Secure Remote User Authentication Scheme Research Articles

SecFHome: Secure remote authentication in fog-enabled smart home environment

Fog computing is the best solution for IoT applications with low latency and real-time interaction. Fog can endow smart home with many smart functions and services. One of the most important services is that users can remotely access and control smart devices. Since remote users and smart homes communicate through insecure channels, it is necessary to design a secure and effective remote authentication scheme to guarantee secure communications. The existing authentication schemes designed for smart homes have some security issues and are not suitable for fog-enabled smart home environments. Therefore, this paper designs a secure remote user authentication scheme, SecFHome. It supports secure communication at the edge of the network and remote authentication in fog-enabled smart home systems. Specifically, We present an efficient authentication mode in the fog-enabled environment, which includes the edge negotiation phase and the authentication phase. SecFHome adds updated information to the authenticator, which can verify the message synchronization simultaneously with the authentication, thus improving the authentication efficiency. In addition, SecFHome does not store sensitive information of users and smart devices in the memory of the smart gateway, which can avoid various attacks caused by the compromised gateway. The formal security proof and informal security analysis show that the SecFHome is secure and can resist known attacks. Compared with the related authentication schemes, SecFHome only needs fewer communication costs and computation costs, and achieves more security features.

A secure remote user authentication scheme for 6LoWPAN-based Internet of Things.

One of the significant challenges in the Internet of Things (IoT) is the provisioning of guaranteed security and privacy, considering the fact that IoT devices are resource-limited. Oftentimes, in IoT applications, remote users need to obtain real-time data, with guaranteed security and privacy, from resource-limited network nodes through the public Internet. For this purpose, the users need to establish a secure link with the network nodes. Though the IPv6 over low-power wireless personal area networks (6LoWPAN) adaptation layer standard offers IPv6 compatibility for resource-limited wireless networks, the fundamental 6LoWPAN structure ignores security and privacy characteristics. Thus, there is a pressing need to design a resource-efficient authenticated key exchange (AKE) scheme for ensuring secure communication in 6LoWPAN-based resource-limited networks. This paper proposes a resource-efficient secure remote user authentication scheme for 6LoWPAN-based IoT networks, called SRUA-IoT. SRUA-IoT achieves the authentication of remote users and enables the users and network entities to establish private session keys between themselves for indecipherable communication. To this end, SRUA-IoT uses a secure hash algorithm, exclusive-OR operation, and symmetric encryption primitive. We prove through informal security analysis that SRUA-IoT is secured against a variety of malicious attacks. We also prove the security strength of SRUA-IoT through formal security analysis conducted by employing the random oracle model. Additionally, we prove through Scyther-based validation that SRUA-IoT is resilient against various attacks. Likewise, we demonstrate that SRUA-IoT reduces the computational cost of the nodes and communication overheads of the network.

An improved privacy preserving remote user authentication scheme for agricultural wireless sensor network

AbstractAgriculture is a fundamental pillar of society, bearing a crucial role in shaping the economy of the country and provides huge financial prospects and the possibility of employment to the large mass of the country. Thus, the incorporation of modern technology would lead to amplification in productivity and economic escalation. In this perspective, Wireless Sensor Network (WSN) can provide a greater service by sensing, monitoring and supplying continuous information about climatic conditions like temperature, light, soil moisture, humidity, and so on. These parameters help in increment of productivity in terms of quantity and quality growth in agriculture. However, WSN brings security threats like masquerading, alteration, interference, interception, and so on, that harmfully affect crop production and other agricultural practices. Thus, privacy preservation and security enhancement for agricultural WSN are the major challenges to be conquered. To meet this purpose, a privacy‐preserving efficient and secure remote user authentication scheme is introduced in this research work for the application of agricultural WSN. The proposed scheme is formally evaluated using probabilistic Random‐Oracle‐Model (ROR) for proving the robustness of the scheme. Further, the scheme is simulated using a well‐accepted AVISPA tool to show the security strength of it. The performance analysis of our scheme shows that along with its robustness in terms of security, the proposed scheme is more efficient in terms of computation and communication overheads in contrast to other existing schemes. These aforesaid features make the proposed scheme implementable in a practical environment.

Secure Remote User Authentication Scheme on Health Care, IoT and Cloud Applications: A Multilayer Systematic Survey

Secure Remote User Authentication Scheme on Health Care, IoT and Cloud Applications: A Multilayer Systematic Survey

An enhanced and provably secure multi-factor authentication scheme for Internet-of-Multimedia-Things environments

The Internet-of-Multimedia-Things (IoMT) opens new doors towards various contingencies to improve applications and services through efficient multimedia data usage. The ever-enlarging content of multimedia information in an IoT system makes it a critical security concern. Whenever users access services or information through a public channel, he/she is exposed to numerous security threats. Many security schemes have been introduced for IoMT environments to tackle the above-said concerns. Still, most of them do not fulfill all the security requirements of the IoMT systems. Recently, Dhillon and Karla have presented an authentication scheme for the IoMT environment. They have declared that the scheme is robust and can resist significant security attacks. However, we noticed that Dhillon and Kalra’s scheme is susceptible to user masquerading attacks and a stolen verifier attack. Besides, their scheme also violates the anonymity and traceability of a user. This paper proposes a more secure remote user authentication scheme using the elliptic curve cryptosystem for the IoMT system. We have evaluated our scheme formally through the random oracle model. The informal security description proves that our scheme provides resistance against significant security attacks. Further, the performance analysis reveals that our scheme is more flexible, robust, and efficient than the relevant schemes.

Secure remote anonymous user authentication scheme for smart home environment

Smart home technology is an emerging application of Internet-of-Things (IoT) where the user can remotely control home devices. Since the user/home communication channel is insecure, an efficient and anonymous authentication scheme is required to provide secure communications in smart home environment. In this paper, we propose a new scheme for user authentication that combines physical context awareness and transaction history. The new scheme offers two advantages: it does not maintain a verification table and avoids clock synchronization problem. Communication overhead and computational cost of the proposed scheme are analyzed and compared with other related schemes. The security of the scheme is evaluated using three different methods: (1) formal analysis using the Burrows-Abadi-Needham logic (BAN); (2) informal analysis; (3) model check using the automated validation of internet security protocols and applications (AVISPA) tool.

Secure Remote User Authenticated Key Establishment Protocol for Smart Home Environment

The Information and Communication Technology (ICT) has been used in wide range of applications, such as smart living, smart health and smart transportation. Among all these applications, smart home is most popular, in which the users/residents can control the operations of the various smart sensor devices from remote sites also. However, the smart devices and users communicate over an insecure communication channel, i.e., the Internet. There may be the possibility of various types of attacks, such as smart device capture attack, user, gateway node and smart device impersonation attacks and privileged-insider attack on a smart home network. An illegal user, in this case, can gain access over data sent by the smart devices. Most of the existing schemes reported in the literature for the remote user authentication in smart home environment are not secure with respect to the above specified attacks. Thus, there is need to design a secure remote user authentication scheme for a smart home network so that only authorized users can gain access to the smart devices. To mitigate the aforementioned isses, in this paper, we propose a new secure remote user authentication scheme for a smart home environment. The proposed scheme is efficient for resource-constrained smart devices with limited resources as it uses only one-way hash functions, bitwise XOR operations and symmetric encryptions/decryptions. The security of the scheme is proved using the rigorous formal security analysis under the widely-accepted Real-Or-Random (ROR) model. Moreover, the rigorous informal security analysis and formal security verification using the broadly-accepted Automated Validation of Internet Security Protocols and Applications (AVISPA) tool is also done. Finally, the practical demonstration of the proposed scheme is also performed using the widely-accepted NS-2 simulation.

A secure remote user authentication scheme for smart cities e-governance applications

Smart cities are rapidly gaining momentum and aims at improving the quality of life of citizens by adopting Information and Communication Technology. E-governance have become the smarter way of deployment of administration by the authority under its jurisdiction. The citizens can access the services of government anywhere at any time. Since this technique requires the transmission of sensitive information between the government and the citizen through the Internet, information security is of utmost importance. This paper proposes a lightweight, robust remote user authentication and key agreement protocol for e-governance applications in the smart cities. The proposed protocol is based on XOR and hash operations, and includes (1) a password and smart card, (2) user anonymity, (3) mutual authentication, (4) shared session key, and (5) key freshness. It satisfies desirable security attributes and is resistant against all well-known security attacks. Further, the formal security verification using AVISPA and informal security proves the security strength of the proposed protocol and its robustness against all possible security threats.

Security analysis and enhancements of an improved multi-factor biometric authentication scheme

Many remote user authentication schemes have been designed and developed to establish secure and authorized communication between a user and server over an insecure channel. By employing a secure remote user authentication scheme, a user and server can authenticate each other and utilize advanced services. In 2015, Cao and Ge demonstrated that An’s scheme is also vulnerable to several attacks and does not provide user anonymity. They also proposed an improved multi-factor biometric authentication scheme. However, we review and cryptanalyze Cao and Ge’s scheme and demonstrate that their scheme fails in correctness and providing user anonymity and is vulnerable to ID guessing attack and server masquerading attack. To overcome these drawbacks, we propose a security-improved authentication scheme that provides a dynamic ID mechanism and better security functionalities. Then, we show that our proposed scheme is secure against various attacks and prove the security of the proposed scheme using BAN Logic.

A Novel Authentication and Key Agreement Scheme for Implantable Medical Devices Deployment.

Implantable medical devices (IMDs) are man-made devices, which can be implanted in the human body to improve the functioning of various organs. The IMDs monitor and treat physiological condition of the human being (for example, monitoring of blood glucose level by insulin pump). The advancement of information and communication technology enhances the communication capabilities of IMDs. In healthcare applications, after mutual authentication, a user (for example, doctor) can access the health data from the IMDs implanted in a patient's body. However, in this kind of communication environment, there are always security and privacy issues, such as leakage of health data and malfunctioning of IMDs by an unauthorized access. To mitigate these issues, in this paper, we propose a new secure remote user authentication scheme for IMDs communication environment to overcome security and privacy issues in existing schemes. We provide the formal security verification using the widely accepted Automated Validation of Internet Security Protocols and Applications tool. We also provide the informal security analysis of the proposed scheme. The formal security verification and informal security analysis prove that the proposed scheme is secure against known attacks. The practical demonstration of the proposed scheme is performed using the broadly accepted NS2 simulation tool. The computation and communication costs of the proposed scheme are also comparable with the existing schemes. Moreover, the scheme provides additional functionality features, such as anonymity, untraceability, and dynamic implantable medical device addition.

Esquema seguro de autenticación de usuario basado en identificador dinámico utilizando cifrado simétrico y tarjetas inteligentes

En 2004, Das, Saxena & Gulati propusieron un nuevo esquema de autenticación basado en un identificador dinámico cuyo principal propósito fue evitar el ataque de robo de identidad. Desde ese momento, se han propuesto varios esquemas con la intención de mejorar la seguridad de esquemas previos. Sood et al., propusieron un nuevo esquema y claman que es más seguro que el esquema propuesto por Liou, Lin & Wang. Sin embargo, un estudio de criptoanálisis ha demostrado que su esquema continúa siendo vulnerable a los siguientes ataques: encontrar la clave secreta, suplantación de identidad, y robo de información de la base de datos, haciendo al esquema inseguro para su uso en servicios electrónicos. En este artículo se propone un nuevo esquema que resuelve las fallas de seguridad encontradas en el esquema de Sood y cumple con todas las características de seguridad que un esquema de autenticación de usuario remoto de ofrecer.Palabras clave: Criptoanálisis, autenticación mutua, seguridad en redes, tarjetas inteligentes

An Enhanced Secure Remote User Authentication Scheme without Verification Table

With the significant advances in communication networks over the last few decades, smart cards have been widely used in many e-commerce applications and network security protocols due to their low cost, portability, efficiency and cryptographic properties. In this paper, we analyze Sood et al.‟s smart card based authentication scheme and demonstrate that the scheme is vulnerable to masquerade user attack, offline password guessing attack, time concurrency weaknesses and fails to achieve mutual authentication. A secure dynamic identity based remote user authentication scheme without verification tables, is proposed in this paper and the scheme resolves the aforementioned problems of Sood et al.‟s scheme. The computation cost of the proposed scheme is comparable to Sood et al.‟s scheme and it is highly secure taking into consideration the complexity of calculating discrete logarithms and the resistance to various attacks.

A secure and robust password-based remote user authentication scheme using smart cards for the integrated EPR information system.

An integrated EPR (Electronic Patient Record) information system of all the patients provides the medical institutions and the academia with most of the patients' information in details for them to make corrective decisions and clinical decisions in order to maintain and analyze patients' health. In such system, the illegal access must be restricted and the information from theft during transmission over the insecure Internet must be prevented. Lee et al. proposed an efficient password-based remote user authentication scheme using smart card for the integrated EPR information system. Their scheme is very efficient due to usage of one-way hash function and bitwise exclusive-or (XOR) operations. However, in this paper, we show that though their scheme is very efficient, their scheme has three security weaknesses such as (1) it has design flaws in password change phase, (2) it fails to protect privileged insider attack and (3) it lacks the formal security verification. We also find that another recently proposed Wen's scheme has the same security drawbacks as in Lee at al.'s scheme. In order to remedy these security weaknesses found in Lee et al.'s scheme and Wen's scheme, we propose a secure and efficient password-based remote user authentication scheme using smart cards for the integrated EPR information system. We show that our scheme is also efficient as compared to Lee et al.'s scheme and Wen's scheme as our scheme only uses one-way hash function and bitwise exclusive-or (XOR) operations. Through the security analysis, we show that our scheme is secure against possible known attacks. Furthermore, we simulate our scheme for the formal security verification using the widely-accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool and show that our scheme is secure against passive and active attacks.

Secure and Efficient Smart-Card-Based Remote User Authentication Scheme for Multiserver Environment

The growth of the Internet and telecommunication technology has facilitated remote access. During the last decade, many secure dynamic identity (ID)-based remote user authentication schemes have been proposed for the multiserver environment using smart cards. Recently, Li et al. point that the Lee et al. scheme is vulnerable to forgery attack, server spoofing attack, improper authentication, and unfriendly and inefficient password change. To overcome these security weaknesses, Li et al. propose a novel smart-card- and dynamic ID-based remote user authentication scheme for multiserver environments. In this paper, we show that the Li et al. scheme is also vulnerable to offline password guessing attack, stolen smart-card attack, forgery attack, and poor reparability. Their scheme does not also provide two-factor security. To provide a secure remote user authentication scheme for the multiserver environment and to overcome the security weaknesses, we propose an enhanced scheme. Our scheme is aimed at logically securing the data stored in the smart card and improving the dynamic property of the ID using password randomization for each session. Our scheme resists forgery attack, replay attack, stolen smart-card attack, offline password guessing attack, and spoofing attack. Our scheme's efficiency has been established analytically and confirmed through simulation.

RSA Based Two-factor Remote User Authentication Scheme with User Anonymity

Abstract Remote user authentication is one of the most commonly used mechanisms to verify the legitimacy of a remote user over insecure communication channel. In remote user authentication, the server and the user mutually authenticate each other and establish a common session key for future communication. In this paper, we propose a secure and effective two-factor remote user authentication scheme based on RSA, which achieves mutual authentication and user anonymity properties. Informal security analysis ensures that the proposed scheme is secure against various malicious attacks and its security is based on the one-way hash function, smart card, and RSA algorithm. Performance comparison shows that the proposed scheme is efficient in terms of communication and computation overhead. Furthermore we demonstrate the validity of our proposed through BAN logic, which confirm that the proposed scheme achieve mutual authentication and session key agreement securely.

A Secure and Efficient Remote User Authentication Scheme for Multi-server Environments Using ECC

With the rapid growth of the communication technology, intelligent terminals (i.e. PDAs and smartphones) are widely used in many mobile applications. To provide secure communication in mobile environment, in recent years, many user authentication schemes have been proposed. However, most of these authentication schemes suffer from various attacks and cannot provide provable security. In this paper, we propose a novel remote user mutual authentication scheme for multi-server environments using elliptic curve cryptography (ECC). Unlike other ECC-based schemes, the proposed scheme uses ECC in combination with a secure hash function to protect the secure communication among the users, the servers and the registration center (RC). Through this method, the proposed scheme requires less ECC-based operations than the related schemes, and makes it possible to significantly reduce the computational cost. Security and performance analyses demonstrate that the proposed scheme can solve various types of security problems and can meet the requirements of computational complexity for low-power mobile devices.

A novel remote user authentication and key agreement scheme for mobile client-server environment

Recently, many identity (ID)-based user authentication and key agreement schemes for mobile client-server environment were proposed. However, these schemes are subjected to an inherent design weakness, namely, the server knows all users' private keys. Under this problem, these schemes cannot provide insider attack resistance or mutual authentication. Furthermore, some of these schemes cannot simultaneously provide user anonymity, perfect forward secrecy, or leakage of session temporary secrets resistance. In this paper, we propose a strongly secure remote user authentication and key agreement scheme to solve these security weaknesses. Security proof shows that the proposed scheme can achieve mutual authentication and key agreement, and provide perfect forward secrecy. Further security analysis shows that the proposed scheme can provide user anonymity, insider attack resistance and leakage of session temporary secrets resistance. In addition, the proposed sche me possesses low computation cost and low power consumption. Thus the proposed scheme is more suitable for mobile client-server environment.

A Secure Dynamic Identity Based Remote User Authentication Scheme Using Secret Sharing

With the rapid growth of Internet based applications, strong privacy protection and robust system security have become essential requirements for an authentication scheme. Engineers have proposed many identity based authentication schemes for remote login systems in past decades. In recent years, the security mechanism for the dynamic identity of legal user appearance has become a new technology in the field of network communications. This novel technology has allowed us to conduct a more secure remote user authentication scheme using a smart card, in which the well-designed module has remedied the system drawback of a static identity based authentication scheme. However, many kinds of authentication schemes need a system of synchronized clocks to withstand replay attacks and achieve mutual authentication, and most of them cannot propose a lightweight mechanism to reduce implementation complexity and achieve computation efficiency. Therefore, we propose a new dynamic identity based authentication scheme using three-way challenge-response strategy to achieve mutual authentication without a system of synchronized clocks. It completely prevents various attacks, supports the session key agreement, and offers the functionality advantages. As a result, the proposed scheme seems to be more secure and suitable for remote communication environment with low computation consumption and better security attributes.

Efficient remote user authentication scheme using smart cards

In 2009, Kim-Chung proposed a secure remote user authentication scheme. In this paper, we show that Kim-Chung|s scheme does not establish a session key. Moreover, the scheme requires time-synchronisation. In order to remedy these drawbacks, this paper proposes an improvement scheme which fulfils all the security requirements for a remote user authentication scheme. Security analysis proved that the improved scheme resists the typical attacks. Furthermore, the analysis of computational cost and storage capacity demonstrated that the scheme is feasible for a practical implementation.

A New Secure Remote User Authentication Scheme with Smart Cards

Remote user authentication scheme is one of the simplest and the most convenient authentication mechanisms to deal with secret data over insecure networks. These types of schemes are applicable to the areas such as computer networks, wireless networks, remote login systems, operation systems and database management systems. The goal of a remote user authentication scheme is to identify a valid card holder as having the rights and privileges indicated by the issuer of the card. In recent years, so many remote user authentication schemes have been proposed to authenticate a legitimate user, but none of them can solve all possible problems and withstand all possible attacks. This paper presents a secure remote user authentication scheme with smart cards. The proposed scheme provides the essential security requirements and achieves particular attributes.