Remote User Authentication Research Articles

ITSSAKA-MS: An Improved Three-Factor Symmetric-Key Based Secure AKA Scheme for Multi-Server Environments

A variety of three-factor smart-card based schemes, specifically designed for telecare medicine information systems (TMIS) are available for remote user authentication. Most of the existing schemes for TMIS are customarily proposed for the single server-based environments and in a single-server environment. Therefore, there is a need for patients to distinctly register and login with each server to employ distinct services, so it escalates the overhead of keeping the cards and memorizing the passwords for the users. Whereas, in a multi-server environment, users only need to register once to resort various services for exploiting the benefits of a multi-server environment. Recently, Barman et al. proposed an authentication scheme for e-healthcare by employing a fuzzy commitment and asserted that the scheme can endure many known attacks. Nevertheless, after careful analysis, this paper presents the shortcoming related to its design. Furthermore, it proves that the scheme of Barman et al. is prone to many attacks including: server impersonation, session-key leakage, user impersonation, secret temporary parameter leakage attacks as well as its lacks user anonymity. Moreover, their scheme has the scalability issue. In order to mitigate the aforementioned issues, this work proposes an amended three-factor symmetric-key based secure authentication and key agreement scheme for multi-server environments (ITSSAKA-MS). The security of ITSSAKA-MS is proved formally under automated tool AVISPA along with a security feature discussion. Although, the proposed scheme requisites additional communication and computation costs. In contrast, the informal and automated formal security analysis indicate that only proposed scheme withstands several known attacks as compared to recent benchmark schemes.

Elliptic Curve Cryptography based Secure and Efficient Authentication Protocol for Smart Card Users

Communication scheme which is used to have communication between authorized remote users over an insecure network is generally the authentication scheme which uses the password for the authentication. Remote user authentication techniques using the smart card have been proposed by many researchers. The main benefit of using the smart card is the storage availability and the computation speed. Huang et al. proposed a scheme for user authentication with smart cards which uses the concept of the timestamp. In Huang et al.’s protocol authors argued that their protocol is secure and efficient against any type of attack. Unfortunately Jung et al. show that Huang et al.’s model fails against the offline password guessing attack and with this scheme wrong password detection is not easy. In Huang et al.’s scheme, RSA cryptosystem is used to offer the authentication. In this article, advanced and secure smart card based authentication protocol using elliptic curve cryptography (ECC) is proposed. This proposed scheme thus overcomes all the possible drawbacks of Huang et al.’s scheme, and it has faster computation as compared to the available schemes

An Improved and Efficient RSA Based Remote User Authentication Scheme using Smart Card for Telecare Medical Systems

Password and Smart card are the authentication factors to access significant information from remote servers. Authentication schemes based on RSA which are studied intensively that are utilized in most of the telecare medical systems. Latest RSA based remote beneficiary validation scheme which does not resist against certain attacks, not satisfy functional properties and consume more computations. The existing previous schemes still have less functional strengths. However, these schemes cannot be efficient by means of performance which is measured in terms of computation and communication. The improvised scheme using smart card and hash functions remove security short comings and reduce the communication, computational cost. We compare the proposed scheme with the other current schemes, our scheme has less computational, communication cost, security attacks than other schemes and prove that it efficient one.

Security analysis and application of Chebyshev Chaotic map in the authentication protocols

ABSTRACT Due to the quick expansion and fast growth of computer networks, remote user's authentication and key agreement protocol is required. Chaotic maps play a very important role in the construction of authentication and key agreement protocol. Recently, many of the key agreement protocols are proposed based on chaotic maps and it can generate secure session key as well as resist known-key attacks. In this paper, it has been illustrated that most of the existing schemes cannot establish secure communication. Moreover, chaotic map-based authentications schemes have been found vulnerable to identity guessing, password guessing, impersonation, stolen smart card, and violation of session key attacks. Although some of the protocol has advantages of low computation cost but they lacks to attain security attributes. Moreover, these schemes do not support verified session key security with a minimum number of messages exchanged. Therefore, a chaotic map-based authentication scheme is essential to overcome existing weaknesses.

HomeChain: A Blockchain-Based Secure Mutual Authentication System for Smart Homes

Increasingly, governments around the world, particularly in technologically advanced countries, are exploring or implementing smart homes, or the related smart facilities for the benefits of the society. The capability to remotely access and control Internet of Things (IoT) devices (e.g., capturing of images, audios, and other information) is convenient but risky, as vulnerable devices can be exploited to conduct surveillance or perform other nefarious activities on the users and organizations. This highlights the necessity of designing a secure and efficient remote user authentication solution. Most of the existing solutions for this problem are generally based on a single-server architecture, which has limitations in terms of privacy and anonymity (leading to users’ daily activities being predicted), and integrity and confidentiality (resulting in an unreliable behavior auditing). While blockchain-based solutions may mitigate these issues, they still face some critical challenges (e.g., providing regulation of behaviors and privacy protection of access policy). Motivated by these facts, in this article, we construct a novel secure mutual authentication system, which can be applied in smart homes and other applications. Specifically, the proposed approach integrates blockchain, group signature, and message authentication code to provide reliable auditing of users’ access history, anonymously authenticate group members, and efficiently authenticate home gateway, respectively. We also prove the security and privacy requirements, including anonymity, traceability, and confidentiality, that the proposed system satisfies, with an implementation and evaluation to demonstrate its practicality.

AGE: authentication in gadget-free healthcare environments

Mobile and sensor related technologies are significantly revolutionizing the medical and healthcare sectors. In current healthcare systems, gadgets are the prominent way of acquiring medical services. However, the recent technological advancements in smart and ambient environments are offering users new ways to access the healthcare services without using any explicit gadgets. One of the key challenges in such gadget-free environments is performing secure user authentication with the intelligent surroundings. For example, a secure, efficient and user-friendly authentication mechanism is essential for elderly/disabled people or patients in critical conditions requiring medical services. Hence, modern authentication systems should be sophisticated enough to identify such patients without requiring their physical efforts or placing gadgets on them. This paper proposes an anonymous and privacy-preserving biometrics based authentication scheme for such gadget-free healthcare environment. We performed formal security verification of our proposed scheme using CDVT /AD tool and our results indicate that the proposed scheme is secure for such smart and gadget-free environments. We verify that the proposed scheme can resist against various well-known security attacks. Moreover, the proposed system showed better performance as compared with existing biometrics based remote user authentication schemes.

Security analysis of a Novel Remote User Authentication Scheme

Security analysis of a Novel Remote User Authentication Scheme

Sparse coding-based feature extraction for biometric remote authentication in Internet of Things

In recent years, Internet of Things (IoT) has attracted lots of attention. However, the security related issues such as authentication remain a challenge. The heterogeneity of IoT in terms of devices and communication makes most existing authentication mechanisms inapplicable. So, there is a need for a two-factor authentication mechanism to obtain an end-to-end authentication between IoT devices/applications. In this paper, we propose a sparse coding based feature extraction for biometric remote user authentication. The proposed scheme makes use of sparse codes hash operations and overcomplete dictionary to store/retrieve the biometric data efficiently. The performance analysis proves that the proposed method is robust against noise and able to obtain the accuracy of 0.97.

A Secure and Efficient ECC-Based Anonymous Authentication Protocol

Nowadays, remote user authentication protocol plays a great role in ensuring the security of data transmission and protecting the privacy of users for various network services. In this study, we discover two recently introduced anonymous authentication schemes are not as secure as they claimed, by demonstrating they suffer from offline password guessing attack, desynchronization attack, session key disclosure attack, failure to achieve user anonymity, or forward secrecy. Besides, we reveal two environment-specific authentication schemes have weaknesses like impersonation attack. To eliminate the security vulnerabilities of existing schemes, we propose an improved authentication scheme based on elliptic curve cryptosystem. We use BAN logic and heuristic analysis to prove our scheme provides perfect security attributes and is resistant to known attacks. In addition, the security and performance comparison show that our scheme is superior with better security and low computation and communication cost.

A secure multifactor remote user authentication scheme for Internet of Multimedia Things environment

SummaryTo attain ubiquitous connectivity of everything, Internet of Things (IoT) systems must include “multimedia things.” Internet of Multimedia Things (IoMT) is a heterogeneous network of smart multimedia things connected together and with other physical devices to the Internet so as to achieve globally available multimedia services and applications. Due to the ever increasing amount of multimedia data in IoT environments, securing these systems becomes crucial. This is because these systems are easily susceptible to attacks when information or any service is accessed by the users. In this paper, we propose a secure three‐factor remote user authentication scheme for IoMT systems using ECC. The formal security proof performed using ROR model and BAN logic confirms that an attacker will not be able to extract sensitive user information. Through informal security analysis, we justify the resistance of the scheme against several security attacks. The performance comparison shows that the scheme is efficient in terms of computational cost, security features, and attack resistance. Furthermore, simulation of the scheme using AVISPA and Proverif proves that the scheme is secure against all active and passive attacks.

Robust Multiple Servers Architecture Based Authentication Scheme Preserving Anonymity.

Recently, many dynamic ID based remote user authentication schemes using smart card have been proposed to improve the security in multiple servers architecture authentication systems. In 2017, Kumari and Om proposed an anonymous multi-server authenticated key agreement scheme, which is believed to be secure against a range of network attacks. Nevertheless, in this paper we reanalyze the security of their scheme, and show that the scheme is vulnerable to impersonation attack and server spoofing attack launched by any adversary without knowing any secret information of the victim users. In addition, their protocol fails to achieve the claimed user privacy protection. For handling these aforementioned shortcomings, we introduce a new biometric-based authentication scheme for multi-server architecture preserving user anonymity. Besides, Burrows—Abadi—Needham (BAN)-logic validated proof and discussion on possible attacks demonstrate the completeness and security of our scheme, respectively. Further, the comparisons in terms of security analysis and performance evaluation of several related protocols show that our proposal can provide stronger security without sacrificing efficiency.

A Cancelable Iris- and Steganography-Based User Authentication System for the Internet of Things.

Remote user authentication for Internet of Things (IoT) devices is critical to IoT security, as it helps prevent unauthorized access to IoT networks. Biometrics is an appealing authentication technique due to its advantages over traditional password-based authentication. However, the protection of biometric data itself is also important, as original biometric data cannot be replaced or reissued if compromised. In this paper, we propose a cancelable iris- and steganography-based user authentication system to provide user authentication and secure the original iris data. Most of the existing cancelable iris biometric systems need a user-specific key to guide feature transformation, e.g., permutation or random projection, which is also known as key-dependent transformation. One issue associated with key-dependent transformations is that if the user-specific key is compromised, some useful information can be leaked and exploited by adversaries to restore the original iris feature data. To mitigate this risk, the proposed scheme enhances system security by integrating an effective information-hiding technique—steganography. By concealing the user-specific key, the threat of key exposure-related attacks, e.g., attacks via record multiplicity, can be defused, thus heightening the overall system security and complementing the protection offered by cancelable biometric techniques.

Security-enhanced three-factor remote user authentication scheme based on Chebyshev chaotic maps

With the wide deployment of new computing paradigms, such as cloud computing and edge computing, the people can access services provided by remote servers more conveniently via the Internet. To pre...

An Enhanced and Secure Biometric Based User Authentication Scheme in Wireless Sensor Networks Using Smart Cards

Over the last two?decades, several researchers have recommended many remote user authentication schemes, following since introducing the concept way back in 1981. Researchers are continuously trying to enhance the security in authentication protocols by incorporating the several features into their work. A few years back, Turkanovic et al. (Ad Hoc Netw 20:96---112, 2014) have presented a novel work for authenticating users in IOT environment using smart cards for wireless sensor networks. In this paper, we have demonstrated that their scheme doesn't resist many possible security threats and have numerous flaws, and also proposed an enhanced and secure biometric-based user authentication technique to overcome their weaknesses. The stated protocol not only overcome from the flaws of Turkanovic et al.'s scheme but also reduce the computation overhead as well. Later, to proving the mutual authentication among the entities and session key secrecy of the proposed scheme has also been verified by ProVerif (2.0) simulation tool.

Lightweight and Secure Password Based Smart Home Authentication Protocol: LSP-SHAP

Remote control his smart home from his mobile device is highly desirable for a mobile user. But, the sensor devices and the user mobile device communicate over an insecure communication channel. Therefore, various attacks are possible, such as impersonation attack, privileged-insider attack, mobile device stolen attack, and the denial of service attack. In this case, an illegal user may gain access to the data sent by the smart devices. In the literature, most of the existing schemes for the remote user authentication are not secure enough with respect to the aforementioned attacks. In addition, they are not enough lightweight at the sensor device side. Therefore, there is a need to design a new secure and lightweight remote user authentication scheme, where only the authorized users may have access to the home sensor devices. So, in this paper, we propose a new secure and lightweight remote user authentication scheme for a smart home environment. For the derivation of a robust session key, we propose to use Elliptic Curve Cryptography. The solution is lightweight for resource-constrained devices with limited resources as the gateway node will assist in deriving the session key to the sensor device. The security of the proposed solution is proved using a formal security evaluation via the Scyther tool. Also, a performance evaluation is performed to show the effectiveness of our solution.

생체정보인식 기반의 원격 사용자 인증 스킴에 대한 보안분석

생체정보인식 기반의 원격 사용자 인증 스킴에 대한 보안분석

Advanced lightweight multi-factor remote user authentication scheme for cloud-IoT applications

With the ongoing revolution of Internet-enabled devices, Internet of Things (IoT) has emerged as the most popular networking paradigm. The enormous amount of data generated from smart devices in IoT environment is one of the biggest concerns. Cloud computing has emerged as a key technology to process the generated data. The confidential data of user from IoT devices is stored in cloud server and the remote user can access this data anytime, anywhere and at any place from the cloud server. This makes remote user authentication a critical issue. This paper proposes a lightweight remote user authentication scheme for cloud-IoT applications. The formal security analysis using BAN logic and random oracle model confirms that the scheme is resilient to known security attacks. Furthermore, the scheme is formally verified using AVISPA tool which confirms the security against multiple security attacks.

An enhanced anonymous and unlinkable user authentication and key agreement protocol for TMIS by utilization of ECC

SummaryThe telecare medicine information systems (TMISs) not only help patients to receive incessant health care services but also assist the medical staffs to access patients' electronic health records anytime and from anywhere via Internet. Since the online communications are exposed to numerous security threats, the mutual authentication and key agreement between patients and the medical servers are of prime significance. During the recent years, various user authentication schemes have been suggested for the TMISs. Nonetheless, most of them are susceptible to some known attacks or have high computational cost. Newly, an effective remote user authentication and session key agreement protocol has been introduced by Ravanbakhsh and Nazari for health care systems. Besides the nice contributions of their work, we found that it has two security weaknesses, namely, known session‐specific temporary information attack and lack of perfect forward secrecy. As a result, to overcome these deficiencies, this paper suggests a novel anonymous and unlinkable user authentication and key agreement scheme for TMISs using the elliptic curve cryptosystem (ECC). We have evaluated the security of the proposed scheme by applying the automated validation of internet security protocols and applications (AVISPA) tool with the intention of indicating that our scheme can satisfy the vital security features. In addition, we have compared the proposed protocol with related schemes to show that it has a proper level of performance. The obtained results demonstrate that the new scheme is more preferable considering both efficiency and security criteria.

Lightweight remote user authentication protocol for multi-server 5G networks using self-certified public key cryptography

Due to small cell deployments and multiple servers in 5G networks, a fast and anonymous mutual authentication protocol needs to be developed for complex 5G networks. In this paper, we propose a lightweight and untraceable authentication protocol for multi-server-based 5G networks. To reduce computational complexity, we employ self-certified public key cryptography based on elliptic curve cryptography to authenticate the validation of users and servers. Without pairing operations, our scheme could improve performance efficiency. Also, a formal security model is designed to prove that our protocol is secure against forgery attack due to the discrete logarithm and the computational Diffie-Hellman problem. Performance analysis further shows that our protocol has a lower communication and computational overhead. Also, our protocol could support anonymous mutual authentication.

RETRACTION: Cryptanalysis and enhancement of multi factor remote user authentication scheme based on signcryption

<p style='text-indent:20px;'>Advances in Mathematics of Communications, (2020)</p><p style='text-indent:20px;'>This paper is retracted by decision of one of the Editors in Chief of the journal Advances in Mathematics of Communications.</p>