Parallel Session Attack Research Articles

Exploiting hash functions to intensify the remote user authentication scheme

Nowadays, the client–server model plays an important part in the Internet architecture. The procedure that a server authenticates a remote user securely has become a significant issue. Hence, many remote user authentication schemes are proposed. Hsiang and Shih pointed out the weaknesses of Yoon et al.'s scheme and proposed an improved scheme not only preserving original merits but also mending the weaknesses. The scheme protects against masquerading attacks, offline password guessing attacks and parallel session attacks. However, He et al. found that Hsiang et al.'s scheme is still vulnerable to password guessing attack, masquerading server attack and masquerading attack. Furthermore, we also found Hsiang–Shih's scheme could be threatened by a malicious insider that can originate an infringed account attack and a resembling account attack. In this paper, we first describe how a malicious insider carries out an infringed account attack and then present a resembling account attack on Hsiang–Shih's scheme. After that, we propose an improvement assisted by hashing functions to enhance Hsiang–Shih's scheme.

Cryptanalysis and security enhancement of Chen et al.’s remote user authentication scheme using smart card

Abstract Recently (2011) Chen et al. found that Wang et al.’s scheme (2007) is vulnerable to impersonation attacks and parallel session attacks; and then proposed a security enhancement of Wang et al.’s scheme. Chen et al. claimed to inherit the merits and eradicate the flaws of the original scheme through their improved scheme. Unfortunately, we found that Chen et al.’s scheme inherits some flaws of the original scheme, like the known-key attack, smart card loss attack and its serious consequences. In addition, Chen et al.’s scheme is not easily reparable and is unable to provide forward secrecy. Thus Chen et al.’s scheme still has scope for security enhancement. Finally, we propose an improved scheme with better security strength. Moreover, we analyze the performance of our scheme and prove that ours is suitable for applications with high security requirements.

An Efficient and Secure ID-based Remote User Authentication Scheme using Smart Card

The User Authentication mechanism technology has enjoyed strong growth in recent year, but security threats and facing attacks in authentication have grown equally fast. Today, there are many potential attacks that are targeted at authentication including insider attack, masquerade attack, server spoofing attack, parallel session attack, offline password guessing attack and many more. Recently, In 2010 R. Song proposed advanced smart card based password authentication protocol with such non-tamper resistant smart card based on symmetric key cryptosystem as well as modular exponentiation. R. Song et al Scheme is vulnerable to the offline password attack, insider attack; forward secrecy and denial of service attack are cryptanalyses by W B Horng. In this article, we will propose an efficient ID-based authentication scheme which can avoid all type of security flaws. The functionally, performance and security analysis show that our proposed scheme is feasible in terms of computation cost, storage capacity and the scheme can resist server attack.

Improvements on Hsiang and Shih's Remote User Authentication Scheme Using Smart Cards

Hsiang and Shih discovered that Yoon et al.’s user authentication scheme was vulnerable to parallel session attack, impersonation attack, and offline password guessing attack. They proposed an improved scheme to prevent these attacks. Hsiang and Shih’s scheme is still susceptible to offline password guessing attack and server impersonation attack. In this paper, we demonstrate how their scheme can be compromised and then propose an improved scheme based on the Rabin cryptosystem to overcome the weaknesses. Furthermore, we discuss the reason why we should use an asymmetric encryption algorithm to secure a password-based remote user authentication scheme using smart cards. We formally prove the security of our proposed scheme using the BAN logic. key words: Network-level security and protection, authentication, security, password

Enhanced Password-based Remote User Authentication Scheme Using Smart Cards

Secure and efficient authentication schemes over insecure networks have been a very important issue with the rapid development of networking technologies. Wang et al. proposed a remote user authentication scheme using smart cards. However, recently, Chen et al. pointed out that their scheme is vulnerable to the impersonation attack and the parallel session attack, and they proposed an enhanced authentication scheme. Chen et al. claimed that their scheme is secure against the various attacks. However, we have found that their scheme cannot resist the parallel attack and the stolen smart card attack. Therefore, in this paper, we show the security flaws in Chen et al.'s scheme and propose an improved remote user authentication scheme using tamper-resistant smart cards to solve the problem of Chen et al.'s scheme. We also analyze our scheme in terms of security and performance.

An improved and secure smart card-based authentication scheme

Kim and Chung (2009) found that Yoon and Yoo’s scheme (2005) easily reveals a user’s password and is susceptible to masquerading user attack, masquerading server attack and stolen verifier attack. Therefore, Kim and Chung proposed a new remote user authentication scheme. They claimed that the proposed scheme resolves all aforementioned security flaws, while keeping the merits of Yoon and Yoo’s scheme. However, we found that Kim and Chung’s scheme is susceptible to masquerading user attack, masquerading server attack, offline dictionary attack using stolen smart card and parallel session attack. This paper improves Kim and Chung’s scheme that resolves the aforementioned security flaws, while keeping the merits of Kim and Chung’s scheme. The security of the proposed protocol depends upon two security parameters which makes difficult for an attacker to launch attacks on the proposed scheme. Therefore, the attacker can not get any meaningful authentication information from eavesdropping.

Security enhancement on an improvement on two remote user authentication schemes using smart cards

With the current level of development of network technologies, various business activities take place on the Internet, and therefore how to assure the security of these activities over an insecure communication channel has become one of the most important issues. Authentication is the first step to protect users. Recently, Wang et al. proposed a remote user authentication scheme using smart cards to provide users with secure activities over an insecure Internet environment. Wang et al. claimed that their scheme is secured against guessing attacks, forgery attacks and denial of service (DoS) attacks which Ku et al.’s and Yoon et al.’s schemes suffered from. In this paper, we state that Wang et al.’s scheme is still vulnerable to the impersonation attack and parallel session attack. Furthermore, we propose an enhancement of Wang et al.’s scheme and provide the criteria of authentication scheme which secures a user against the risk of attack over an insecure Internet environment, for instance, session key agreement, mutual authentication and perfect forward secrecy. Moreover, we analyze the security of our scheme and prove that ours is suitable for applications with high security requirements.

An Efficient and Reliable Three-Entity Remote User and Server Authentication Technique

Authentication of remote user and server is a great research challenge in today’s advanced wired and wireless communication. Recently Das proposed a flexible remote system authentication using smart card [7]. Xu et al. proved that Khan et al.’s fingerprint based remote user authentication is vulnerable to the impersonation and parallel session attack [10]. In this paper, we show that Das’s scheme is not withstand the reverse XOR and adversary system attack. We also propose an improved remote user and server authentication that verifies the authenticity of user by user’s password, smart card and biometric property of user. The technique is insulated from the reverse XOR, adversary system, impersonation and parallel session attacks INDEXING TERMS: Authentication, Remote System, Password, Smart card, Biometric.

Weaknesses and improvements of the Yoon–Ryu–Yoo remote user authentication scheme using smart cards

Remote user authentication scheme is a procedure which allows a server to authenticate a remote user through insecure channel. Recently, Yoon, Ryu and Yoo made an enhancement based on Ku–Chen’s remote user authentication scheme by using smart cards. The scheme has the merits of providing mutual authentication, no verification table, freely choosing password, involving only few hashing operations and parallel session attack resistance. In this paper, we point out security flaws of Yoon–Ryu–Yoo’s protocols against masquerading attack, off-line password guessing attacks and parallel session attack. An improvement to enhance Yoon–Ryu–Yoo’s security scheme is proposed.

A bilateral remote user authentication scheme that preserves user anonymity

AbstractSmart card‐based authentication is one of the most widely used and practical solutions to remote user authentication. Compared to other authentication schemes, our proposed scheme aims to provide more functionalities and to resist well‐known attacks. These crucial merits include (1) a user can freely choose and change his passwords; (2) our scheme provides mutual authentication between a server and a user; (3) it achieves user anonymity; (4) a server and a user can generate authenticated sessions keys. Moreover, our scheme can resist replay attacks, forgery attacks, insider attacks, reflection attacks, and parallel session attacks. Copyright © 2008 John Wiley & Sons, Ltd.

Weaknesses and improvements of a remote user authentication scheme using smart cards

In 2005, Liu et al. proposed an improvement to Chien et al.'s remote user authentication scheme, using smart cards, to prevent parallel session attack. This article, however, will demonstrate that Liu et al.'s scheme is vulnerable to masquerading server attack and has the system's secret key forward secrecy problem. Therefore, an improved scheme with better security strength, by using counters instead of timestamps, is proposed. The proposed scheme does not only achieve their scheme's advantages, but also enhances its security by withstanding the weaknesses just mentioned.

Weakness in Jung et al.'s ID-Based Conference Key Distribution Scheme

In 2000, Xu and Tilborg proposed an ID-based conference key distribution scheme which builds on earlier work of Harn and Yang in the 2-party setting. Recently, Jung et al. have discovered security flaws in the Xu-Tilborg scheme and proposed an improvement of this scheme to fix the security flaws. However, Jung et al.'s improvement introduces another security weakness. We demonstrate this by showing that the improved scheme is vulnerable to a parallel session attack mounted by two colluding adversaries. Further, we recommend changes to the scheme that address this vulnerability.

Further improvement of an efficient password based remote user authentication scheme using smart cards

Recently, Ku-Chen proposed an improvement to Chien et al.'s scheme to prevent from some weaknesses. However, the improved scheme is not only still susceptible to parallel session attack, but also insecure for changing the user's password in password change phase. Accordingly, the current paper presents an enhancement to resolve such problems. As a result, the proposed scheme enables users to change their passwords freely and securely without the help of a remote server, while also providing secure mutual authentication.

Improved efficient remote user authentication scheme using smart cards

In 2000, since Hwang and Li proposed a remote user authentication scheme without password table using smart cards based on ID-based cryptosystems, the related works have been done. In 2002, Chien et al. proposed an efficient and practical remote user authentication scheme providing the many merits. However, Hsu showed that Chien et al.'s scheme is vulnerable to the parallel session attack. This paper proposes an improved scheme to overcome the weakness while maintaining the advantages of Chien et al.'s scheme.

Improvement of Chien et al.'s remote user authentication scheme using smart cards

In 2000, Sun proposed an efficient remote user authentication scheme using smart cards. Later, Chien et al. pointed out that Sun's scheme does not provide the mutual authentication between the user and the server and allow users to freely choose password themselves. Chien et al. further proposed a new efficient and practical solution to solve the problems. However, Hsu showed that Chien et al.'s scheme is vulnerable to the parallel session attack. This paper proposes an improved scheme to overcome the weakness while maintaining the advantages of Chien et al.'s scheme.

Security of two remote user authentication schemes using smart cards

In 2000, Sun proposed an efficient remote user authentication scheme using smart cards (published in IEEE Transactions on Consumer Electronics, vol. 46, no. 4, 2000) Recently, Chien et al. pointed out that Sun's scheme only achieve the unilateral authentication. That is, only the authentication server can authenticate that of the remote user while the use cannot authenticate that of the server. Chien et al. further proposed a new efficient and practical solution to achieve the mutual user authentication (published in Computer & Security, vol. 21, No. 4 2002). This paper, however, will demonstrate that Sun's scheme is vulnerable to the off-line and on-line password guessing attacks and Chien et al.'s scheme is vulnerable to the parallel session attack.

Security of Chien et al.'s remote user authentication scheme using smart cards

In 2000, Sun proposed an efficient remote user authentication scheme using smart cards. Recently, Chien et al. pointed out that Sun's scheme only achieves the unilateral authentication and further proposed a new efficient and practical solution to achieve the mutual user authentication. This paper, however, will demonstrate that Chien et al.'s scheme is vulnerable to the parallel session attack.