Password-based Authentication Scheme Research Articles

Efficient and anonymous password-hardened encryption services

Password-based authentication and encryption schemes are commonly employed to ensure data privacy. Nevertheless, these schemes are vulnerable to brute-force attacks, as user passwords have low-entropy. Password-hardened encryption (PHE) was proposed to combat brute-force attacks by introducing an external crypto service to enforce rate limiting for user requests. However, existing PHE schemes fail to provide user anonymity and need to rely on computationally expensive cryptographic primitives (e.g. zero-knowledge proofs and exponentiations). In this paper, we introduce cross-epoch anonymity in PHE to trade off rate limiting and per-user anonymity. The user requests within the same epoch can be linked by the external crypto service to enforce rate limiting and defend against brute-force attacks, while the requests from different epochs cannot be linked to specific users, ensuring per-user anonymity. Subsequently, we propose an anonymous PHE (APHE) scheme that leverages the trusted execution environment provided by Intel SGX to achieve cross-epoch anonymity. Our scheme achieves both soundness and strong soundness without using zero-knowledge proofs and exponentiations. Sensitive operations are executed within the trusted execution environment, leading to significant performance improvements. The evaluation results demonstrate that our scheme outperforms the state-of-the-art PHE scheme with more than 12/9 times lower latencies for encryption/decryption.

An access control model based on blockchain master-sidechain collaboration

The centralized storage and centralized authorization approach in medical information systems can lead to data tampering and private information privacy leakage, while the traditional access control model has an overly simple authentication approach, relies excessively on trusted third-party organizations for the enforcement of access control policies, and has low efficiency in processing access requests. To address these problems, this paper proposes an access control model based on the collaboration of blockchain main and side chains, AC-BMS. Firstly, a password-based authentication scheme is designed based on doctors’ identity information; then Polygon side chain is designed to enhance the storage scalability of the blockchain; finally, the access node information on the main Ethereum chain is located on the side chain, and resources are obtained by executing Roll-up contracts deployed on the side chain. It is confirmed by simulation experiments in Hyperledger Fabric that the access efficiency and throughput of the blockchain access model proposed in this paper are improved when the number of accesses is multiplied, the average access time is saved by 2–3 s, the latency time is floating and stable, and the security, scalability, and availability are enhanced.

PKAS: A Secure Password-Based Key Agreement Scheme for the Edge Cloud

For the simplicity and feasibility, password-based authentication and key agreement scheme has gradually become a popular way to protect network security. In order to achieve mutual authentication between users and edge cloud servers during data collection, password-based key agreement scheme has attracted much attention from researchers and users. However, security and simplicity are a contradiction, which is one of the biggest difficulties in designing a password-based key agreement scheme. Aimed to provide secure and efficient key agreement schemes for data collecting in edge cloud, we propose an efficient and secure key agreement in this paper. Our proposed scheme is proved by rigorous security proof, and the proposed scheme can be protected from various attacks. By comparing with other similar password-based key agreement schemes, our proposed scheme has lower computational and communication costs and has higher security.

Improvement of a Security Enhanced One-time Mutual Authentication and Key Agreement Scheme

So far, many one-time password based authentication schemes have been proposed; however, none is secure enough. In 2004, W.C.Ku proposed hash-based strong-password based authentication scheme without using smart card that is vulnerable to the password guessing attack, not achieving mutual authentication and key agreement. In this paper, we propose a new improved version of Ku’s scheme that is eliminated these weaknesses.

ElGamal cryptosystem‐based secure authentication system for cloud‐based IoT applications

Life in modern society becomes easier due to the rapid growth of different technologies like real-time analytic, ubiquitous wireless communication, commodity sensors, machine learning and embedded systems. Nowadays, there seems to be a need to merge these technologies in the form of Internet of Things (IoT) so that smart systems can be achieved. On the other hand, cloud computing is a pillar in IoT by which end users get connected through the cloud servers for getting different services. However, to recognise the legitimacy of communicators during communication sessions through insecure channels like the Internet, serious issues in cloud-based IoT applications need to be addressed. Thus, authentication procedure is highly desirable to remove the unapproved access in IoT applications. This study presents an ElGamal cryptosystem and biometric information along with a user's password-based authentication scheme for cloud-based IoT applications refereed as SAS-Cloud. Security of the proposed scheme has been analysed by well popular random oracle model and it is found that SAS-Cloud has the ability to defend all the possible attacks. Furthermore, the performance of SAS-Cloud has been evaluated and it was found that SAS-Cloud has better efficiency than other existing competing ElGamal cryptosystem-based authentication schemes.

Secure Human Authentication with Graphical Passwords

Both alphanumeric and graphical password schemes are vulnerable to the shoulder-surfing attack. Even when authentication schemes are secure against a single shoulder-surfing attack round, they can be easily broken by intersection attacks, using multiple shoulder-surfing attacker records. To this end, in this paper we propose a graphical password-based authentication scheme to provide security against the intersection attack launched by an attacker who may record the user’s screen, mouse clicks and keyboard input with the help of video recording devices and key logging software. We analyze our scheme’s security under various threat models and show its high security guarantees. Various analysis, usability studies and comparison with the previous work highlight our scheme’s practicality and merits.

AuCPace: Efficient verifier-based PAKE protocol tailored for the IIoT

Increasingly connectivity becomes integrated in products and devices that previously operated in a stand-alone setting. This observation holds for many consumer applications in the so-called "Internet of Things" (IoT) as well as for corresponding industry applications (IIoT), such as industrial process sensors. Often the only practicable means for authentication of human users is a password. The security of password-based authentication schemes frequently forms the weakest point of the security infrastructure. In this paper we first explain why a tailored protocol designed for the IIoT use case is considered necessary. The differences between IIoT and the conventional Internet use-cases result in largely modified threats and require special procedures for allowing both, convenient and secure use in the highly constrained industrial setting. Specifically the use of a verifier-based password-authenticated key-exchange (V-PAKE) protocol as a hedge against public-key-infrastructure (PKI) failures is considered important. Availability concerns for the case of failures of (part of) the communication infrastructure makes local storage of access credentials mandatory. The larger threat of physical attacks makes it important to use memory-hard password hashing. This paper presents a corresponding tailored protocol, AuCPace, together with a security proof within the Universal Composability (UC) framework considering fully adaptive adversaries. We also introduce a new security notion of partially augmented PAKE that provides specific performance advantages and makes them suitable for a larger set of IIoT applications. We also present an actual instantiation of our protocol, AuCPace25519, and present performance results on ARM Cortex-M0 and Cortex-M4 microcontrollers. Our implementation realizes new speed-records for PAKE and X25519 Diffie-Hellman for the ARM Cortex M4 architecture.

Design of a Secure Password-Based Authentication Scheme for M2M Networks in IoT Enabled Cyber-Physical Systems

The Internet of Things (IoT) forms a foundation for cyber-physical systems. We propose an efficient and secure authentication scheme for machine-to-machine (M2M) networks in IoT enabled cyber-physical systems. Smart objects and smart devices over CPS are capable of capturing a variety of multimedia contents; interact with each other and also with the physical world in a fully automatic manner without human interference. The proposed scheme allows any pair of entities in an M2M network to mutually authenticate each other and agree on a session key for communicating data in a secure and efficient way. The authentication process does not incorporate the M2M service provider, and hence eliminates the burden of managing the authentication of massive scale devices at the edge of the network. The burden of the authentication process is offloaded and distributed on the gateways under the authority of this M2M service provider. The proposed scheme requires the mobile user to hold only one secret key provided by the M2M service provider, by which, he can roam randomly in the M2M network and authenticate to any of the gateways in the domain. Then, this authenticated gateway allows the mobile user to authenticate with any sensor node in the domain. In the proposed scheme, the authentication process does not rely on any public key cryptographic operations. Authentication is achieved using very few hash invocations and symmetric key encryptions. Therefore, the scheme is suitable for environmental sensors which are limited in resources (computation, storage, and energy). We analyze the security of the proposed scheme using BAN logic, which is widely accepted as a framework for the assessment of authentication protocols and also using ProVerif. We assess the efficiency of the proposed scheme and compare with some recently proposed schemes.

Secure Remote User Mutual Authentication Scheme with Key Agreement for Cloud Environment

Authentication schemes are widely used mechanisms to thwart unauthorized access of resources over insecure networks. Several smart card based password authentication schemes have been proposed in the literature. In this paper, we demonstrate the security limitations of a recently proposed password based authentication scheme, and show that their scheme is still vulnerable to forgery and offline password guessing attacks and it is also unable to provide user anonymity, forward secrecy and mutual authentication. With the intention of fixing the weaknesses of that scheme, we present a secure authentication scheme. We show that the proposed scheme is invulnerable to various attacks together with attacks observed in the analyzed scheme through both rigorous formal and informal security analysis. Furthermore, the security analysis using the widely-accepted Real-Or-Random (ROR) model ensures that the proposed scheme provides the session key (SK) security. Finally, we carry out the performance evaluation of the proposed scheme and other related schemes, and the result favors that the proposed scheme provides better trade-off among security and performance as compared to other existing related schemes.

An improved anonymous authentication scheme for roaming in ubiquitous networks.

With the evolution of communication technology and the exponential increase of mobile devices, the ubiquitous networking allows people to use our data and computing resources anytime and everywhere. However, numerous security concerns and complicated requirements arise as these ubiquitous networks are deployed throughout people’s lives. To meet the challenge, the user authentication schemes in ubiquitous networks should ensure the essential security properties for the preservation of the privacy with low computational cost. In 2017, Chaudhry et al. proposed a password-based authentication scheme for the roaming in ubiquitous networks to enhance the security. Unfortunately, we found that their scheme remains insecure in its protection of the user privacy. In this paper, we prove that Chaudhry et al.’s scheme is vulnerable to the stolen-mobile device and user impersonation attacks, and its drawbacks comprise the absence of the incorrect login-input detection, the incorrectness of the password change phase, and the absence of the revocation provision. Moreover, we suggest a possible way to fix the security flaw in Chaudhry et al’s scheme by using the biometric-based authentication for which the bio-hash is applied in the implementation of a three-factor authentication. We prove the security of the proposed scheme with the random oracle model and formally verify its security properties using a tool named ProVerif, and analyze it in terms of the computational and communication cost. The analysis result shows that the proposed scheme is suitable for resource-constrained ubiquitous environments.

Distributed Multiparty Key Management for Efficient Authentication in the Internet of Things

With the inclusion of mobile devices and ubiquitous connectivity of smart devices in Internet of Things, secure key management is mandatory to ensure privacy for information exchange. In this regard, the multiparty key establishment schemes achieve better security strength by taking shared parameters from neighboring member nodes to calculate the key. The similar multiparty mechanism can be adopted among other hierarchical nodes, including head node, server and gateway node. Moreover, session keys can also be set up in a similar manner. The main problem in multiparty password-based authentication schemes is the computation of extensively hard problem that limits it to three parties and N-party is quite more complex or infeasible. This paper presents a novel distributed multiparty keying scheme where chaotic maps are used to provide one-way hashing and Chebyshev polynomial are used for establishing a common multiparty key. In this paper, Phase-I covers keying among trusted server and group heads and Phase-II elaborates the key establishment among smart devices and their group heads. The scheme is verified through the formal specification and security analysis using Rubin Logic for inter-group key establishment scenario. We have validated the intra-group and inter-group key establishment by doing extensive simulations in NS 2.35. Moreover, a test bed is setup for group head to server level authentication and key establishment. Results prove the supremacy of our scheme as compared with preliminaries in terms of computation cost, communication cost, and resilience.

Breaking Three Remote user Authentication Systems for Mobile Devices

Smart-card-based user authentication is a significant security mechanism that allows remote users to be granted access to services and resources in distributed computing environments. In this paper, we review three password-based authentication schemes with smart cards proposed by Mishra et al., in JISA 2015, Wu et al. in SCN 2015 and Moon et al. in IJNS 2017, respectively. We demonstrate that: (1) Despite being armed with a formal security proof in all schemes, Mishra et al.’s scheme actually cannot achieve the claimed feature of user anonymity and is vulnerable to a new insider attack scenario; and (2) Wu et al.’s scheme remains being susceptible to de-synchronization attack as they stated to overcome the weaknesses of Kumar et al.’s scheme. (3) Moon et al.’s scheme cannot achieve user anonymity and is susceptible to a novel impersonation attack. Furthermore, with the cryptanalysis of these three schemes and our previous protocol design and analysis experience, we figure out two principles to design more robust smart-card-based user authentication schemes. The proposed principles would be helpful to protocol designers for proposing schemes with desirable user friendliness and security.

Press touch code: A finger press based screen size independent authentication scheme for smart devices.

Due to recent advancements and appealing applications, the purchase rate of smart devices is increasing at a higher rate. Parallely, the security related threats and attacks are also increasing at a greater ratio on these devices. As a result, a considerable number of attacks have been noted in the recent past. To resist these attacks, many password-based authentication schemes are proposed. However, most of these schemes are not screen size independent; whereas, smart devices come in different sizes. Specifically, they are not suitable for miniature smart devices due to the small screen size and/or lack of full sized keyboards. In this paper, we propose a new screen size independent password-based authentication scheme, which also offers an affordable defense against shoulder surfing, brute force, and smudge attacks. In the proposed scheme, the Press Touch (PT)—a.k.a., Force Touch in Apple’s MacBook, Apple Watch, ZTE’s Axon 7 phone; 3D Touch in iPhone 6 and 7; and so on—is transformed into a new type of code, named Press Touch Code (PTC). We design and implement three variants of it, namely mono-PTC, multi-PTC, and multi-PTC with Grid, on the Android Operating System. An in-lab experiment and a comprehensive survey have been conducted on 105 participants to demonstrate the effectiveness of the proposed scheme.

Efficient and secure two-factor dynamic ID-based password authentication scheme with provable security

ABSTRACTPassword-based remote user authentication schemes using smart cards are designed to ensure that only a user who possesses both the smart card and the corresponding password can gain access to the remote servers. Despite many research efforts, it remains a challenging task to design a secure password-based authentication scheme with user anonymity. The author uses Kumari et al.’s scheme as the case study. Their scheme uses non-public key primitives. The author first presents the cryptanalysis of Kumari et al.’s scheme in which he shows that their scheme is vulnerable to user impersonation attack, and does not provide forward secrecy and user anonymity. Using the case study, he has identified that public-key techniques are indispensable to construct a two-factor authentication scheme with security attributes, such as user anonymity, unlinkability and forward secrecy under the nontamper resistance assumption of the smart card. The author proposes a password-based authentication scheme using elliptic curve cryptography. Through the informal and formal security analysis, he shows that proposed scheme is secure against various known attacks, including the attacks found in Kumari’s scheme. Furthermore, he verifies the correctness of mutual authentication using the BAN logic.

A Self-Verifiable Password Based Authentication Scheme for Multi-Server Architecture Using Smart Card

In network based services, remote user authentication has become an important and challenging part to ensure authorized access of resource. The traditional two party architectures are not enough to...

A password based authentication scheme for wireless multimedia systems

In this digital era, where Internet of Things (IoT) is increasing day by day, use of resource constrained devices is also increasing. Indeed, the features such as low cost, less maintenance, more adaptive to hostile environment, etc. make the wireless multimedia devices to be the best choice as the resource constrained devices. For the security, the end user device requires to establish the session key with the server before transferring the data. Mobile is one of the device having more and more usage as wireless multimedia device in recent years. In 2013, Li et al. proposed an efficient scheme for the wireless mobile communications and claimed it to be secure against various attacks. Recently, Shen et al. claimed that the scheme of Li et al. is still vulnerable to the privileged insider attack, the stolen verifier attack and finally proposed a scheme to withstand the mentioned and other attacks. However, in this paper we claim that the scheme of Shen et al. is still susceptible to the user anonymity, the session specific temporary information attack and the replay attack. In addition, Shen et al.’s scheme requires more time due to many operations. Further, we propose an efficient scheme that is secure against various known attacks and due to reduced time complexity our scheme is a preferred choice for the wireless mobile networks and hence for wireless multimedia systems.

Defining Security in Primary Key Infrastructures

Smart card authentication is a methodology used for security across various network infrastructures that demand multiple factors in user authentication. The present existence of smart card authentication thrives in our mobile and payment card networks; but can be applied to the average organization’s local area network (LAN) and remote connectivity mediums for a baseline of multiple factor authentication. Moreover, this paper looks into implementing network-wide smart card authentication on enterprise systems in an attempt to alleviate those systems of passwordbased authentication schemes. Much emphasis and research will be provided on the detailed characteristics of smart card authentication and its implementation on modern network appliances, key distribution servers and endpoint configurations.

VAP code: A secure graphical password for smart devices

In parallel to the increasing purchase rate of the smart devices, attacks on these devices are also increasing in an alarming rate. To prevent these attacks, many password-based authentication schemes are proposed. Among them, graphical password schemes are preferred on these devices due to their limited screen size and a lack of full sized keyboard. Again, existing graphical password schemes are susceptible to various attacks, among which shoulder surfing, smudge attack, and brute force attack are the most prominent. Hence, in this paper, we propose Vibration-And-Pattern (VAP) code, a new graphical password scheme that is resilient against these three major attacks. To evaluate the usability of our proposed scheme, a usability study has been conducted on 122 participants of various age groups from different demographics.

CARP: CAPTCHA as A Graphical Password Based Authentication Scheme

CARP: CAPTCHA as A Graphical Password Based Authentication Scheme

A mobile authentication system resists to shoulder-surfing attacks

Traditional password-based authentication schemes are vulnerable to shoulder-surfing attacks. Attackers may steal user's sensitive information through direct observation, particularly at crowded pl...