Remote Authentication Research Articles

SecFHome: Secure remote authentication in fog-enabled smart home environment

Fog computing is the best solution for IoT applications with low latency and real-time interaction. Fog can endow smart home with many smart functions and services. One of the most important services is that users can remotely access and control smart devices. Since remote users and smart homes communicate through insecure channels, it is necessary to design a secure and effective remote authentication scheme to guarantee secure communications. The existing authentication schemes designed for smart homes have some security issues and are not suitable for fog-enabled smart home environments. Therefore, this paper designs a secure remote user authentication scheme, SecFHome. It supports secure communication at the edge of the network and remote authentication in fog-enabled smart home systems. Specifically, We present an efficient authentication mode in the fog-enabled environment, which includes the edge negotiation phase and the authentication phase. SecFHome adds updated information to the authenticator, which can verify the message synchronization simultaneously with the authentication, thus improving the authentication efficiency. In addition, SecFHome does not store sensitive information of users and smart devices in the memory of the smart gateway, which can avoid various attacks caused by the compromised gateway. The formal security proof and informal security analysis show that the SecFHome is secure and can resist known attacks. Compared with the related authentication schemes, SecFHome only needs fewer communication costs and computation costs, and achieves more security features.

Cooperative Detection Method for DDoS Attacks Based on Blockchain

Distributed Denial of Service (DDoS) attacks is always one of the major problems for service providers. Using blockchain to detect DDoS attacks is one of the current popular methods. However, the problems of high time overhead and cost exist in the most of the blockchain methods for detecting DDoS attacks. This paper proposes a blockchain-based collaborative detection method for DDoS attacks. First, the trained DDoS attack detection model is encrypted by the Intel Software Guard Extensions (SGX), which provides high security for uploading the DDoS attack detection model to the blockchain. Secondly, the service provider uploads the encrypted model to Inter Planetary File System (IPFS) and then a corresponding Content-ID (CID) is generated by IPFS which greatly saves the cost of uploading encrypted models to the blockchain. In addition, due to the small amount of model data, the time cost of uploading the DDoS attack detection model is greatly reduced. Finally, through the blockchain and smart contracts, the CID is distributed to other service providers, who can use the CID to download the corresponding DDoS attack detection model from IPFS. Blockchain provides a decentralized, trusted and tamper-proof environment for service providers. Besides, smart contracts and IPFS greatly improve the distribution efficiency of the model, while the distribution of CID greatly improves the efficiency of the transmission on the blockchain. In this way, the purpose of collaborative detection can be achieved, and the time cost of transmission on blockchain and IPFS can be considerably saved. We designed a blockchain-based DDoS attack collaborative detection framework to improve the data transmission efficiency on the blockchain, and use IPFS to greatly reduce the cost of the distribution model. In the experiment, compared with most blockchain-based method for DDoS attack detection, the proposed model using blockchain distribution shows the advantages of low cost and latency. The remote authentication mechanism of Intel SGX provides high security and integrity, and ensures the availability of distributed models.

Privacy-Preserving Fingerprint Authentication Using D-H Key Exchange and Secret Sharing

Biometric based remote authentication has been widely deployed. However, there exist security and privacy issues to be addressed since biometric data includes sensitive information. To alleviate these concerns, we design a privacy-preserving fingerprint authentication technique based on Diffie-Hellman (D-H) key exchange and secret sharing. We employ secret sharing scheme to securely distribute fragments of critical private information around a distributed network or group, which softens the burden of the template storage center (TSC) and the users. To ensure the security of template data, the user’s original fingerprint template is stored in ciphertext format in TSC. Furthermore, the D-H key exchange protocol allows TSC and the user to encrypt the fingerprint template in each query using a random one-time key, so as to protect the user’s data privacy. Security analysis indicates that our scheme enjoys indistinguishability against chosen-plaintext attacks and user anonymity. Through experimental analysis, we demonstrate that our scheme can provide secure and accurate remote fingerprint authentication.

ECC-based lightweight authentication and access control scheme for IoT E-healthcare

The E-healthcare system has a complex architecture, diverse business types, and sensitive data security. To meet the secure communication and access control requirements in the user–medical server, user–patient, patient–medical server, and other scenarios in the E-healthcare system, secure and efficient authenticated key agreement and access authorization scheme need to be studied. However, the existing multi-server solutions do not consider the authentication requirements of the Wireless Body Area Network (WBAN) and are not suitable for user–patient, patient–medical server scenarios; most of the existing WBAN authentication schemes are single-server type, which are difficult to meet the requirements of multi-server applications, and the study of user–patient real-time scenarios has not received due attention. This work first reveals the structural flaws and security vulnerabilities of the existing typical schemes and then proposes an authentication and access control architecture suitable for multiple scenarios of the E-healthcare system with separate management and business and designs a novel ECC-based multi-factor remote authentication and access control scheme for E-healthcare using physically unclonable function (PUF) and hash. Security analysis and efficiency analysis show that the new scheme has achieved improved functionality and higher security while maintaining low computational and communication overhead.

Will Requirements for Last Wills Remain as They Are? The ‘Physical Presence Requirement’ of Witnesses and Notaries in the Light of the COVID-19 Interim Measures and the EU Freedom of (Notarial) Services

The COVID-19-crisis has exposed the shortcomings of formal requirements for legal acts which involve the physical presence of others. This is in particular true with regard to last wills which require the physical presence of a notary and/or witnesses, who have to authenticate and/or attest to the last will of the testator. In such cases, the physical presence requirement imposes an outright obstruction to passing a last will in times of COVID-19. Western countries have responded differently to COVID-19. In the civil-law jurisdictions where only notarial wills are offered, such as the Netherlands, the government has introduced interim measures allowing the testator (and witnesses, if required) to appear before the notary by audio-video technology, leading to authorized remote notarization and remote witnessing. The same has been done in common law jurisdictions where only witnessed wills are offered, including Australia, New Zealand and some states in the United States with regard to witnessing. The first part of this paper researches the different types of last wills and seeks to explain why countries have responded differently in this respect to COVID-19. The second part discusses the different solutions available and argues that solutions introducing audio-video technology as an alternative for physical presence are more favourable than other solutions. Remote authentication and remote witnessing leaves intact the existing will-types of the particular jurisdiction as they are, modernizing the presence requirement of the notary and/or the witnesses, while at the same time preserving legal certainty by anchoring these possibilities in legislation. Introducing audio-video technology in making last wills seems a logical step forward in the 21st century. Building on the two previous parts, the third part investigates a more fundamental issue relating to the physical presence requirement for notarial wills from a European Union free movement of services perspective. Discussing ECJ case law and two applicable directives, it shows that Member States are allowed to restrict the freedom of establishment of notaries and freedom to provide notarial services. These restrictions often lead to a domestic monopoly of notaries, where notaries appointed in the Member State offer exclusively notarial services under the legislation of that Member State, with the requirement that these notaries can only be established in and only offer their services that Member State. Combined with the physical presence requirement, these restrictions to the freedom of establishment and the freedom of services effectively force a testator desiring to make its last will before a notary to travel to the Member State of that notary. Even without COVID-19, it is the question whether this physical presence requirement unnecessarily restricts the freedom of services under art. 56 TFEU, as it deprives the notary and the testator of a rapid and direct technique of passing notarial wills. The possibility of remote authentication under interim legislation raises the question whether the physical presence requirement is objectively justified and proportionate to restrict the freedom of services.

Adversary Models for Mobile Device Authentication

Mobile device authentication has been a highly active research topic for over 10 years, with a vast range of methods proposed and analyzed. In related areas, such as secure channel protocols, remote authentication, or desktop user authentication, strong, systematic, and increasingly formal threat models have been established and are used to qualitatively compare different methods. However, the analysis of mobile device authentication is often based on weak adversary models, suggesting overly optimistic results on their respective security. In this article, we introduce a new classification of adversaries to better analyze and compare mobile device authentication methods. We apply this classification to a systematic literature survey. The survey shows that security is still an afterthought and that most proposed protocols lack a comprehensive security analysis. The proposed classification of adversaries provides a strong and practical adversary model that offers a comparable and transparent classification of security properties in mobile device authentication.

Biometric Cryptosystems: Towards a Light and Precise Remote Authentication

Background: Remote authentication in current networks such as IoT that connects many end-devices of low capacity must be light, accurate and scalable without threaten security. In general, biometrics is the most reliable way to authenticate users because of its efficient results in many applications. Objective: The biometric data is expressed by a feature vector that should be extracted and secured by reliable techniques. This paper proposes a suitable extraction and encryption scheme in the aim to make the authentication light, accurate, scalable and secure. Method: As extraction technique, principle component analysis with a nonlinear block average quantization is used to reduce the feature vector length in the aim to increase the rapidity and the scalability. As encryption technique, the fuzzy commitment and the fuzzy vault with Hamming and Reed-Solomon codes are used in to increase security. These cryptosystems are tested with multi-biometric modalities to make the validation more credible. Results: Experimental results are analyzed, validated and compared to other works according to several conventional and new recognition rates. Analysis is also done in terms of computation time to validate the lightness of our findings. It is shown that the proposed scheme finds a compromise between the coveted features. Conclusion: Our biometric cryptosystems ensure a secure, light, precise and scalable remote authentication. These properties can be achieved by using PCA technique with nonlinear coefficient quantization and fuzzy schemes with the appropriate correcting-code.

SCB-HC-ECC-Based Privacy Safeguard Protocol for Secure Cloud Storage of Smart Card-Based Health Care System.

The advent of the internet has brought an era of unprecedented connectivity between networked devices, making one distributed computing, called cloud computing, and popular. This has also resulted in a dire need for remote authentication schemes for transferring files of a sensitive nature, especially health-related information between patients, smart health cards, and cloud servers via smart health card solution providers. In this article, we elaborate on our proposed approach for such a system and accomplish an informal analysis to demonstrate the claim that this scheme provides sufficient security while maintaining usability.

IMPLEMENTASI WIRELESS DISTRIBUTION SYSTEM DAN AUTENTIKASI HOTSPOT MENGGUNAKAN RADIUS SERVER DI PT RIMBA MAKMUR UTAMA

ABSTRACTPT Rimba Makmur Utama is located on Jalan Kantin No.8 Kota Bogor. This private business company is engaged in the field of forest restoration on the island of Kalimantan, precisely in the Sampit region. This company's restoration is to save the forest from illegal logging and protect animals from extinction in the forests around the Sampit area. PT Rimba Makmur Utama is already using a hotspot so users can connect to the internet. However, problems arise when users move between rooms or places in the office but the wireless signal coverage cannot be reached. To overcome this, the solution is to build a Wireless Distribution System (WDS) network. WDS is a method that can be used to expand wireless networks by connecting multiple access points without using cables. Hotspot networks do not always provide fast and stable internet access. To overcome this, a user management system and bandwidth are needed using the Remote Authentication Dial In User Service protocol or RADIUS Server. User Manager is a RADIUS Server developed by MikroTik. All the area in the building have been covered with the internet. Users need username and password to connected to the network in the building.

Understanding security failures of anonymous authentication schemes for cloud environments

Currently, password-based remote authentication mechanism has become an essential procedure to ensure users access the resources of the cloud server securely. Dozens of password-based multi-factor authentication schemes have been successively proposed recently. Unfortunately, most of them are vulnerable to various known attacks. The key to designing a secure and privacy-preserving authentication scheme is drawing some lessons from the security failures of existing schemes. In this work, we investigate three anonymous multi-factor authentication schemes based on passwords for cloud environments (i.e., Karuppiah et al.’s scheme at MONET’19, Lin’s scheme at IEEE Syst J’19, Rajamanickam et al.’s scheme at IEEE Syst J’20), and demonstrate that these three schemes all suffer from off-line guessing attacks and are short of an important property (i.e., forward secrecy). We also propose several effective countermeasures to remedy these weaknesses. Our analysis shows that none of these three protocols can achieve their security goals. Furthermore, we make a summary of the causes of the flaws, and reveal that the vulnerabilities of these schemes are caused by violating the basic design principles for a secure protocol (e.g., Ma et al.’s principles at IJCS’14). In addition, we investigate whether dozens of recently proposed schemes follow the design principles of Ma et al..

Blockchain-hosted Data Access Agreements for Remote Condition Monitoring in Rail

Advances in sensor technologies, remote authentication, and high bandwidth data networks mean that Remote Condition Monitoring (RCM) systems are now an essential 'Internet of Things' (IoT) resource for the efficient operation of railway infrastructure. However, the full potential of the big data generated by these systems has yet to be realized. RCM data within the industry is typically collected and used in silos, with limited possibility of exploitation across system boundaries. In 2013, the Rail Safety and Standards Board (RSSB), on behalf of the GB Rail industry, established a cross-industry research program, T1010, which aimed to build stronger cooperation between stakeholders and enable sharing of RCM data. Building on the outputs of T1010, this work explores the use of blockchains and smart contracts in the automation, in an auditable and tamper-proof way, of commercial agreements for RCM data transfers in rail. By removing the limitations of paper-based agreements, we aim to enable innovation in shared business processes and stimulate the market for RCM data in rail. Leveraging existing smart contract-based schemes for trading and sharing IoT data over blockchain networks, we identify suitable methods for the enforcement of agreements, and ensure fair cost attribution between stakeholders, without a Trusted Third Party. The outline of a blockchain-based RCM data audit framework is presented, appropriate data access agreements and accounting models are specified in detail, and three permissioned blockchain platforms (Hyperledger Fabric, Sawtooth, and Iroha) have been analysed for their suitability for implementation. Finally, the paper outlines planned future work around validation of the tools based on two industrial use cases: monitoring systems for unattended overhead line equipment and axle bearings.

Simple solution for low cost bandwidth management

Organizations in this era can't be separated from information technology, especially in communication and information sharing. The existence of information technology, especially computer networks, greatly facilitates agencies in terms of communication. Organizations that have used computer networks generally don’t have tools to handle security and bandwidth management issues in large numbers, resulting in wasteful use of bandwidth for unproductive purposes, such as accessing video streaming. The fact is professional tools to overcome the problem of security and bandwidth management issues are already in the market, but have hundreds of millions of priced. The high price of professional devices gave an opportunity to develop a bandwidth management system based on the integration of the remote authentication dial in user service (RADIUS) server and Mikrotik RouterBoard, at a lower cost. RADIUS server was chosen as a service for network security, because it supports the legal authentication for users via AAA protocol. The RADIUS server can be integrated with MySQL database, it can be developed SSO systems. Bandwidth management can be done with Mikrotik feature, but has the disadvantages of scalable storage, that problem can overcome by integrating Mikrotik and RADIUS server, then defining time doing data packet quota for the client and its implementation can help with hypertext preprocessor (PHP) scripts.

A survey on modern day trends in water level and quality analysis system

Our goal is to explore consistent water quality systems, the dry season, and the water quality standard structure. In fact, river water will be destroyed by a variety of hazards such as capital sewage, agricultural waste and current waste, making it unusable for anthropological practice. Employees are expected to add web water testing and submit it to the evaluation office and then conduct assessments at different water boundaries, which is an exaggerated and long-term relationship. The light display shows the distribution of information between the central lights. Information is transmitted to the cloud via a mobile screen to reduce energy consumption. In addition, these assessments can be used to configure IoT infrastructure so that a decision can be made whenever there is a dramatic change in the assessment of any water quality toilets. The project is proposed for natural water observations under a network of remote sensors. It consists of three parts: information bulbs, a basic information center and a remote authentication focus. Valid multi-temperature sensor sensors must be aware of the bulbs to meet the requirements of the multi-water display and access to rest areas. Water is one of the basic compounds that affects the environment inside and out. In this way, the water control center is important to see water quality in large areas such as lake, stream, and hydroponics. Looking at the level of pollution, water surveys are becoming more widespread. Guidelines for identifying water quality essentially exacerbate the deterioration of water quality. To think about this substance, we need a web control center for water quality integration.

VisTAS: blockchain-based visible and trusted remote authentication system.

The information security domain focuses on security needs at all levels in a computing environment in either the Internet of Things, Cloud Computing, Cloud of Things, or any other implementation. Data, devices, services, or applications and communication are required to be protected and provided by information security shields at all levels and in all working states. Remote authentication is required to perform different administrative operations in an information system, and Administrators have full access to the system and may pose insider threats. Superusers and administrators are the most trusted persons in an organisation. “Trust but verify” is an approach to have an eye on the superusers and administrators. Distributed ledger technology (Blockchain-based data storage) is an immutable data storage scheme and provides a built-in facility to share statistics among peers. Distributed ledgers are proposed to provide visible security and non-repudiation, which securely records administrators’ authentications requests. The presence of security, privacy, and accountability measures establish trust among its stakeholders. Securing information in an electronic data processing system is challenging, i.e., providing services and access control for the resources to only legitimate users. Authentication plays a vital role in systems’ security; therefore, authentication and identity management are the key subjects to provide information security services. The leading cause of information security breaches is the failure of identity management/authentication systems and insider threats. In this regard, visible security measures have more deterrence than other schemes. In this paper, an authentication scheme, “VisTAS,” has been introduced, which provides visible security and trusted authentication services to the tenants and keeps the records in the blockchain.

Revisited—The Subliminal Channel in Blockchain and Its Application to IoT Security

Although digital signature has been a fundamental technology for cryptosystems, it still draws considerable attention from both academia and industry due to the recent raising interest in blockchains. This article revisits the subliminal channel existing digital signature and reviews its abuse risk of the constructor’s private key. From a different perspective on the subliminal channel, we find the new concept named the chamber of secrets in blockchains. The found concept, whereby the secret is hidden and later recovered by the constructor from the common transactions in a blockchain, highlights a new way to encourage implementing various applications to benefit efficiency and security. Thus, the proposed scheme benefits from the following advantages: (1) avoiding the high maintenance cost of certificate chain of certificate authority, or public key infrastructure, and (2) seamlessly integrating with blockchains using the property of chamber of secrets. In order to easily understand the superiority of this new concept, a remote authentication scenario is taken as a paradigm of IoT to demonstrate that the further advantages are achieved: (1) avoiding high demand for storage space in IoT devices, and (2) avoiding maintaining a sensitive table in IoT server.

Dynamic Forest of Random Subsets‐based supervised hash signature scheme for secure user authentication in smart home environment

SummaryThe advent of information and communication technology has revolutionized the application of smart home through which the residents remotely establish superior control over the smart devices. The users and the smart devices interact over an insecure communication channel that may help an illegitimate user to gain access on the data disseminated by the smart devices, resulting in high exploiting attacks like privileged insider attack, smart device and gateway node impersonation attack, and smart node capture attack in the smart home. Thus, a secure remote authentication scheme that permits only legitimate users to gain access to the smart devices based on supervised learning becomes essential. In this article, Dynamic Forest of Random Subsets‐based supervised hash signature (DFORS‐SHS) scheme is proposed for robust user authentication in smart homes. This proposed DFORS‐SHS scheme concurrently performs the signed generation of random subsets such that each element of a signature is used for the generation of successive random subset elements for authentication. It utilized the strength of revealed secret keys through chaining approach that bundles the random subset generation and signature. This supervised learning approach only permits the signer of the original message to potentially generate a random subset and prevents the malicious intruder from gaining the access of the smart devices. The formal verification and the security investigation of the proposed DFORS‐SHS scheme are conducted using the Burrows‐Abadi‐Needham (BAN) and AVIPSA toolkit for determining communication cost, communication time, computation time, and energy consumptions incurred during the authentication process. It can be stated that, the communication cost and storage costs of the proposed DFORS‐SHS scheme was also identified to be comparatively minimized than the baseline smart home authentication schemes.

Trends in blockchain-based electronic voting systems

Electronic voting systems face many challenges, including authentication, privacy, data integrity, transparency and verifiability. However, the developed over 10 years ago blockchain technology provides an out-of-the-box solution for many of those challenges. Despite that, some issues are still to be solved, like remote authentication, anonymity and end-to-end verifiability. For this reason, research on new and better blockchain-based systems is still ongoing. The main goal of this study is to highlight the current trends in this research and its eventual shortcomings. This was accomplished by conducting a Systematic Literature Review (SLR) (Kitchenham and Charters, 2007), which resulted in selecting 35 publications. The performed SLR allowed to define trends in utilized blockchain technologies, intended scenarios, testing methods, main benefits and challenges faced by various systems and the most used cryptographic solutions.

Privacy-preserving and verifiable multi-instance iris remote authentication using public auditor

Homomorphic Encryption (HE) is the most widely explored research area to construct privacy-preserving biometric authentication systems due to its advantages over cancelable biometrics and biometric cryptosystem. However, most of the existing privacy-preserving biometric authentication systems using HE assume that the server performs computations honestly. In a malicious server setting, the server may return an arbitrary result to save the computational resources results in false accept/reject. To address this, we propose a privacy-preserving and verifiable multi-instance iris authentication using public auditor (PviaPA). Paillier HE provides confidentiality for the iris templates in PviaPA. A public auditor ensures the correctness of comparator result in PviaPA. Extensive experimental results on benchmark iris databases demonstrate that PviaPA provides privacy to the iris templates with no loss in the accuracy as well as trust on the comparator result.

A biometric-based Password Authentication with key Exchange Scheme using Mobile Device for Multi-Server Environment

Remote authentication for multi-server environment can help users register only once and access arbitrary services conveniently in the same registry realm. However, most of the solutions are plagued by security problems. In this paper, we point out that 'a novel smart card and dynamic ID based remote user authentication scheme for multi-server environment' is vul nerable to user impersonation attack, server masquerade attack and cannot achieve forward secrecy. Therefore, by introducing biometrics as the third authentication factor, we devise an enhanced three-factor based remote authentication with key agreement scheme for multi- server environment. In our designation, we combine the technologies of Client Puzzle, Fuzzy Extractor, message authentication code (MAC) and Diffie-Hellman key exchange. Moreover, our proposal not only maintains the advantages of the original, but also preserves user privacy with optional access mode. Meanwhile, it can be also reduced to two-factor based scheme with less security properties for specific applications. Finally, the proposed scheme is p roved to work correctly through BAN-Logic, and the security analysis and performance cost are discussed to show that our proposal is more secure, robust and practical.

Robust and provable secure three-factor mutual authentication scheme using a smart card

The best solution to perform remote authentication verification is offered by the authentication scheme that opts a smart card. Such schemes are developed by using the combination of password and biometric identity. Biometric-based authentication schemes provide the most prominent security, when compared to the alternative schemes available for authentication. In this paper, a provable secure three-factor authentication scheme that makes use of smart card has been proposed. This authentication scheme is developed based on fundamental assumption of discrete logarithm problem and modular exponentiation. The formal and informal security analysis for the proposed scheme shows that the authentication scheme is more secure. The efficiency of this scheme is calculated based on the performance analysis for both computational and communication cost. It shows that the proposed authentication scheme is performing well, when compared to the related authentication schemes.