Password-based Remote User Authentication Scheme Research Articles

Cryptanalysis of Three Password-Based Remote User Authentication Schemes with Non-Tamper-Resistant Smart Card

Remote user authentication is the first step to guarantee the security of online services. Online services grow rapidly and numerous remote user authentication schemes were proposed with high capability and efficiency. Recently, there are three new improved remote user authentication schemes which claim to be resistant to various attacks. Unfortunately, according to our analysis, these schemes all fail to achieve some critical security goals. This paper demonstrates that they all suffer from offline dictionary attack or fail to achieve forward secrecy and user anonymity. It is worth mentioning that we divide offline dictionary attacks into two categories: (1) the ones using the verification from smart cards and (2) the ones using the verification from the open channel. The second is more complicated and intractable than the first type. Such distinction benefits the exploration of better design principles. We also discuss some practical solutions to the two kinds of attacks, respectively. Furthermore, we proposed a reference model to deal with the first kind of attack and proved its effectiveness by taking one of our cryptanalysis schemes as an example.

Advanced dynamic identity-based authentication protocol using smart card

Instances of password theft are rapidly growing in number. This is sufficient to shake the confidence of the customer in e-commerce. Authenticating the user on insecure communication channel like internet is an essential primitive and is target of various attacks. Therefore, remote user authentication is one of the most essential requirement for ensuring secure communication in today's ubiquitous computing environment. Smart card-based authentication provide multi-factor authentication for accessing web-based applications. In this paper, an efficient password-based remote user authentication scheme using smart card is proposed. The proposed scheme is an improvement of the scheme proposed by Hsiang and Shih in 2009. Proposed scheme is secure against all well known security attacks and has a low computational cost. The security of the proposed protocol depends upon two security parameters which makes difficult for an attacker to launch attacks on the proposed scheme. Moreover, the user and the server agree on the common session key. Afterwards, all the subsequent messages between the user and the server are encrypted with this session key. Therefore, the attacker cannot get any meaningful authentication information from eavesdropping even in insecure communication channel.

A Secure User Anonymity and Authentication Scheme Using AVISPA for Telecare Medical Information Systems

Telecare medicine information systems (TMIS) have been known as an effective mechanism to increase quality and security of healthcare services. In other to the protection of patient privacy, several authentication schemes have been proposed in TMIS, however, most of them have a security problems. Recently, Das proposed a secure and robust password-based remote user authentication scheme for the integrated EPR information system. However, in this paper, we show that his scheme have some security flaws. Then, we shall propose a secure authentication scheme to overcome their weaknesses. We prove the proposed scheme with random oracle and also use the BAN logic to prove the correctness of the proposed scheme. Furthermore, we simulate our scheme for the formal security analysis using the AVISPA (Automated Validation of Internet Security Protocols and Applications) tool.

Cryptanalysis and improvement of a password-based user authentication scheme for the integrated EPR information system

Recently, Wu et al. proposed a password-based remote user authentication scheme for the integrated Electronic Patient Record (EPR) information system to achieve mutual authentication and session key agreement over the Internet. They claimed that the scheme resists various attacks and offers lower computation cost, data integrity, confidentiality and authenticity. However, we observed that the scheme cannot withstand lost smartcard/off-line password guessing, privileged-insider and known session-specific temporary information attacks, and lacks the requirements of lost smartcard revocation and users’ anonymity. Besides, the password change phase is inconvenient to use because a user cannot change his password independently. Thus, we proposed a new password-based user authentication scheme for the integrated EPR information system that would be able to resist detected security flaws of Wu et al.’s scheme.

A secure and robust password-based remote user authentication scheme using smart cards for the integrated EPR information system.

An integrated EPR (Electronic Patient Record) information system of all the patients provides the medical institutions and the academia with most of the patients' information in details for them to make corrective decisions and clinical decisions in order to maintain and analyze patients' health. In such system, the illegal access must be restricted and the information from theft during transmission over the insecure Internet must be prevented. Lee et al. proposed an efficient password-based remote user authentication scheme using smart card for the integrated EPR information system. Their scheme is very efficient due to usage of one-way hash function and bitwise exclusive-or (XOR) operations. However, in this paper, we show that though their scheme is very efficient, their scheme has three security weaknesses such as (1) it has design flaws in password change phase, (2) it fails to protect privileged insider attack and (3) it lacks the formal security verification. We also find that another recently proposed Wen's scheme has the same security drawbacks as in Lee at al.'s scheme. In order to remedy these security weaknesses found in Lee et al.'s scheme and Wen's scheme, we propose a secure and efficient password-based remote user authentication scheme using smart cards for the integrated EPR information system. We show that our scheme is also efficient as compared to Lee et al.'s scheme and Wen's scheme as our scheme only uses one-way hash function and bitwise exclusive-or (XOR) operations. Through the security analysis, we show that our scheme is secure against possible known attacks. Furthermore, we simulate our scheme for the formal security verification using the widely-accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool and show that our scheme is secure against passive and active attacks.

Attacks on He et al.'s password-based remote user authentication scheme without smart cards

Attacks on He et al.'s password-based remote user authentication scheme without smart cards

A robust and effective smart-card-based remote user authentication mechanism using hash function.

In a remote user authentication scheme, a remote server verifies whether a login user is genuine and trustworthy, and also for mutual authentication purpose a login user validates whether the remote server is genuine and trustworthy. Several remote user authentication schemes using the password, the biometrics, and the smart card have been proposed in the literature. However, most schemes proposed in the literature are either computationally expensive or insecure against several known attacks. In this paper, we aim to propose a new robust and effective password-based remote user authentication scheme using smart card. Our scheme is efficient, because our scheme uses only efficient one-way hash function and bitwise XOR operations. Through the rigorous informal and formal security analysis, we show that our scheme is secure against possible known attacks. We perform the simulation for the formal security analysis using the widely accepted AVISPA (Automated Validation Internet Security Protocols and Applications) tool to ensure that our scheme is secure against passive and active attacks. Furthermore, our scheme supports efficiently the password change phase always locally without contacting the remote server and correctly. In addition, our scheme performs significantly better than other existing schemes in terms of communication, computational overheads, security, and features provided by our scheme.

Formal security analysis and verification of a password-based user authentication scheme for hierarchical wireless sensor networks

In 2012, Das et al. proposed a new password-based remote user authentication scheme in hierarchical wireless sensor networks (HWSNs). The proposed scheme achieves better security and efficiency as compared to those for other existing password-based schemes proposed in HWSNs. In this paper, we first analyse Das et al.’s scheme for formal security under the random oracle models to show their scheme is secure. Furthermore, we simulate this proposed scheme for formal security verification using the widely-accepted automated validation of internet security protocols and applications (AVISPA) tool. Using the AVISPA model checkers, we show that Das et al.’s scheme is also secure against possible passive and active attacks, including the replay and man-in-the-middle attacks. In addition, we also simulate the existing password-based schemes for formal security verification using AVISPA tool and provide a comparison among Das et al.’s scheme and other schemes. It is shown that Das et al.’s scheme outperforms other existing approaches.

An anonymous multi-server authenticated key agreement scheme based on trust computing using smart cards and biometrics

Password-based remote user authentication schemes are widely investigated, with recent research increasingly combining a user’s biometrics with a password to design a remote user authentication scheme that enhances the level of the security. However, these authentication schemes are designed for a single server environment and result in users needing to register many times when they want to access different application servers. To solve this problem, in this paper we propose an anonymous multi-server authenticating key agreement scheme based on trust computing using smart cards, password, and biometrics. Our scheme not only supports multi-server environments but also achieves many security requirements. In addition, our scheme is a lightweight authentication scheme which only uses the nonce and a hash function. From the subsequent analysis, the proposed scheme can be seen to resist several kinds of attacks, and to have more security properties than other comparable schemes.

Cryptanalysis and Improvement of a Password-Based Remote User Authentication Scheme without Smart Cards

Recently, Chen et al. [B. Chen, W. Kuo, L. Wuu, A secure password-based remote user authentication scheme without smart cards, Information Technology and Control 41(1) (2012) 53-59] proposed a secure password-based remote user authentication scheme without smart cards and claimed that their scheme could withstand various attacks. Although Chen et al.’s scheme has many benefits; we find that it is vulnerable to the device stolen attack and the privileged insider attack. We also find that their scheme does not support perfect forward secrecy and no key control. Therefore, we propose an improved scheme to overcome weaknesses and maintain the benefits of the original scheme.DOI: http://dx.doi.org/10.5755/j01.itc.42.2.2554

An Improved Password-Based Remote User Authentication Protocol without Smart Cards

Authentication is one of the fundamental mechanisms to enable a legitimate user to log into a remote server in an insecure environment. Many authentication protocols have been proposed in the literature for preventing unauthorized parties from access resources. Recently, Chen et al. proposed a password-based remote user authentication and key agreement scheme using common storage devices, such as USB sticks. They claimed that the scheme can withstand off-line dictionary attacks even if the authentication information stored in the device is obtained by the adversary. However, we observe that Chen et al.’s scheme is insecure against off-line dictionary attacks in this case. To remedy this security flaw, we propose an improved authentication protocol without using smart cards. Compared with the previous schemes, our scheme not only provides more security guarantees, but also is more efficient both in computation and communication cost.DOI: http://dx.doi.org/10.5755/j01.itc.42.2.2079

Security Analysis on a Timestamp-based Remote User Authentication Scheme

In recent years, many password-based remote user authentication schemes have been presented. In 2003, Shen et al. proposed a timestamp-based password authentication scheme using smart cards. In their scheme, the server does not need to maintain any verification table and only stores a secret key. However, Awasthi et al. found that Shen et al.’s scheme is vulnerable to impersonation attacks with the stolen card. Awasthi et al. proposed an improved remote user authentication scheme based smart cards. Unfortunately, the improved version is still insecure. We show that Awasthi et al.’s scheme is vulnerable to offline password guessing attacks, password compromise to the server, impersonation attack and important message leakage attacks. In addition, Awasthi et al.’s scheme has poor reparability.

Secure Password-based Remote User Authentication Scheme Against Smart Card Security Breach

It is a challenge for password authentication protocols using non-tamper resistant smart cards to achieve user anonymity, forward secrecy, immunity to various attacks and high performance at the same time. In 2011, Li and Lee showed that both Hsiang-Shih’s password-based remote user authentication schemes are vulnerable to various attacks if the smart card is non-tamper resistant. Consequently, an improved scheme was developed to preclude the identified weaknesses and claimed that it is secure against smart card loss attacks. In this paper, however, we will show that Li-Lee’s scheme still cannot withstand offline password guessing attack under the non-tamper resistance assumption of the smart card. In addition, their scheme is also vulnerable to denial of service attack and fails to provide user anonymity and forward secrecy. As our main contribution, a robust scheme is presented to cope with the aforementioned defects, while keeping the merits of different password authentication schemes using smart cards. The analysis demonstrates that our scheme meets all the proposed criteria and eliminates several hard security threats that are difficult to be tackled at the same time in previous scholarship.

A SECURE PASSWORD-BASED REMOTE USER AUTHENTICATION SCHEME WITHOUT SMART CARDS

There are many remote user authentication schemes proposed in literatures for preventing unauthorized parties from accessing resources in an insecure environment. Due to inherent tamper-resistance, most of them are based on smart card authentication schemes. Unfortunately, the cost of cards and readers make these schemes costly. In the real world, common storage devices, such as universal serial bus (USB) thumb drives, portable HDDs, mobile phones, Laptop or Desktop PCs, are widely used, and they are much cheaper or more convenient for storing user authentication information. However, since these devices do not provide tamper-resistance, it is a challenge to design a secure authentication scheme using these kinds of memory devices. In this paper, we will propose a secure password-based remote user authentication and key agreement scheme without using smart cards. According to our analysis, the proposed scheme guarantees mutual authentication and also resists off-line dictionary, replay, forgery, and impersonation attacks. Compared to related scheme, the proposed scheme’s computation cost is lower and the total message length is shorter. Therefore, our scheme is suitable even for applications in limited power computing environments.DOI: http://dx.doi.org/10.5755/j01.itc.41.1.975

Security Flaws in Three Password-Based Remote User Authentication Schemes with Smart Cards

Since the publication of Hwang-Li's password-based remote user authentication scheme with smart cards, a number of password-based authentication schemes with smart cards have been proposed to meet a variety of desirable security and performance requirements. In this paper, security flaws in three password-based remote user authentication schemes with smart cards are pointed out. These results demonstrate that no more password-based authentication schemes with smart cards should be constructed with such ad-hoc methods, i.e., the formal design methodology with provable security approach should be employed in future design.

Improvements on Hsiang and Shih's Remote User Authentication Scheme Using Smart Cards

Hsiang and Shih discovered that Yoon et al.’s user authentication scheme was vulnerable to parallel session attack, impersonation attack, and offline password guessing attack. They proposed an improved scheme to prevent these attacks. Hsiang and Shih’s scheme is still susceptible to offline password guessing attack and server impersonation attack. In this paper, we demonstrate how their scheme can be compromised and then propose an improved scheme based on the Rabin cryptosystem to overcome the weaknesses. Furthermore, we discuss the reason why we should use an asymmetric encryption algorithm to secure a password-based remote user authentication scheme using smart cards. We formally prove the security of our proposed scheme using the BAN logic. key words: Network-level security and protection, authentication, security, password

Enhanced Password-based Remote User Authentication Scheme Using Smart Cards

Secure and efficient authentication schemes over insecure networks have been a very important issue with the rapid development of networking technologies. Wang et al. proposed a remote user authentication scheme using smart cards. However, recently, Chen et al. pointed out that their scheme is vulnerable to the impersonation attack and the parallel session attack, and they proposed an enhanced authentication scheme. Chen et al. claimed that their scheme is secure against the various attacks. However, we have found that their scheme cannot resist the parallel attack and the stolen smart card attack. Therefore, in this paper, we show the security flaws in Chen et al.'s scheme and propose an improved remote user authentication scheme using tamper-resistant smart cards to solve the problem of Chen et al.'s scheme. We also analyze our scheme in terms of security and performance.