectiveness of the proposed guidelines is carried out on a set of protocols, incorporating those that are known to be vulnerable to replay or parallel session attacks as well as some amended versions that are known to be free of these weaknesses. The goal of this study is to establish conformance of the set of protocols with the proposed design guidelines. The results of the study show that any protocol following the design guidelines can be considered free of weaknesses exploitable by replay or parallel session attacks. On the other hand, if non-conformance of a protocol with the design guidelines is determined, then the protocol is vulnerable to replay or parallel session attacks.

An Efficient and Secure Multi-server Smart Card based Authentication Scheme

This paper proposes an efficient and robust multi-server authentication scheme using smart cards. Security of this scheme depends upon cryptographic one-way hash function. This scheme allows remote users to access multiple servers without any need of separately registering with each server. Also, it gets rid of the use of verification table, permits users to select and update the password securely without taking help from the server or registration center, achieves mutual authentication and establishes a session key that is common between user and the server. Moreover, the proposed scheme withstands user impersonation attack, reflection and parallel session attacks, server impersonation attack, replay attack, password guessing attack, smart card loss attack, insider attack, and stolen verifier attack.

Secure and Efficient User Authentication Scheme in Ubiquitous Wireless Sensor Networks

The user authentication scheme in ubiquitous wireless sensor networks (WSNs) is an important security mechanism that allows users to access sensors through wireless networks. Therefore, many user authentication schemes in ubiquitous WSNs have been proposed. However, many user authentication schemes are vulnerable to impersonation attacks, parallel session attacks, password guessing attacks, stolen smart card attacks, and so forth. In this paper, we propose a secure and efficient user authentication scheme for use in ubiquitous WSNs. Our proposed scheme is secure against various attacks and provides mutual authentication and session key establishment. Furthermore, our proposed scheme is efficient at using the hash function and exclusive-OR operation.

On the Security of the Discrete Logarithm Based Remote Authentication Scheme Using Smart Cards

Nowadays, we can easily obtain variety of services through network. But due to the open environment, networks are vulnerable to variety of security threats. Ramasamy et al. proposed a discrete logarithm based remote authentication scheme with smart cards. Their scheme provides mutual authentication and withstanding the denial of service attack, forgery attack, parallel session attack and smart card loss attack. In this article, we show that their scheme is not a practical solution for remote accessing. It also lacks key agreement mechanism; and users cannot update password freely. Moreover, their scheme cannot resist the stolen verifier attack and off-line guessing attack.

Security Analysis of a Chaotic Map-based Authentication Scheme for Telecare Medicine Information Systems

Many authentication schemes have been proposed for telecare medicine information systems (TMIS) to ensure the privacy, integrity, and availability of patient records. These schemes are crucial for TMIS systems because otherwise patients' medical records become susceptible to tampering thus hampering diagnosis or private medical conditions of patients could be disclosed to parties who do not have a right to access such information. Very recently, Hao et al. proposed a chaotic map-based authentication scheme for telecare medicine information systems in a recent issue of Journal of Medical Systems. They claimed that the authentication scheme can withstand various attacks and it is secure to be used in TMIS. In this paper, we show that this authentication scheme is vulnerable to key-compromise impersonation attacks, off-line password guessing attacks upon compromising of a smart card, and parallel session attacks. We also exploit weaknesses in the password change phase of the scheme to mount a denial-of-service attack. Our results show that this scheme cannot be used to provide security in a telecare medicine information system.

Smart-card-loss-attack and Improvement of Hsiang et al.’s Authentication Scheme

Due to the open environment, all network systems suffer from various security threats. The remote user authentication scheme is a secure mechanism to allow users obtaining a variety of information services through insecure channels. For efficiency and security, many remote user authentication schemes identify users with smart cards. However, many smart card based schemes are vulnerable to lots of attacks. Recently, Hsiang et al. proposed a smart card based remote authentication scheme. In this article, we show that their scheme is vulnerable to the smart-card-loss-attack. That is, if an unauthorized person obtains the smart card, he/she can guess the correct password to masquerade as a legitimate user to login the system. The attack is caused by the smart card outputs fixed message for the same inputs. We propose an improved scheme to fix the flaw. The improved scheme withstands the off-line password guessing attack, parallel session attack and smart-card-loss-attack. Moreover, it also has the merits of providing mutual authentication, no verification table and users can freely update their passwords.

Dynamic Encryption Key based Smart Card Authentication Scheme

In order to keep away from difficulties associated with traditional password based authentication methods, smart card based authentication schemes have been widely used. It has already been accepted worldwide due to its low computational cost. However, most of these schemes are vulnerable to one or the other possible attack. This paper describes a new smart card authentication scheme using symmetric key cryptography, which covers all the identified security pitfalls and satisfies the needs of a user. Its security is based on encrypting the contents of all the communicating messages exchanged between remote user and the server. Moreover, it provides users to choose and change their passwords freely, mutual authentication and session key generation. In addition, it uses nonce instead of timestamp to resist replay attack. Security analysis proves that this scheme is secure against impersonation attack, password guessing attack, replay attack, reflection attack, parallel session attack, insider attack, attack on perfect forward secrecy, stolen verifier attack, smart card loss attack and man-in-the-middle attack. The proposed scheme can be easily extended to Internet protocol television broadcasting, Multi-server authentication, Wireless communication and Healthcare, where the user needs to access data from server.

Cryptanalysis of a remote user authentication scheme for mobile client–server environment based on ECC

Understanding security failures of cryptographic protocols is the key to both patching existing protocols and designing future schemes. The design of secure remote user authentication schemes based on elliptic curve crypto-graphy (ECC) for mobile applications is still quite a challenging problem, though many schemes have been published lately. In this paper, we analyze an efficient ID-based scheme for mobile client–server environment without the MapToPoint function introduced by He et al. in 2012. This proposal attempts to overcome many of the well known security and efficiency shortcomings of previous schemes, and it also carries a claimed proof of security in the random oracle model. However, notwithstanding its formal security arguments, we show that He et al.’s protocol even cannot attain the basic goal of mutual authentication by demonstrating its vulnerabilities to reflection attack and parallel session attack. Besides these two security vulnerabilities, their scheme also suffers from some practical pitfalls such as user anonymity violation and clock synchronization problem. In addition, we carry out an investigation into their security proof and propose some changes to the scheme so that it can achieve at least its basic security goal, in the hope that similar mistakes are no longer made in the future.

Establishing and Fixing Security Protocols Weaknesses Using a Logic-based Verification Tool

 Abstract—Formal verification aims at providing a rigid and thorough means of evaluating the correctness of security protocols and also establishing that the protocols are free of weaknesses that can be exploited by attacks. This paper discusses the process of formal verification using a logic–based verification tool. The verification tool with attack detection capabilities is introduced, and the verification process is demonstrated by way of a case study on two published security protocols that provide mutual authentication using smart cards. The performed verification reveals new weaknesses in the protocols that can be exploited by a replay attack and a parallel session attack. The impact of these attacks is that an attacker is able to masquerade as a legitimate remote user to cheat the system. The reasoning why these attacks are possible is detailed and an amended protocol, resistant to these attacks is proposed. Formal verification of the amended protocol provides confidence in the correctness and effectiveness of the proposed modifications.

Cryptanalysis and security enhancement of a remote user authentication scheme using smart cards

With the broad implementations of the electronic business and government applications, robust system security and strong privacy protection have become essential requirements for remote user authentication schemes. Recently, Chen et al. pointed out that Wang et al.'s scheme is vulnerable to the user impersonation attack and parallel session attack, and proposed an enhanced version to overcome the identified security flaws. In this paper, however, we show that Chen et al.'s scheme still cannot achieve the claimed security goals and report its following problems: (1) It suffers from the offline password guessing attack, key compromise impersonation attack and known key attack; (2) It fails to provide forward secrecy; (3) It is not easily repairable. As our main contribution, a robust dynamic ID-based scheme based on non-tamper resistance assumption of the smart cards is presented to cope with the aforementioned defects, while preserving the merits of different related schemes. The analysis demonstrates that our scheme meets all the proposed criteria and eliminates several grave security threats that are difficult to be tackled at the same time in previous scholarship.

A secure and effective user authentication and privacy preserving protocol with smart cards for wireless communications

In 2012, Li and Lee (C. T. Li and C. C. Lee, “A novel user authentication and privacy preserving scheme with smart cards for wireless communications,” Mathematical and Computer Modelling, vol. 55, nos. 1–2, pp. 35–44, 2012) proposed a novel user authentication and privacy preserving scheme with smart cards for wireless communications. However, in this paper, we show that Li-Lee’s scheme is vulnerable to three security weaknesses: (1) Li-Lee’s scheme fails to achieve strong authentication in login and authentication phases, (2) Li-Lee’s scheme fails to update the user’s password correctly in the password change phase, and (3) Li-Lee’s scheme fails strongly to protect replay attacks. In order to remedy those security flaws in Li-Lee’s scheme, we propose a secure and effective user authentication and privacy preserving scheme with smart cards for wireless communications. We show that our scheme is secure against various known types of attacks, such as user anonymity, perfect forward security, strong replay attack, impersonation and off-line password guessing attacks and parallel session attack, which makes our scheme more secure and practical for mobile wireless networking. Moreover, our scheme works without password table, provides correct password change locally by the mobile user, non-repudiation, user friendliness, fairness in key agreement, and session keys establishment between the mobile user and the foreign agent, between the mobile user and the home agent, and between the foreign agent and the home agent. Further, through the simulation results using the AVISPA (Automated Validation of Internet Security Protocols and Applications) tool we show that our improved scheme is secure against passive and active attacks.

Improvement of a security enhanced one-time two-factor authentication and key agreement scheme

In 2010, Hölbl et al. showed that Shieh et al.’s mutual authentication and key agreement scheme is vulnerable to the smart card lost attack, not achieving perfect forward secrecy, and proposed a security enhanced scheme to eliminate these weaknesses. In this paper, we show that Hölbl et al.’s security enhancement is still vulnerable to the smart card lost attacks. In addition, their scheme cannot resist impersonation attacks and parallel session attacks. Seeing that the existing mutual authentication schemes using smart cards are almost vulnerable to the smart card lost attacks, we further propose a new one-time two-factor mutual authentication and key agreement scheme to eliminate these weaknesses.