Password Authentication Scheme Research Articles

A Note on “Design of a Password Authentication and Key Agreement Scheme to Access e-Healthcare Services”

A Note on “Design of a Password Authentication and Key Agreement Scheme to Access e-Healthcare Services”

Quantum2FA: Efficient Quantum-Resistant Two-Factor Authentication Scheme for Mobile Devices

Smart-card based password authentication has been the most widely used two-factor authentication (2FA) mechanism for security-critical applications (e.g., e-Health, smart grid and e-Commerce) in the past decades, and it is likely to hold its status in the foreseeable future. Hundreds of this type of 2FA schemes have been proposed, yet to our knowledge, most of them are built on the intractability of conventional hard problems (e.g., discrete logarithm problems and integer factoring problems) which are no longer hard in the quantum era. With the recent advancements in quantum computing, the design of secure and efficient smart-card based password authentication schemes against quantum attacks is becoming increasingly urgent. However, it is not as simple as it seems, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">how to design such a quantum-resistant 2FA scheme is challenging due to the demanding security requirements and the resource-constrained nature of mobile devices</i> . In this work, we take the first step towards this issue by proposing Quantum2FA, a practical quantum-resistant smart-card-based password authentication scheme that employs Alkim <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> ’s lattice-based key exchange and Wang-Wang’s “fuzzy-verifier + honeywords” technique (IEEE TDSC’18). Particularly, Quantum2FA can thwart the newly revealed key-reuse attack (ACISP’18, CT-RSA’19) against lattice-based key exchange schemes in two aspects: signal leakage attacks and key mismatch attacks. Specifically, it restricts the necessary conditions (i.e., the attacker must be the initiator of the key exchange) for an adversary to analyze the signal; It introduces honeywords to detect the key mismatches between the smart card and the server, and thus smart card loss attack can be thwarted. We formally prove the security of Quantum2FA under the random oracle model and demonstrate its efficiency through experiments on a 32 MHz 8-bit AVR Embedded Processor. Comparison results show that Quantum2FA is not only more secure but also offers better computation efficiency than the state-of-the-art conventional 2FA schemes.

An efficient two-factor authentication scheme based on negative databases: Experiments and extensions

With the rapid development of network communication technology, identity authentication based on smart cards is one of the most common two-factor authentication schemes. In some real-world applications, timeliness is another challenge besides security and privacy because of the frequent logon and logoff or data updating. Presently, two-factor authentication schemes based on elliptic curve cryptography (ECC) are efficient. They are based on asymmetric encryption algorithms. But the time efficiency can be improved by hash-based methods, such as Negative databases (NDB) inspired by the artificial immune system. A one-time password authentication scheme based on NDBs is efficient, but it does not achieve the functions of mutual authentication and password changing, nor resists stolen-verifier attacks.In this paper, we propose an efficient two-factor authentication scheme based on NDBs. With this scheme, the password changing function is achieved, and the properties of uncertain form of negative databases can reduce the frequency of data updating. As the proposed scheme is a hash function based one, it has fewer calculation steps and higher time efficiency, compared with the authentication schemes based on asymmetric encryption algorithms such as ECC. This scheme also resists the majority of attacking behaviours, such as password-guessing attacks and man-in-the-middle attacks. Experimental results verify the time efficiency of this proposed scheme, and its security is analysed as well.

A Provably Secure and Efficient Remote Password Authentication Scheme Using Smart Cards

Communication technology has advanced dramatically amid the 21^st century, increasing the security risk in safeguarding sensitive information. The remote password authentication (RPA) scheme is the simplest cryptosystem that serves as the first line of defence against unauthorised entity attacks. Although the literature contains numerous RPA schemes, to the best of the authors’ knowledge, only few schemes based on the integer factorisation problem (IFP) and the discrete logarithm problem (DLP) that provided a provision for session key agreement to ensure proper mutual authentication. Furthermore, none of the previous schemes provided formal security proof using the random oracle model. Therefore, this study proposed an improved RPA scheme with session key establishment between user and server. The design of the proposed RPA scheme is based on the widely established Dolev-Yao adversary model. Moreover, as the main contribution, a novel formal security analysis based on formal definitions of IFP and DLP under the random oracle model was presented. The proposed scheme's performance was compared to that of other similar competitive schemes in terms of the transmission/computational cost and time complexity. The findings revealed that the proposed scheme required higher memory storage costs in smart cards. Nonetheless, the proposed scheme is more efficient regarding the transmission cost of login and response messages and the total time complexity compared to other scheme of similar security attributes. Overall, the proposed scheme outperformed the other RPA schemes based on IFP and DLP. Finally, the potential application of converting the RPA scheme to a user identification (UI) scheme is considered for future work. Since RPA and UI schemes are similar, the proposed approach can be expanded to develop a provably secure and efficient UI scheme based on IFP and DLP.

Password authentication scheme based on smart card and QR code

As a hopeful computing paradigm, cloud services are obtainable to end users based on pay-as-you-go service. Security is represented one of the vital issues for the extended adoption of cloud computing, with the object of accessing several cloud service providers, applications, and services by using anonymity features to authenticate the user. We present a good authentication scheme based on quick response (QR) code and smart card. Furthermore, our proposed scheme has several crucial merits such as key management, mutual authentication, one-time password, user anonymity, freely chosen password, secure password changes, and revocation by using QR code. The security of proposed scheme depends on crypto-hash function, QR-code validation, and smart card. Moreover, we view that our proposed scheme can resist numerous malicious attacks and are more appropriate for practical applications than other previous works. The proposed scheme has proved as a strong mutual authentication based on burrows-abadi-needham (BAN) logic and security analysis. Furthermore, our proposed scheme has good results compared with related work.

A New Remote Fuzzy User Password Authentication Scheme Using Sub-tree for Cloud Computing

Recent advancements in internet technology and the infrastructure have attracted more people and organizations to do everything online. Internet technologies have provided amazing and smooth ease for electronic sales and purchases. However, many people have refused to use these internet technologies in electronic purchases because of unstable and insecure forms. New hacking techniques and new types of attacks have been tackled to make these internet technologies better and safer. Smartcard-based password authentication schemes have been the mainstream in recent years, featuring their highly lightweight, easy-to-use equipment and lowcost apps. Various secure and faster authentication schemes have been proposed in the literature. However, most of the existing authentication schemes have found vulnerable to recent attacks and have security flaws. This paper provides and efficient way for authentication using the partial discrete logarithm and sub-tree structure. The proposed scheme has seen effective and more useful in cloud computing environment. The analysis based on the security and the computational cost shows that the proposed authentication scheme proves to be more secure and efficient compared to other protocols that serve the same purposes.

State space classification of Markov password – an alphanumeric password authentication scheme for secure communication in cloud computing

PurposePurpose of this study is to classify the states of Markov Chain for the implementation of Markov Password for effective security. Password confirmation is more often required in all authentication process, as the usage of computing facilities and electronic devices have developed hugely to access networks. Over the years with the increase in numerous Web developments and internet applications, each platform needs ID and password validation for individual users.Design/methodology/approachIn the technological development of cloud computing, in recent times, it is facing security issues. Data theft, data security, denial of service, patch management, encryption management, key management, storage security and authentication are some of the issues and challenges in cloud computing. Validation in user login authentications is generally processed and executed by password. To authenticate universally, alphanumeric passwords are used. One of the promising proposed methodologies in this type of password authentication is Markov password. Markov passwords – a rule-based password formation are created or generated by using Markov chain. Representation of Markov password formation can be done by state space diagram or transition probability matrix. State space classification of Markov chain is one of the basic and significant properties. The objective of this paper is to classify the states of Markov chain to support the practice of this type of password in the direction of effective authentication for secure communication in cloud computing. Conversion of some sample obvious password into Markov password and comparative analysis on their strength is also presented in this paper. Analysis on strength of obvious password of length eight has shown range of 7%–9% although the converted Markov password has shown more than 82%. As an effective methodology, this password authentication can be implemented in cloud portal and password login validation process.FindingsThe objective of this paper is to classify the states of Markov chain to support the practice of this type of password in the direction of effective authentication for secure communication in cloud computing. Conversion of some sample obvious password into Markov password and comparative analysis on their strength is also presented in this paper.Originality/valueValidation in user login authentications is generally processed and executed by password. To authenticate universally, alphanumeric passwords are used. One of the promising proposed methodologies in this type of password authentication is Markov password.

Enhanced bitcoin with two-factor authentication

Bitcoin transactions rely on digital signatures to prove the ownership of bitcoin. The private signing key of the bitcoin owner is the key component to enable a bitcoin transaction. If the signing key of a bitcoin is stolen, the theft who possesses the key can make a transaction of the bitcoin. In this paper, based on the distance-based encryption (DBE), we propose an enhanced version of bitcoin in order to protect the signing key. Our approach is based on our two-factor authentication, where the signing key cannot be retrieved without being identified via the password and biometric authentication scheme, and the user is only required to enter his password and fingerprint (or other biometric information such as a factual image) to retrieve the key. By doing this, we can effectively improve the bitcoin security and provide stronger authentication. An attractive feature of our scheme is that one of encryption schemes is asymmetric, in the sense that the decryption key (biometric information) is not stored in the device. We also provide the security model and proof to justify the security of our scheme.

Performance of Orthogonal Frequency Division Multiplexing Based Advanced Encryption Standard

Currently, there are a lot of secure communication schemes have been proposed to hide secret contents. In this work, one of the methods deploying encryption to cipher data is represented. The primary object of this project is applying Advanced Encryption Standard (AES) in communications based Orthogonal Frequency Division Multiplexing (OFDM). This article discusses the security of the method encrypting directly QAM symbols instead of input bit-stream. This leads to improving the security of transmitting data by utilization of authentication key between the mobile and base station. The archived results demonstrate that the performance of the AES-OFDM system is completely acceptable to compare with the criteria for 4G.&#x0D; Keywords:&#x0D; Orthogonal Frequency Division Multiplexing (OFDM), Advanced Encryption Standard (AES), Quadrature Amplitude Modulation (QAM), Authentication Key, Cellular Network, Encryption, Physical Layer, 4G, LTE.&#x0D; References&#x0D; [1] M.A. Jessen, “Wireless communication security: Physical-Layer techniques exploiting radio and propagation characteristics”, Wireless Information Technology and Systems (ICWITS), IEEE International Conference, 2012.[2] M. Kim, M. Lee, S. Kim, D. Won, “Weakness and Improvements of a One-time Password Authentication Scheme”, International Journal of Future Generation Communication and Networking, 2009.&#x0D; [3] Alabaichi, Ashwaq, Salih, Adnan, “Enhance security of advance encryption standard algorithm based on key-dependent S-box”, 2015, pp. 44-53.&#x0D; [4] S. Xiao, W. Gong, D. Towsley, “Secure Wireless Communication with Dynamic secrets”, IEEE INFOCOM, 2010.[5] N.U. Rehman, L. Zhang, M.Z. Hammad, “ICI cancellation in OFDM system by frequency offset reduction”, Journal of Information Engineering and Applications, 2014.&#x0D; [6] Nikita Agrawal, Neelesh Gupta, “Security of OFDM through Steganography”, International Journal of Computer Applications 121(20) (2015) 41-43.&#x0D; [7] A. Al-Dweik, M. Mirahmadi, A. Sharmi, Z. Ding, R. Hamila, “Joint Secured and Robust technique for OFDM systems”, Western University, Canada, IEEE ICC 2013.&#x0D; [8] G.R. Tsouri, D. Wulich, “Securing OFDM over Wireless Time-varying channel using subcarrier overloading with Joint signal constellations”, Hindawi Publishing Corporation, EURASIP Journal on Wireless Communication and Networking, 2009.&#x0D; [9] D. Rajaveerappa, A. Almarimi, A., “RSA/Shift secured IFFT/FFT based OFDM wireless system,” Fifth International Conference on Information Assurance and Security, 2009.&#x0D; [10] M. Hilmey, S. Elhalafwy, M. Zein Eldin, “Efficient transmission of chaotic and AES encrypted images with OFDM over an AWGN channel”, 2009 International Conference on Computer Engineering &amp; Systems, Cairo, 2009, pp. 353-358.&#x0D; [11] B.V. Naik, N.L.K. Sai, C.M. Kumar, “Efficient transmission of encrypted images with OFDM system”, 2017 IEEE International Conference on Power, Control, Signals and Instrumentation Engineering (ICPCSI), Chennai, 2017, pp. 2383-2388.&#x0D; [12] S.M.S. Eldin, “Optimized OFDM Transmission of Encrypted Image Over Fading Channel”, An International Journal on Sensing and Imaging 15(1) (2014), pp. 1-14.&#x0D; [13] C. Akbar, H. Mahmood, Q. Minhas, I. Mustafa, “Secure AES OFDM with channel reciprocity exploitation through relative calibration”, 2016 International Conference on Open Source Systems &amp; Technologies (ICOSST), Lahore, 2016, pp. 54-61.&#x0D; [14] Y. Liang, J. Ren, T. Li, “Secure OFDM System Design and Capacity Analysis Under Disguised Jamming”, in IEEE Transactions on Information Forensics and Security 15 (2020) 738-752.&#x0D; [15] Westlund, B. Harold, “NIST reports measurable success of Advanced Encryption Standard”,Journal of Research of the National Institute of Standards and Technology, 2002.&#x0D; [16] B. Schneier, J. Kelsey, D. Whiting, D. Wagner, C. Hall, N. Ferguson, Performance Comparison of the AES Submissions, Proceedings of the Second AES Candidate Conference, 1999.&#x0D; [17] S. He, A. Tang, H. Zhang, “A high-performance Implementation of OFDM-MIMO base-band in wireless video system”, Information Technology Journal 13 (2014), pp. 1678-1685.

Cryptanalysis and Remedy Scheme on Qiu et al.'s Enhanced Password Authentication Scheme for SIP

Cryptanalysis and Remedy Scheme on Qiu et al.'s Enhanced Password Authentication Scheme for SIP

Multi-level Graphical Password Authentication Scheme for Cloud (MGPASC)

The usage and management of information technology resources and services are revolutionized with the arrival of Cloud Computing. But, the revolution always comes with problems. Authentication is one such problem. Especially for Graphical Password Authentication System, there is a threat of shoulder surfing attack. This research presents a multi-level graphical password authentication mechanism by extending an existing method. UGPSCCCT (User guided Graphical Password Scheme for Cloud using Caesar Cipher Technique) is the existing method and this method is extended in this paper such that another level of security is added. The user credentials in this method are transmitted to the server in encryption format. A key is generated for every login to encrypt user details. The analysis of the proposed method is done by calculating the computational cost and communication cost of the proposed method.

Design of a Password Authentication and Key Agreement Scheme to Access e-Healthcare Services

The telecare medical information system (TMIS) offers remote healthcare services to the patients at their doorstep. Including this serenity, it is compulsory to preserve privacy and to give guaranty to the patients for secured TMIS communication. Authentication protocols are usually exploited to ensure privacy and protect communication between patients and remote assistance. Currently, we observe the inaccuracy of an authentication protocol for TMIS. The scheme is recently proposed by Qiu et al. to realize healthcare services. We find that their protocol is vulnerable to offline password guessing, replay, and anonymity violation attacks. To avoid these weaknesses, we have developed an improved biometric-based protocol. Our proposed protocol is capable to prevent the said attacks. We validate the security of our proposed protocol using Burrows–Abadi–Needham logic. We compare the performance of the proposed protocol with the preceding protocols and conclude that the proposed protocol is more secure and efficient as compared to its former counterparts.

A Practical and Secure Hash Function-Based Password Authentication Scheme

In this study, we propose a practical and secure hash function-based password authentication scheme using smart cards. Our proposed scheme offers some advantages and interesting features. Firstly, the scheme does not require a verification table and is secure against the replay attacks, an attack that most of the existing schemes suffer. Secondly, any user of the scheme be allowed to change his or her account’s password efficiently. Thirdly, the time complexity for each algorithm in the proposed scheme are relatively low and minimal compared to some existing well-known password authentication schemes.

Fingerprint Protected Password Authentication Protocol

With the rapid development of industrial Internet of things (IIOT), a variety of cloud services have been deployed to store and process the big data of IIOT. The traditional password only authentication is unable to meet the needs of security situation in IIOT. Therefore, a lot of mobile phone assisted password authentication schemes have been proposed. However, in existing schemes, the secret information is required to be stored in the user’s mobile phone. Once the phone is lost, the secret information may be obtained by the opponent, which will bring irreparable loss to the user. To address the above problems, we propose a fingerprint protected password authentication scheme which has no need to store the secret parameter in the mobile phone. When a user logs in, he uses his mobile phone to generate the private key which is used to decrypt the encrypted text generated during the registration phase. The process of generating the private key needs to enter the password and the fingerprint. When the computer interacts with the mobile phone, the user’s password will be blinded so that it can protect the user’s password from adversary’s attacks. Theoretical analysis and experimental results show that our scheme improves the security of the user’s secret. Meanwhile, our scheme can resist the opponent’s dictionary attacks, replay attacks, and phishing attack. Our scheme can reduce the storage pressure of the mobile phone and is easy to deploy.

Revisiting Anonymous Two-Factor Authentication Schemes for IoT-Enabled Devices in Cloud Computing Environments

Investigating the security pitfalls of cryptographic protocols is crucial to understand how to improve security. At ICCCS’17, Wu and Xu proposed an efficient smart-card-based password authentication scheme for cloud computing environments to cope with the vulnerabilities in Jiang et al.’s scheme. However, we reveal that Wu-Xu’s scheme actually is subject to various security flaws, such as offline password guessing attack and replay attack. Besides security, user friendly is also another great concern. In 2017, Roy et al. found that in most previous two-factor schemes a user has to manage different credentials for different services and further suggested a user-friendly scheme which is claimed to be suitable for multiserver architecture and robust against various attacks. In this work, we show that Roy et al.’s scheme fails to achieve truly two-factor security and shows poor scalability. At FGCS’18, Amin et al. pointed out that most of existing two-factor schemes are either insecure or inefficient for mobile devices due to the use of public-key techniques and thus suggested an improved protocol by using only light-weight symmetric key techniques. Almost at the same time, Wei et al. also observed this issue and proposed a new scheme based on symmetric key techniques with formal security proofs in the random oracle model. Nevertheless, we point out that both Amin et al.’s and Wei et al.’s schemes cannot achieve the claimed security goals (including the most crucial goal of “truly two-factor security”). Our results invalidate any use of the scrutinized schemes for cloud computing environments.

An Improved Mutual Authentication Scheme with Smart Cards and Password under Trusted Computing

In the traditional smart card-based password authentication schemes, the authentication is only applied to verify both of server and user, but not applied to verify the platform. Recently, Yang, Ma, and Jiang proposed a mutual authentication scheme with smart cards and password under trusted computing. Their scheme was designed to authenticate the platform. They claimed that their scheme could withstand most of the possible attacks, such as secure session key agreement, user identity anonymity, password free changing, and platform certification updating. However, we will show that their scheme is vulnerable to on-line guessing password attack with smart card, and man-in-the-middle attack. In this article, we also propose an improved Yang-Ma-Jiang’s mutual authentication scheme to withstand the vulnerability in their scheme.

Privacy Preserving User Authentication Scheme Based on Smart Card

One of the most commonly used user authentication mechanisms is two factor authentication based on smart card and password. The core feature of the scheme is to enforce that the user must have the smart card and know the password in order to gain access to server. Recently, Liu et al. proposed a smart card based password authentication scheme and argued that it is secure against insider attack, replay attack and man in the middle attack and provides perfect forward secrecy. In this paper, we show security weaknesses in Liu et al.’s scheme focused on off-line password guessing attack and masquerading attack and it does not provide perfect forward secrecy and anonymity. Accordingly, we propose a privacy preserving user authentication scheme based on smart card, denoted as PUAS, to remedy these security weaknesses and to provide anonymity and perfect forward secrecy. PUAS is more secure with a bit of computational overhead to support several positive properties in security and privacy.

The Weakness of Moon et al.’s Password Authentication Scheme

Using smart cards make remote transactions easier for users in Internet. It’s important to identity the legal users to have the access right to obtain the resources. In 2017, Liu et al. proposed an efficient and secure smart card based password authentication scheme. Recently, Moon et al. pointed some weaknesses of Liu et al.’s scheme. They also proposed a password authentication scheme to overcome Liu et al.’s weaknesses. They claim that their scheme is more secure and practical as a remote user authentication scheme. However, we find that some weaknesses of Moon et al.'s scheme. In this article, we will show that Moon et al.’s scheme is vulnerable to the guessing identity and impersonation attacks.

Lightweight one‐time password authentication scheme based on radio‐frequency fingerprinting

The energy-constrained devices such as the mobile terminals and nodes of the Internet of Things make lightweight security schemes an urgent need. The traditional identity authentication techniques can provide protection for the user's privacy and information to a certain extent, but they suffer from heavy cost. Non-cryptographic authentication mechanisms based on the physical layer characteristics are new techniques, which have a higher security level. The recognition technique of radio transmitter based on radio-frequency fingerprint ( RFF ) is one of the non-cryptographic authentication techniques. The authors propose a lightweight one-time password (OTP) authentication scheme based on RFF (RFF-OTP), which is a novel cross-layer secure authentication scheme and can provide mutual authentication between the mobile terminal and server, by combining RFF recognition algorithm with a hash encryption algorithm. By theoretical analysis and Syverson and van Oorschot logic verification, they prove that the RFF-OTP scheme is simple, efficient, flexible and independent of trusted-party while it also can resist the cloning attack and satisfy the anonymity compared with the OTP authentication scheme. Besides, it only requires the password to log into the system in the authors' scheme in comparison to the OTP scheme that needs both ID and password for the same purpose.

Secure Remote User Mutual Authentication Scheme with Key Agreement for Cloud Environment

Authentication schemes are widely used mechanisms to thwart unauthorized access of resources over insecure networks. Several smart card based password authentication schemes have been proposed in the literature. In this paper, we demonstrate the security limitations of a recently proposed password based authentication scheme, and show that their scheme is still vulnerable to forgery and offline password guessing attacks and it is also unable to provide user anonymity, forward secrecy and mutual authentication. With the intention of fixing the weaknesses of that scheme, we present a secure authentication scheme. We show that the proposed scheme is invulnerable to various attacks together with attacks observed in the analyzed scheme through both rigorous formal and informal security analysis. Furthermore, the security analysis using the widely-accepted Real-Or-Random (ROR) model ensures that the proposed scheme provides the session key (SK) security. Finally, we carry out the performance evaluation of the proposed scheme and other related schemes, and the result favors that the proposed scheme provides better trade-off among security and performance as compared to other existing related schemes.