Password-based User Authentication Scheme Research Articles

Pivot: Panoramic-image-based VR User Authentication against Side-Channel Attacks

With metaverse attracting increasing attention from both academic and industry, the application of virtual reality (VR) has extended beyond 3D immersive viewing/gaming to a broader range of areas, such as banking, shopping, tourism, education, etc., which involves a growing amount of sensitive and private user data into VR systems. However, with current password-based user authentication schemes in mainstream VR devices, studies demonstrate that side-channel attacks can pose a severe threat to VR user privacy. To mitigate the threat, we propose a novel Panoramic-image-based VR user authentication system, i.e., Pivot , to defend against such attacks, yet maintain high usability. Specifically, in Pivot , we design an image-random-pivoting-based user interaction mechanism to assist users in quickly and securely selecting memorable points of interest in a panoramic image. Then an image region segmentation algorithm is designed to automatically scatter the points to regions to form the customized graphic password for the user, which could ensure a sufficiently large password space and also reduce the near-region point misclicks. Afterward, the region indexes are used to generate the hashed password for authentication. Both theoretical security analysis and extensive user studies demonstrate that Pivot is secure and user-friendly in practice.

Two-factor authentication in industrial Internet-of-Things: Attacks, evaluation and new construction

Due to the sensitiveness of the physical environments and resource-constrained nature of edge devices, how to securely and efficiently access real-time data in Industrial Internet-of-Things (IIoT) is becoming an increasingly imperative concern. Though intensive efforts have been made to design password-based user authentication schemes for IIoT environments, the majority of them are subject to weaknesses, either suffering from various known attacks or lack of critical features. To ameliorate this situation, firstly, we put forward a criteria set on the basis of related state-of-art evaluation set to fairly assess authentication schemes for IIoT environments. The effectiveness and practicality of our criteria are tested by 42 representative schemes. Secondly, we revisit two representative schemes, namely Amin et al.’s scheme and Gope–Hwang’s scheme, as case studies to demonstrate the common pitfalls in designing robust schemes. Finally, we propose a practical authentication scheme for Industrial Internet-of-Things with provable security, and shed light on how to tackle node capture attack by using the “honeywords” technique. The security and performance evaluation results show that our new scheme is superior to other related ones, and thus, more suitable for IIoT environments.

Cryptanalysis and Security Enhancement of Three Authentication Schemes in Wireless Sensor Networks

Nowadays wireless sensor networks (WSNs) have drawn great attention from both industrial world and academic community. To facilitate real‐time data access for external users from the sensor nodes directly, password‐based authentication has become the prevalent authentication mechanism in the past decades. In this work, we investigate three foremost protocols in the area of password‐based user authentication scheme for WSNs. Firstly, we analyze an efficient and anonymous protocol and demonstrate that though this protocol is equipped with a formal proof, it actually has several security loopholes been overlooked, such that it cannot resist against smart card loss attack and violate forward secrecy. Secondly, we scrutinize a lightweight protocol and point out that it cannot achieve the claimed security goal of forward secrecy, as well as suffering from user anonymity violation attack and offline password guessing attack. Thirdly, we find that an anonymous scheme fails to preserve two critical properties of forward secrecy and user friendliness. In addition, by adopting the “perfect forward secrecy (PFS)” principle, we provide several effective countermeasures to remedy the identified weaknesses. To test the necessity and effectiveness of our suggestions, we conduct a comparison of 10 representative schemes in terms of the underlying cryptographic primitives used for realizing forward secrecy.

Secure anonymity-preserving password-based user authentication and session key agreement scheme for telecare medicine information systems

Background and objectivesInformation and communication and technology (ICT) has changed the entire paradigm of society. ICT facilitates people to use medical services over the Internet, thereby reducing the travel cost, hospitalization cost and time to a greater extent. Recent advancements in Telecare Medicine Information System (TMIS) facilitate users/patients to access medical services over the Internet by gaining health monitoring facilities at home. MethodsAmin and Biswas recently proposed a RSA-based user authentication and session key agreement protocol usable for TMIS, which is an improvement over Giri et al.'s RSA-based user authentication scheme for TMIS. In this paper, we show that though Amin–Biswas's scheme considerably improves the security drawbacks of Giri et al.'s scheme, their scheme has security weaknesses as it suffers from attacks such as privileged insider attack, user impersonation attack, replay attack and also offline password guessing attack. A new RSA-based user authentication scheme for TMIS is proposed, which overcomes the security pitfalls of Amin–Biswas's scheme and also preserves user anonymity property. ResultsThe careful formal security analysis using the two widely accepted Burrows–Abadi–Needham (BAN) logic and the random oracle models is done. Moreover, the informal security analysis of the scheme is also done. These security analyses show the robustness of our new scheme against the various known attacks as well as attacks found in Amin–Biswas's scheme. The simulation of the proposed scheme using the widely accepted Automated Validation of Internet Security Protocols and Applications (AVISPA) tool is also done. ConclusionsWe present a new user authentication and session key agreement scheme for TMIS, which fixes the mentioned security pitfalls found in Amin–Biswas's scheme, and we also show that the proposed scheme provides better security than other existing schemes through the rigorous security analysis and verification tool. Furthermore, we present the formal security verification of our scheme using the widely accepted AVISPA tool. High security and extra functionality features allow our proposed scheme to be applicable for telecare medicine information systems which is used for e-health care medical applications.

Cryptanalysis and improvement of a password-based user authentication scheme for the integrated EPR information system

Recently, Wu et al. proposed a password-based remote user authentication scheme for the integrated Electronic Patient Record (EPR) information system to achieve mutual authentication and session key agreement over the Internet. They claimed that the scheme resists various attacks and offers lower computation cost, data integrity, confidentiality and authenticity. However, we observed that the scheme cannot withstand lost smartcard/off-line password guessing, privileged-insider and known session-specific temporary information attacks, and lacks the requirements of lost smartcard revocation and users’ anonymity. Besides, the password change phase is inconvenient to use because a user cannot change his password independently. Thus, we proposed a new password-based user authentication scheme for the integrated EPR information system that would be able to resist detected security flaws of Wu et al.’s scheme.

Robust password and smart card based authentication scheme with smart card revocation

User authentication scheme allows user and server to authenticate each other, and generates a session key for the subsequent communication. How to resist the password guessing attacks and smart card stolen attacks are two key problems for designing smart cart and password based user authentication scheme. In 2011, Li and Lee proposed a new smart cart and password based user authentication scheme with smart card revocation, and claimed that their scheme could be immunity to these attacks. In this paper, we show that Li and Lee’s scheme is vulnerable to off-line password guessing attack once the information stored in smart card is extracted, and it does not provide perfect forward secrecy. A robust user authentication scheme with smart card revocation is then proposed. We use a most popular and widely used formal verification tool ProVerif, which is based on applied pi calculus, to prove that the proposed scheme achieves security and authentication.

On the security of two remote user authentication schemes for telecare medical information systems.

The telecare medical information systems (TMISs) support convenient and rapid health-care services. A secure and efficient authentication scheme for TMIS provides safeguarding patients' electronic patient records (EPRs) and helps health care workers and medical personnel to rapidly making correct clinical decisions. Recently, Kumari et al. proposed a password based user authentication scheme using smart cards for TMIS, and claimed that the proposed scheme could resist various malicious attacks. However, we point out that their scheme is still vulnerable to lost smart card and cannot provide forward secrecy. Subsequently, Das and Goswami proposed a secure and efficient uniqueness-and-anonymity-preserving remote user authentication scheme for connected health care. They simulated their scheme for the formal security verification using the widely-accepted automated validation of Internet security protocols and applications (AVISPA) tool to ensure that their scheme is secure against passive and active attacks. However, we show that their scheme is still vulnerable to smart card loss attacks and cannot provide forward secrecy property. The proposed cryptanalysis discourages any use of the two schemes under investigation in practice and reveals some subtleties and challenges in designing this type of schemes.

Formal security analysis and verification of a password-based user authentication scheme for hierarchical wireless sensor networks

In 2012, Das et al. proposed a new password-based remote user authentication scheme in hierarchical wireless sensor networks (HWSNs). The proposed scheme achieves better security and efficiency as compared to those for other existing password-based schemes proposed in HWSNs. In this paper, we first analyse Das et al.’s scheme for formal security under the random oracle models to show their scheme is secure. Furthermore, we simulate this proposed scheme for formal security verification using the widely-accepted automated validation of internet security protocols and applications (AVISPA) tool. Using the AVISPA model checkers, we show that Das et al.’s scheme is also secure against possible passive and active attacks, including the replay and man-in-the-middle attacks. In addition, we also simulate the existing password-based schemes for formal security verification using AVISPA tool and provide a comparison among Das et al.’s scheme and other schemes. It is shown that Das et al.’s scheme outperforms other existing approaches.

An Improvement of Wang. et. al. 's Remote User Authentication Scheme against Smart Card Security Breach

User authentication is one of the fundamental procedures to provide secure communications between user and server over an insecure public channel. Recently, Wang et. al. proposed password-based user authentication scheme based on hash function and modular exponentiation and they claimed that their scheme provides strong authentication than related scheme. But in this paper, it is pointed out that their scheme suffers from off-line password guessing attack, off-line identity guessing attack, user impersonation attack, server masquerading attack, smart card stolen attack and password change attack. Then an improved scheme over Wang et. al.’s scheme has been proposed to overcome their weaknesses. The proposed scheme resists all possible attacks and provides more security than wang et. al’s scheme, published earlier.

An Improved Dynamic Password-based User Authentication Scheme for Hierarchical Wireless Sensor Networks

User authentication is an important issue in wireless sensor networks (WSN). Das et al. recently proposed a dynamic password-based user authentication scheme for hierarchical wireless sensor networks (HWSN), which provides high security and a simple authentication approach. In this paper we present a flaw in Das et al.’s scheme that makes it infeasible for real-life implementation. Additionally, we demonstrate that Das et al.’s scheme has redundant elements. To overcome these imperfections we propose an enhanced user authentication scheme based on Das et al.’s, which is both efficient and secure.DOI: http://dx.doi.org/10.5755/j01.eee.19.6.2038

A Secure and Efficient Password-Based User Authentication Scheme Using Smart Cards for the Integrated EPR Information System

The integrated EPR information system supports convenient and rapid e-medicine services. A secure and efficient authentication scheme for the integrated EPR information system provides safeguarding patients' electronic patient records (EPRs) and helps health care workers and medical personnel to rapidly making correct clinical decisions. Recently, Wu et al. proposed an efficient password-based user authentication scheme using smart cards for the integrated EPR information system, and claimed that the proposed scheme could resist various malicious attacks. However, their scheme is still vulnerable to lost smart card and stolen verifier attacks. This investigation discusses these weaknesses and proposes a secure and efficient authentication scheme for the integrated EPR information system as alternative. Compared with related approaches, the proposed scheme not only retains a lower computational cost and does not require verifier tables for storing users' secrets, but also solves the security problems in previous schemes and withstands possible attacks.

A New User Authentication Scheme for Hierarchical Wireless Sensor Networks

Recently, Das et al. proposed a new password-based user authentication scheme in hierarchical wireless sensor networks and claimed this scheme is security against different kinds of attack. However, in this paper, we analyze their scheme and show that their scheme has some pitfalls and can be more efficient through optimize the authentication process. Then we propose an enhanced scheme to overcome the inherent weakness. The enhanced scheme achieves more secure and efficient in WSNs.

Crypto System based Authentication using CSTA in Grid

Grid computing, as a distributed computing model, stands for the new kind of systems that pools heterogeneous computational resources, such as computers, storage space, sensors, application software, and experiment data. When a user wants to request some computing and data resources, the grid can seamlessly, transparently and dynamically supply them. The security issue has become an important concern of grid computing. To prevent the grid resources from being illegally visited, the strong mutual authentication is needed for user and server. In recent periods, many password-based user authentication schemes are proposed for solving the authentication issue. However, most of them are not ideal for grid computing, since they do not provide the strong mutual authentication. It is proposed to introduce an efficient user Cyclic Shift Transposition Algorithm (CSTA) scheme and a model for secure routing mechanism of sharing messages between source and destination in grid computing by adding information about sender and preserves the message content, which prevents not only known attacks but also maintains the integrity of data. This efficient method is implemented over text data. This model dynamically reorders the frequency of the input symbols according to the coupled cyclic shift system.All text is coded during initialization. The output from the engine is in the form of variable size words and the individual bit output corresponding to the inserted symbols cannot be determined thus highly confidential.

A dynamic password-based user authentication scheme for hierarchical wireless sensor networks

Most queries in wireless sensor network (WSN) applications are issued at the point of the base station or gateway node of the network. However, for critical applications of WSNs there is a great need to access the real-time data inside the WSN from the nodes, because the real-time data may no longer be accessed through the base station only. So, the real-time data can be given access directly to the external users (parties) those who are authorized to access data as and when they demand. The user authentication plays a vital role for this purpose. In this paper, we propose a new password-based user authentication scheme in hierarchical wireless sensor networks. Our proposed scheme achieves better security and efficiency as compared to those for other existing password-based approaches. In addition, our scheme has merit to change dynamically the user's password locally without the help of the base station or gateway node. Furthermore, our scheme supports dynamic nodes addition after the initial deployment of nodes in the existing sensor network.

Cryptanalysis of Multiple-Server Password-Authenticated Key Agreement Schemes Using Smart Cards

Password-based user-authentication schemes have been widely used when users access a server to avail internet services. Multiserver password-authentication schemes enable remote users to obtain service from multiple servers without separately registering with each server. In 2008, Jia-Lun Tsai proposed an improved and efficient password-authenticated key agreement scheme for a multiserver architecture based on Chang-Lee's scheme proposed in 2004. However, we found that Tsai's scheme does not provide forward secrecy and is weak to insider impersonation and denial of service attacks. In this article, we describe the drawbacks of Tsai's scheme and provide a countermeasure to satisfy the forward secrecy property.

A Reliable User Authentication and Key Agreement Scheme for Web-Based Hospital-Acquired Infection Surveillance Information System

With the rapid development of the Internet, both digitization and electronic orientation are required on various applications in the daily life. For hospital-acquired infection control, a Web-based Hospital-acquired Infection Surveillance System was implemented. Clinical data from different hospitals and systems were collected and analyzed. The hospital-acquired infection screening rules in this system utilized this information to detect different patterns of defined hospital-acquired infection. Moreover, these data were integrated into the user interface of a signal entry point to assist physicians and healthcare providers in making decisions. Based on Service-Oriented Architecture, web-service techniques which were suitable for integrating heterogeneous platforms, protocols, and applications, were used. In summary, this system simplifies the workflow of hospital infection control and improves the healthcare quality. However, it is probable for attackers to intercept the process of data transmission or access to the user interface. To tackle the illegal access and to prevent the information from being stolen during transmission over the insecure Internet, a password-based user authentication scheme is proposed for information integrity.

Further Improved Remote User Authentication Scheme

SUMMARY Kim and Chung previously proposed a password-based user authentication scheme to improve Yoon and Yoo’s scheme. However, Kim and Chung’s scheme is still vulnerable to an offline password guessing attack, an unlimited online password guessing attack, and server impersonation. We illustrate how their scheme can be compromised and then propose an improved scheme to overcome the weaknesses. Our improvement is based on the Rabin cryptosystem. We verify the correctness

A Password-Based User Authentication Scheme for the Integrated EPR Information System

With the rapid development of the Internet, digitization and electronic orientation are required in various applications of our daily life. For e-medicine, establishing Electronic patient records (EPRs) for all the patients has become the top issue during the last decade. Simultaneously, constructing an integrated EPR information system of all the patients is beneficial because it can provide medical institutions and the academia with most of the patients' information in details for them to make correct decisions and clinical decisions, to maintain and analyze patients' health. Also beneficial to doctors and scholars, the EPR system can give them record linkage for researches, payment audits, or other services bound to be developed and integrated into medicine. To tackle the illegal access and to prevent the information from theft during transmission over the insecure Internet, we propose a password-based user authentication scheme suitable for information integration.

Privacy-Preserving Authentication of Users with Smart Cards Using One-Time Credentials

User privacy preservation is critical to prevent many sophisticated attacks that are based on the user's server access patterns and ID-related information. We propose a password-based user authentication scheme that provides strong privacy protection using one-time credentials. It eliminates the possibility of tracing a user's authentication history and hides the user's ID and password even from servers. In addition, it is resistant against user impersonation even if both a server's verification database and a user's smart card storage are disclosed. We also provide a revocation scheme for a user to promptly invalidate the user's credentials on a server when the user's smart card is compromised. The schemes use lightweight operations only such as computing hashes and bitwise XORs.

A countable and time-bound password-based user authentication scheme for the applications of electronic commerce

In this paper, we propose a secure and efficient user authentication scheme with countable and time-bound features. The countable feature is to limit the use to a certain number of times, which means that the users are able to successfully log into the system in a fixed number of times. The feature of the time-bound allows each login ticket to have a period of expiration. In other words, if a login request is overdue, it would not be available anymore. These features make our scheme more reliable for applications in the field of electronic commerce, such as on-line games, pay-TV, and so on. Since our scheme does not require any password or verification table and can avoid replay attacks, it is under firm security. Moreover, our scheme shows a lower computational overhead on the user side. Therefore, it offers an efficient and adequate alternative for the implementations in the mobile environment with limited computing capability.