Privacy Preserving User Authentication Research Articles

Improved Gentry–Halevi's fully homomorphic encryption‐based lightweight privacy preserving scheme for securing medical Internet of Things

AbstractInternet of Medical Things (IoMT) solutions have proliferated rapidly in the COVID‐19 pandemic era. The smart medical sensors capture real‐time data from remote patients and communicate it to medical servers in a secure and privacy‐preserving manner. It is a herculean challenge to guarantee security and privacy in Medical IoT applications. Hence, an improved Gentry–Halevi's fully homomorphic encryption‐based (IGHFHE) lightweight privacy preserving user authentication scheme is proposed in this work. The scheme is proposed with an integer matrix computation strategy for securing data computation with privacy protection. It adopts the translation process of Gentry–Halevi's fully homomorphic encryption process for performing homomorphic addition and multiplication, then encrypt an integer matrix modulo that represents a positive integer. Extensive informal investigation and simulation of the proposed IGHFHE scheme shows that it is more resistant to well‐known attacks for preventing authentication breaches. Also, the proposed IGHFHE scheme reduced computational and storage overhead by 4.98% and 5.78% respectively on average in comparison to other prevailing schemes.

Desynchronization resistant privacy preserving user authentication protocol for location based services

Desynchronization resistant privacy preserving user authentication protocol for location based services

Blockchain based Privacy Preserving User Authentication Protocol for Distributed Mobile Cloud Environment

The development in cloud computing platforms has resulted, hosting many day-to-day service applications in the cloud. To avail the services provided by different cloud service providers (CSPs), the mobile user has to register his/her identity with the CSPs. The mobile user (MU) has to remember multiple identities and credentials to access various CSPs. Many single sign-on schemes have been proposed in the literature to eliminate multiple registrations by mobile users to access CSPs. Most of these schemes rely on a trusted third party known as Registration Authority Center (RAC), which is a centralized entity to manage the identity information of all the mobile users registered with it. The centralized RAC has two operational problems, i.e., RAC has full control over the data it possesses, resulting in the possibility of the data breach and increased risk of single-point-of-failure. In this paper, we propose a blockchain based privacy preserving user authentication protocol for distributed mobile cloud environment, which solves these two traditional problems with centralized registration centers. In proposed protocol, the registration of MU and CSP are performed through public blockchain network for MU to access CSPs and the authentication was performed between MU and CSP through public blockchain. The public blockchain network stores MU and CSPs identity information. Public blockchain network provides integrity to the data stored in it and secures the system from single-point-of-failure. In addition, security analysis and performance analysis were also performed for proposed protocol and it showed that the proposed protocol is secure from all-known attacks with better performance efficiency.

Privacy Preserving User Authentication Scheme Based on Smart Card

One of the most commonly used user authentication mechanisms is two factor authentication based on smart card and password. The core feature of the scheme is to enforce that the user must have the smart card and know the password in order to gain access to server. Recently, Liu et al. proposed a smart card based password authentication scheme and argued that it is secure against insider attack, replay attack and man in the middle attack and provides perfect forward secrecy. In this paper, we show security weaknesses in Liu et al.’s scheme focused on off-line password guessing attack and masquerading attack and it does not provide perfect forward secrecy and anonymity. Accordingly, we propose a privacy preserving user authentication scheme based on smart card, denoted as PUAS, to remedy these security weaknesses and to provide anonymity and perfect forward secrecy. PUAS is more secure with a bit of computational overhead to support several positive properties in security and privacy.

On the Challenges in Designing Identity-Based Privacy-Preserving Authentication Schemes for Mobile Devices

Providing secure, efficient, and privacy-preserving user authentication in mobile networks is a challenging problem due to the inherent mobility of users, variety of attack vectors, and resource-constrained nature of user devices. Recent studies show that identity-based cryptosystems can eliminate the certificate overhead and thus address the issues associated with public-key infrastructure technology—which is a rare bit of good news in today's computer security world. In this paper, we employ three representative identity-based remote user authentication schemes (i.e., Truong et al. 's scheme, Li et al. 's scheme, and Zhang et al. 's scheme) as case studies to reveal the challenges and subtleties in designing a practical authentication scheme for mobile devices. First, we demonstrate that Truong et al. 's scheme, which was presented at the IEEE AINA 2012, cannot achieve a few important security goals under our new attacking scenarios: 1) it fails to resist against known session-specific temporary information attack; 2) it cannot withstand key compromise impersonation attack; and 3) it is of poor usability. Second, we show that Li et al. 's privacy-preserving scheme, which was proposed at GLOBECOM 2012, is subject to some subtle (yet severe) efficiency problems that make it virtually impossible for any practical use. Third, we scrutinize a “provably secure” scheme for roaming services in mobile networks designed by Zhang et al. at SCN 2015 and find it prone to collusion attack and replay attack. Further, we investigate into the underlying causes for these identified failures, and figure out an improvement over Truong et al. 's scheme to overcome the revealed challenges while maintaining reasonable efficiency.

Biometrics-Based Privacy-Preserving User Authentication Scheme for Cloud-Based Industrial Internet of Things Deployment

Due to the widespread popularity of Internet-enabled devices, Industrial Internet of Things (IIoT) becomes popular in recent years. However, as the smart devices share the information with each other using an open channel, i.e., Internet, so security and privacy of the shared information remains a paramount concern. There exist some solutions in the literature for preserving security and privacy in IIoT environment. However, due to their heavy computation and communication overheads, these solutions may not be applicable to wide category of applications in IIoT environment. Hence, in this paper, we propose a new biometric-based privacy preserving user authentication (BP2UA) scheme for cloud-based IIoT deployment. BP2UA consists of strong authentication between users and smart devices using preestablished key agreement between smart devices and the gateway node. The formal security analysis of BP2UA using the well-known real-or-random model is provided to prove its session key security. Moreover, an informal security analysis of BP2UA is also given to show its robustness against various types of known attacks. The computation and communication costs of BP2UA in comparison to the other existing schemes of its category demonstrate its effectiveness in the IIoT environment. Finally, the practical demonstration of BP2UA is also done using the NS2 simulation.

Privacy Preserving User Authentication Scheme Based on Smart Card

One of the most commonly used user authentication mechanisms is two factor authentication based on smart card and password. The core feature of the scheme is to enforce that the user must have the smart card and know the password in order to gain access to server. Recently, Liu et al. proposed a smart card based password authentication scheme and argued that it is secure against insider attack, replay attack and man in the middle attack and provides perfect forward secrecy. In this paper, we show security weaknesses in Liu et al.’s scheme focused on off-line password guessing attack and masquerading attack and it does not provide perfect forward secrecy and anonymity. Accordingly, we propose a privacy preserving user authentication scheme based on smart card, denoted as PUAS, to remedy these security weaknesses and to provide anonymity and perfect forward secrecy. PUAS is more secure with a bit of computational overhead to support several positive properties in security and privacy.

NFC Based Privacy Preserving User Authentication Scheme in Mobile Office

NFC Based Privacy Preserving User Authentication Scheme in Mobile Office