Secure Password Authentication Research Articles

Practical and Secure Password Authentication and Key-Agreement-Scheme-Based Dual Server for IoT Devices in 5G Network

Practical and Secure Password Authentication and Key-Agreement-Scheme-Based Dual Server for IoT Devices in 5G Network

A Provably Secure and Efficient Remote Password Authentication Scheme Using Smart Cards

Communication technology has advanced dramatically amid the 21^st century, increasing the security risk in safeguarding sensitive information. The remote password authentication (RPA) scheme is the simplest cryptosystem that serves as the first line of defence against unauthorised entity attacks. Although the literature contains numerous RPA schemes, to the best of the authors’ knowledge, only few schemes based on the integer factorisation problem (IFP) and the discrete logarithm problem (DLP) that provided a provision for session key agreement to ensure proper mutual authentication. Furthermore, none of the previous schemes provided formal security proof using the random oracle model. Therefore, this study proposed an improved RPA scheme with session key establishment between user and server. The design of the proposed RPA scheme is based on the widely established Dolev-Yao adversary model. Moreover, as the main contribution, a novel formal security analysis based on formal definitions of IFP and DLP under the random oracle model was presented. The proposed scheme's performance was compared to that of other similar competitive schemes in terms of the transmission/computational cost and time complexity. The findings revealed that the proposed scheme required higher memory storage costs in smart cards. Nonetheless, the proposed scheme is more efficient regarding the transmission cost of login and response messages and the total time complexity compared to other scheme of similar security attributes. Overall, the proposed scheme outperformed the other RPA schemes based on IFP and DLP. Finally, the potential application of converting the RPA scheme to a user identification (UI) scheme is considered for future work. Since RPA and UI schemes are similar, the proposed approach can be expanded to develop a provably secure and efficient UI scheme based on IFP and DLP.

Encryption Technique for Secure Password Authentication Scheme at Application Layer

Encryption Technique for Secure Password Authentication Scheme at Application Layer

Security Vulnerabilities and Improvements of SPAM: a Secure Password Authentication Mechanism for Seamless Handover in Proxy Mobile IPv6 Networks

The main contribution of this paper is to analyze a secure passwordauthentication mechanism (SPAM), proposed by Chuang et al. in 2013(IEEE Syst J.). The SPAM was used for designing a secure handover inProxy Mobile IPv6 (PMIPv6) networks. Chuang et al. in the originalpaper claimed that SPAM provides high security properties and canresist various attacks. However, in this paper we point out thatSPAM is vulnerable to the critical attacks, such as stolen smartcard and off-line dictionary attack, replay attack and impersonationattack. In addition, we show that the identity of MNs and thesession key between MN and MAG can be disclosed by an insiderattacker; resultantly, anonymity and confidentiality between MNs andMAG will be completely broken in SPAM. As a remedy, we also propose an improved scheme which not only conquers the problems of the previous schemes but also provides a reduction in computational cost. Moreover, the proposed scheme provides the user anonymity and untraceability and secure session key agreement. Finally, the security of the improved protocol is proved in the random oracle model.DOI: http://dx.doi.org/10.5755/j01.itc.46.2.12118

SPFP: Ticket-based secure handover for fast proxy mobile IPv6 in 5G networks

Recently, Chuang et al. introduced a secure password authentication mechanism, called SPAM, for seamless handovers in Proxy Mobile IPv6 (PMIPv6). SPAM aimed at providing high security properties while optimizing handover latency and computation overhead, but as pointed out in this paper SPAM is vulnerable to replay and malicious insider attacks as well as the compromise of a single node. In this paper, a new Security Protocol for Fast PMIPv6, called SPFP, is proposed that provides a ticket-based secure handover for mobile nodes (MNs). In SPFP, a ticket containing authentication materials is used for fast handover authentication when an MN changes its attachment point. Moreover, the MN’s anonymity is supported for preserving location privacy. Detailed operations of initial authentication and handover authentication are presented with message flows. The formal security analysis of SPFP is provided with results of qualitative analysis and quantitative analysis.

A Secure and Efficient One-time Password Authentication Scheme for WSN

An algorithm that a user has authenticated over remote devices should be designed to consider the limitations of computation and lower power in a wireless sensor net- works. Lamport first proposed a one-time password authentication scheme which the password was different in each transaction. In this paper, according to the Lam- port's concept we propose an efficient and secure one- time password authentication scheme for wireless sensor networks.

Cryptanalysis and Improvement of "A Secure Password Authentication Mechanism for Seamless Handover in Proxy Mobile IPv6 Networks".

Proxy Mobile IPv6 is a network-based localized mobility management protocol that supports mobility without mobile nodes’ participation in mobility signaling. The details of user authentication procedure are not specified in this standard, hence, many authentication schemes have been proposed for this standard. In 2013, Chuang et al., proposed an authentication method for PMIPv6, called SPAM. However, Chuang et al.’s Scheme protects the network against some security attacks, but it is still vulnerable to impersonation and password guessing attacks. In addition, we discuss other security drawbacks such as lack of revocation procedure in case of loss or stolen device, and anonymity issues of the Chuang et al.’s scheme. We further propose an enhanced authentication method to mitigate the security issues of SPAM method and evaluate our scheme using BAN logic.

Provably Secure and Anonymous Password Authentication Protocol for Roaming Service in Global Mobility Networks Using Extended Chaotic Maps

In recent years, many anonymous password-based mobile user authentication techniques have been constructed for roaming service in global mobility networks. However, such type of protocol has not yet been devised in the random oracle model using extended chaotic map. Therefore, in this paper, we put forwarded a new provably secure and privacy-preserving password authentication protocol using extended chaotic maps for roaming service in wireless networks. The proposed protocol is provably secure and protects active and passive attacks under the chaotic maps-based Diffie-Hellman (CDH) assumption in the random oracle model. The proposed protocol is also analyzed and compared with the related protocol. The results proved that it is strong enough to resist different security vulnerabilities and efficient against the existing protocol.

Comments on “SPAM: A Secure Password Authentication Mechanism for Seamless Handover in Proxy Mobile IPv6 Networks”

Recently, Chuang et al. have introduced a secure password authentication mechanism for seamless handover in Proxy Mobile IPv6 (SPAM). SPAM aimed at providing high-security properties while optimizing the handover latency and the computation overhead. However, it is still vulnerable to replay and malicious insider attacks, as well as the compromise of a single node. This paper formally and precisely analyzes SPAM based on the Burrows–Abadi–Needham logic, followed by its weaknesses and related attacks.

Secure Password Authentication Approach using Cued Click Points

Secure Password Authentication Approach using Cued Click Points

漏えいに強いパスワード認証とその応用

漏えいに強いパスワード認証とその応用

A Generic Framework for Anonymous Authentication in Mobile Networks

Designing an anonymous user authentication scheme in global mobility networks is a non-trivial task because wireless networks are susceptible to attacks and mobile devices powered by batteries have limited communication, processing and storage capabilities. In this paper, we present a generic construction that converts any existing secure password authentication scheme based on a smart card into an anonymous authentication scheme for roaming services. The security proof of our construction can be derived from the underlying password authentication scheme employing the same assumptions. Compared with the original password authentication scheme, the transformed scheme does not sacrifice the authentication efficiency, and additionally, an agreed session key can be securely established between an anonymous mobile user and the foreign agent in charge of the network being visited. Furthermore, we present an instantiation of the proposed generic construction. The performance analysis shows that compared with other related anonymous authentication schemes, our instantiation is more efficient.

SPAM: A Secure Password Authentication Mechanism for Seamless Handover in Proxy Mobile IPv6 Networks

The Internet Engineering Task Force NETLMM Working Group recently proposed a network-based localized mobility management protocol called Proxy Mobile IPv6 (PMIPv6) to support mobility management without the participation of mobile nodes in any mobility-related signaling. Although PMIPv6 reduces the signaling overhead and the handover latency, it still suffers from packet loss problem and long authentication latency during handoff. In addition, there are many security threats to PMIPv6. In this paper, we perform a bicasting scheme for avoiding the packet loss problem, use the piggyback technique to reduce the signaling overhead, and provide a secure password authentication mechanism (SPAM) for protecting a valid user from attacks in PMIPv6 networks. SPAM provides high security properties, including anonymity, stolen-verified attack resistance, location privacy, mutual authentication, forgery attack resistance, no clock synchronization problem, modification attack resistance, replay attack resistance, fast error detection, choose and change password free, and session key agreement. Moreover, SPAM is an efficient authentication scheme that performs the authentication procedure locally and has low computational cost. From the analysis, we demonstrate that our scheme can resist various attacks and provides better performance than existing schemes.

An Extended Multi-Server-Based User Authentication and Key Agreement Scheme with User Anonymity

With the explosive growth of computer networks, many remote service providing servers and multi-server network architecture are provided and it is extremely inconvenient for to remember numerous different identities and passwords. Therefore, it is important to provide a mechanism for a remote user to use single identity and password to access multi-server network architecture without repetitive registration and various multi-server authentication schemes have been proposed in recent years. Recently, Tsaur et al. proposed an efficient and secure smart card based user authentication and key agreement scheme for multi-server environments. They claimed that their scheme satisfies all of the requirements needed for achieving secure password authentication in multi-server environments and gives the formal proof on the execution of the proposed authenticated key agreement scheme. However, we find that Tsaur et al.s scheme is still vulnerable to impersonation attack and many logged-in attack. We propose an extended scheme that not only removes the aforementioned weaknesses on their scheme but also achieves user anonymity for hiding login users real identity. Compared with other previous related schemes, our proposed scheme keeps the efficiency and security and is more suitable for the practical applications.

Reasoning about Resources and Information: A Linear Logic Approach

A logic called sequence-indexed linear logic SLL is proposed to appropriately formalize resource-sensitive reasoning with sequential information. The completeness and cut-elimination theorems for SLL are proved, and SLL and a fragment of SLL are shown to be undecidable and decidable, respectively. As an application of SLL, some specifications of secure password authentication systems are discussed.

Attack and Improvement of the Secure Password Authentication Protocol in Wireless Networks

Password authentication protocols are widely used mechanisms to authenticate identities in networks. In 2006, Yoon et al. proposed a secure password authentication protocol in wireless networks that fixed the drawback of Ma et al.’s protocol. In this article we show that the Yoon et al.’s protocol is still vulnerable to the off-line password guessing attack. We propose an improvement to solve the problem. The improvement protocol is secure while the computation cost is the same with Yoon et al.’s protocol.

Efficient and secure password authentication schemes for low-power devices

In 2003, Lin et al. proposed an improvement on the Optimal Strong-Password Authentication (OSPA) scheme to make the scheme withstand the stolen-verifier attack, using smart card. However, Ku et al. showed that Lin et al.'s scheme is vulnerable to the replay and the denial of service attack. In 2004, Chen et al. proposed a secure SAS-like password authentication schemes. Their schemes can protect a system against replay and denial-of-service attacks. In this paper, we propose two efficient and secure password authentication schemes which are able to withstand replay and denial-of-service attacks. The proposed schemes are more efficient than Chen et al.'s schemes in computation costs. Moreover, the proposed schemes can be implemented on most of target low-power devices such as smart cards and low-power Personal Digital Assistants in wireless networks.

Impersonation Attack on Two-Gene-Relation Password Authentication Protocol (2GR)

In 2004, Tsuji and Shimizu proposed a one-time password authentication protocol, named 2GR (Two-Gene-Relation password authentication protocol). The design goal of the 2GR protocol is to eliminate the stolen-verifier attack on SAS-2 (Simple And Secure password authentication protocol, ver.2) and the theft attack on ROSI (RObust and SImple password authentication protocol). Tsuji and Shimizu claimed that in the 2GR an attacker who has stolen the verifiers from the server cannot impersonate a legitimate user. This paper, however, will point out that the 2GR protocol is still vulnerable to an impersonation attack, in which any attacker can, without stealing the verifiers, masquerade as a legitimate user.

Cryptanalysis of Yeh-Shen-Hwang's One-Time Password Authentication Scheme

Yeh, Shen, and Hwang recently proposed a secure one-time password authentication scheme using smart cards. They modified the famous S/KEY scheme to achieve security against preplay attacks and off-line dictionary attacks. However, this article shows that their scheme is vulnerable to preplay attacks.

Smart card based secure password authentication scheme

This paper presents a smart card based remote access password authentication scheme which can verify a log-in password without verification table. It utilizes the signature property of public key systems. The security of our scheme rests in part on the difficulty of factoring a large number and on the discrete logarithm problem. Not only can the network users freely choose their preferred passwords, but the network system can also be protected against replay by time stamping the password.