Secure Remote User Authentication Research Articles

Secure Patient Authentication Scheme in the Healthcare System Using Symmetric Encryption

Recently, the incorporation of state-of-the-art technology such as Electronic Healthcare Records (EHRs), networks, and cloud computing has transformed the traditional healthcare system. However, security problems have arisen as a result of the integration of technology. Secure remote user authentication is a core part of the healthcare system to validate the user’s identification via an unsecured communication network. Since then, several remote user authentication schemes have been presented, each with its own set of pros and limitations. As a result, security, malicious attacks, and privacy concerns are considered one of the main challenges related to the healthcare system. In this paper, we propose a safe user authentication scheme for patients in the healthcare system that overcomes these flaws and confirms the security of the proposed work using scyther, a formal security tool. In the healthcare environment, our work provides an effective means to construct an environment capable of setting, registering, storing, searching, analyzing, authentication, and verifying electronic healthcare information in order to protect the information of patients. Furthermore, our suggested scheme uses symmetric encryption based on the crypto-hash function for accessing the anomaly of the patient’s identity and One-Time Password (OTP). Towards the end of the study, the performance analysis results indicate a delicate balance of security and performance that is frequently lacking in previous works.

SecFHome: Secure remote authentication in fog-enabled smart home environment

Fog computing is the best solution for IoT applications with low latency and real-time interaction. Fog can endow smart home with many smart functions and services. One of the most important services is that users can remotely access and control smart devices. Since remote users and smart homes communicate through insecure channels, it is necessary to design a secure and effective remote authentication scheme to guarantee secure communications. The existing authentication schemes designed for smart homes have some security issues and are not suitable for fog-enabled smart home environments. Therefore, this paper designs a secure remote user authentication scheme, SecFHome. It supports secure communication at the edge of the network and remote authentication in fog-enabled smart home systems. Specifically, We present an efficient authentication mode in the fog-enabled environment, which includes the edge negotiation phase and the authentication phase. SecFHome adds updated information to the authenticator, which can verify the message synchronization simultaneously with the authentication, thus improving the authentication efficiency. In addition, SecFHome does not store sensitive information of users and smart devices in the memory of the smart gateway, which can avoid various attacks caused by the compromised gateway. The formal security proof and informal security analysis show that the SecFHome is secure and can resist known attacks. Compared with the related authentication schemes, SecFHome only needs fewer communication costs and computation costs, and achieves more security features.

A secure remote user authentication scheme for 6LoWPAN-based Internet of Things.

One of the significant challenges in the Internet of Things (IoT) is the provisioning of guaranteed security and privacy, considering the fact that IoT devices are resource-limited. Oftentimes, in IoT applications, remote users need to obtain real-time data, with guaranteed security and privacy, from resource-limited network nodes through the public Internet. For this purpose, the users need to establish a secure link with the network nodes. Though the IPv6 over low-power wireless personal area networks (6LoWPAN) adaptation layer standard offers IPv6 compatibility for resource-limited wireless networks, the fundamental 6LoWPAN structure ignores security and privacy characteristics. Thus, there is a pressing need to design a resource-efficient authenticated key exchange (AKE) scheme for ensuring secure communication in 6LoWPAN-based resource-limited networks. This paper proposes a resource-efficient secure remote user authentication scheme for 6LoWPAN-based IoT networks, called SRUA-IoT. SRUA-IoT achieves the authentication of remote users and enables the users and network entities to establish private session keys between themselves for indecipherable communication. To this end, SRUA-IoT uses a secure hash algorithm, exclusive-OR operation, and symmetric encryption primitive. We prove through informal security analysis that SRUA-IoT is secured against a variety of malicious attacks. We also prove the security strength of SRUA-IoT through formal security analysis conducted by employing the random oracle model. Additionally, we prove through Scyther-based validation that SRUA-IoT is resilient against various attacks. Likewise, we demonstrate that SRUA-IoT reduces the computational cost of the nodes and communication overheads of the network.

An improved privacy preserving remote user authentication scheme for agricultural wireless sensor network

AbstractAgriculture is a fundamental pillar of society, bearing a crucial role in shaping the economy of the country and provides huge financial prospects and the possibility of employment to the large mass of the country. Thus, the incorporation of modern technology would lead to amplification in productivity and economic escalation. In this perspective, Wireless Sensor Network (WSN) can provide a greater service by sensing, monitoring and supplying continuous information about climatic conditions like temperature, light, soil moisture, humidity, and so on. These parameters help in increment of productivity in terms of quantity and quality growth in agriculture. However, WSN brings security threats like masquerading, alteration, interference, interception, and so on, that harmfully affect crop production and other agricultural practices. Thus, privacy preservation and security enhancement for agricultural WSN are the major challenges to be conquered. To meet this purpose, a privacy‐preserving efficient and secure remote user authentication scheme is introduced in this research work for the application of agricultural WSN. The proposed scheme is formally evaluated using probabilistic Random‐Oracle‐Model (ROR) for proving the robustness of the scheme. Further, the scheme is simulated using a well‐accepted AVISPA tool to show the security strength of it. The performance analysis of our scheme shows that along with its robustness in terms of security, the proposed scheme is more efficient in terms of computation and communication overheads in contrast to other existing schemes. These aforesaid features make the proposed scheme implementable in a practical environment.

Secure Remote User Authentication Scheme on Health Care, IoT and Cloud Applications: A Multilayer Systematic Survey

Secure Remote User Authentication Scheme on Health Care, IoT and Cloud Applications: A Multilayer Systematic Survey

An enhanced and provably secure multi-factor authentication scheme for Internet-of-Multimedia-Things environments

The Internet-of-Multimedia-Things (IoMT) opens new doors towards various contingencies to improve applications and services through efficient multimedia data usage. The ever-enlarging content of multimedia information in an IoT system makes it a critical security concern. Whenever users access services or information through a public channel, he/she is exposed to numerous security threats. Many security schemes have been introduced for IoMT environments to tackle the above-said concerns. Still, most of them do not fulfill all the security requirements of the IoMT systems. Recently, Dhillon and Karla have presented an authentication scheme for the IoMT environment. They have declared that the scheme is robust and can resist significant security attacks. However, we noticed that Dhillon and Kalra’s scheme is susceptible to user masquerading attacks and a stolen verifier attack. Besides, their scheme also violates the anonymity and traceability of a user. This paper proposes a more secure remote user authentication scheme using the elliptic curve cryptosystem for the IoMT system. We have evaluated our scheme formally through the random oracle model. The informal security description proves that our scheme provides resistance against significant security attacks. Further, the performance analysis reveals that our scheme is more flexible, robust, and efficient than the relevant schemes.

Secure remote anonymous user authentication scheme for smart home environment

Smart home technology is an emerging application of Internet-of-Things (IoT) where the user can remotely control home devices. Since the user/home communication channel is insecure, an efficient and anonymous authentication scheme is required to provide secure communications in smart home environment. In this paper, we propose a new scheme for user authentication that combines physical context awareness and transaction history. The new scheme offers two advantages: it does not maintain a verification table and avoids clock synchronization problem. Communication overhead and computational cost of the proposed scheme are analyzed and compared with other related schemes. The security of the scheme is evaluated using three different methods: (1) formal analysis using the Burrows-Abadi-Needham logic (BAN); (2) informal analysis; (3) model check using the automated validation of internet security protocols and applications (AVISPA) tool.

A Secure Remote User Authentication Protocol for Healthcare Monitoring Using Wireless Medical Sensor Networks

The wireless medical sensor networks WMSN play a crucial role in healthcare monitoring remotely. In remote healthcare monitoring, the sensor nodes are deployed in patient's body for collecting physiological data and transmit these data over an insecure channel. The patient's health information is highly sensitive and important. Any malicious modification in physiological data will make wrong diagnoses and harm the patient health. Therefore, privacy, data security, and user authentication are extremely important for accessing patient's real-time heath information over an insecure channel. In this regard, this article proposes a secure and robust two-factor based remote user authentication protocol for healthcare monitoring. The authentication proof has done with the help of BAN logic, which ensures that the proposed scheme provides mutual authentication and session key agreement securely. The informal security verification proves that the developed protocol is secure from various security attacks. The simulation of the proposed scheme has been done using AVISPA tool, whose simulation results confirm that the proposed scheme is secure from active and passive attacks. Performance evaluation shows that the proposed protocol is efficient in terms of security features, computation cost, communication cost, and execution time.

Secure Remote User Authenticated Key Establishment Protocol for Smart Home Environment

The Information and Communication Technology (ICT) has been used in wide range of applications, such as smart living, smart health and smart transportation. Among all these applications, smart home is most popular, in which the users/residents can control the operations of the various smart sensor devices from remote sites also. However, the smart devices and users communicate over an insecure communication channel, i.e., the Internet. There may be the possibility of various types of attacks, such as smart device capture attack, user, gateway node and smart device impersonation attacks and privileged-insider attack on a smart home network. An illegal user, in this case, can gain access over data sent by the smart devices. Most of the existing schemes reported in the literature for the remote user authentication in smart home environment are not secure with respect to the above specified attacks. Thus, there is need to design a secure remote user authentication scheme for a smart home network so that only authorized users can gain access to the smart devices. To mitigate the aforementioned isses, in this paper, we propose a new secure remote user authentication scheme for a smart home environment. The proposed scheme is efficient for resource-constrained smart devices with limited resources as it uses only one-way hash functions, bitwise XOR operations and symmetric encryptions/decryptions. The security of the scheme is proved using the rigorous formal security analysis under the widely-accepted Real-Or-Random (ROR) model. Moreover, the rigorous informal security analysis and formal security verification using the broadly-accepted Automated Validation of Internet Security Protocols and Applications (AVISPA) tool is also done. Finally, the practical demonstration of the proposed scheme is also performed using the widely-accepted NS-2 simulation.

A secure remote user authentication scheme for smart cities e-governance applications

Smart cities are rapidly gaining momentum and aims at improving the quality of life of citizens by adopting Information and Communication Technology. E-governance have become the smarter way of deployment of administration by the authority under its jurisdiction. The citizens can access the services of government anywhere at any time. Since this technique requires the transmission of sensitive information between the government and the citizen through the Internet, information security is of utmost importance. This paper proposes a lightweight, robust remote user authentication and key agreement protocol for e-governance applications in the smart cities. The proposed protocol is based on XOR and hash operations, and includes (1) a password and smart card, (2) user anonymity, (3) mutual authentication, (4) shared session key, and (5) key freshness. It satisfies desirable security attributes and is resistant against all well-known security attacks. Further, the formal security verification using AVISPA and informal security proves the security strength of the proposed protocol and its robustness against all possible security threats.

Security analysis and enhancements of an improved multi-factor biometric authentication scheme

Many remote user authentication schemes have been designed and developed to establish secure and authorized communication between a user and server over an insecure channel. By employing a secure remote user authentication scheme, a user and server can authenticate each other and utilize advanced services. In 2015, Cao and Ge demonstrated that An’s scheme is also vulnerable to several attacks and does not provide user anonymity. They also proposed an improved multi-factor biometric authentication scheme. However, we review and cryptanalyze Cao and Ge’s scheme and demonstrate that their scheme fails in correctness and providing user anonymity and is vulnerable to ID guessing attack and server masquerading attack. To overcome these drawbacks, we propose a security-improved authentication scheme that provides a dynamic ID mechanism and better security functionalities. Then, we show that our proposed scheme is secure against various attacks and prove the security of the proposed scheme using BAN Logic.

A Novel Authentication and Key Agreement Scheme for Implantable Medical Devices Deployment.

Implantable medical devices (IMDs) are man-made devices, which can be implanted in the human body to improve the functioning of various organs. The IMDs monitor and treat physiological condition of the human being (for example, monitoring of blood glucose level by insulin pump). The advancement of information and communication technology enhances the communication capabilities of IMDs. In healthcare applications, after mutual authentication, a user (for example, doctor) can access the health data from the IMDs implanted in a patient's body. However, in this kind of communication environment, there are always security and privacy issues, such as leakage of health data and malfunctioning of IMDs by an unauthorized access. To mitigate these issues, in this paper, we propose a new secure remote user authentication scheme for IMDs communication environment to overcome security and privacy issues in existing schemes. We provide the formal security verification using the widely accepted Automated Validation of Internet Security Protocols and Applications tool. We also provide the informal security analysis of the proposed scheme. The formal security verification and informal security analysis prove that the proposed scheme is secure against known attacks. The practical demonstration of the proposed scheme is performed using the broadly accepted NS2 simulation tool. The computation and communication costs of the proposed scheme are also comparable with the existing schemes. Moreover, the scheme provides additional functionality features, such as anonymity, untraceability, and dynamic implantable medical device addition.

Esquema seguro de autenticación de usuario basado en identificador dinámico utilizando cifrado simétrico y tarjetas inteligentes

En 2004, Das, Saxena & Gulati propusieron un nuevo esquema de autenticación basado en un identificador dinámico cuyo principal propósito fue evitar el ataque de robo de identidad. Desde ese momento, se han propuesto varios esquemas con la intención de mejorar la seguridad de esquemas previos. Sood et al., propusieron un nuevo esquema y claman que es más seguro que el esquema propuesto por Liou, Lin & Wang. Sin embargo, un estudio de criptoanálisis ha demostrado que su esquema continúa siendo vulnerable a los siguientes ataques: encontrar la clave secreta, suplantación de identidad, y robo de información de la base de datos, haciendo al esquema inseguro para su uso en servicios electrónicos. En este artículo se propone un nuevo esquema que resuelve las fallas de seguridad encontradas en el esquema de Sood y cumple con todas las características de seguridad que un esquema de autenticación de usuario remoto de ofrecer.Palabras clave: Criptoanálisis, autenticación mutua, seguridad en redes, tarjetas inteligentes

An Enhanced Secure Remote User Authentication Scheme without Verification Table

With the significant advances in communication networks over the last few decades, smart cards have been widely used in many e-commerce applications and network security protocols due to their low cost, portability, efficiency and cryptographic properties. In this paper, we analyze Sood et al.‟s smart card based authentication scheme and demonstrate that the scheme is vulnerable to masquerade user attack, offline password guessing attack, time concurrency weaknesses and fails to achieve mutual authentication. A secure dynamic identity based remote user authentication scheme without verification tables, is proposed in this paper and the scheme resolves the aforementioned problems of Sood et al.‟s scheme. The computation cost of the proposed scheme is comparable to Sood et al.‟s scheme and it is highly secure taking into consideration the complexity of calculating discrete logarithms and the resistance to various attacks.

A secure and robust password-based remote user authentication scheme using smart cards for the integrated EPR information system.

An integrated EPR (Electronic Patient Record) information system of all the patients provides the medical institutions and the academia with most of the patients' information in details for them to make corrective decisions and clinical decisions in order to maintain and analyze patients' health. In such system, the illegal access must be restricted and the information from theft during transmission over the insecure Internet must be prevented. Lee et al. proposed an efficient password-based remote user authentication scheme using smart card for the integrated EPR information system. Their scheme is very efficient due to usage of one-way hash function and bitwise exclusive-or (XOR) operations. However, in this paper, we show that though their scheme is very efficient, their scheme has three security weaknesses such as (1) it has design flaws in password change phase, (2) it fails to protect privileged insider attack and (3) it lacks the formal security verification. We also find that another recently proposed Wen's scheme has the same security drawbacks as in Lee at al.'s scheme. In order to remedy these security weaknesses found in Lee et al.'s scheme and Wen's scheme, we propose a secure and efficient password-based remote user authentication scheme using smart cards for the integrated EPR information system. We show that our scheme is also efficient as compared to Lee et al.'s scheme and Wen's scheme as our scheme only uses one-way hash function and bitwise exclusive-or (XOR) operations. Through the security analysis, we show that our scheme is secure against possible known attacks. Furthermore, we simulate our scheme for the formal security verification using the widely-accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool and show that our scheme is secure against passive and active attacks.

RSA Based Two-factor Remote User Authentication Scheme with User Anonymity

Abstract Remote user authentication is one of the most commonly used mechanisms to verify the legitimacy of a remote user over insecure communication channel. In remote user authentication, the server and the user mutually authenticate each other and establish a common session key for future communication. In this paper, we propose a secure and effective two-factor remote user authentication scheme based on RSA, which achieves mutual authentication and user anonymity properties. Informal security analysis ensures that the proposed scheme is secure against various malicious attacks and its security is based on the one-way hash function, smart card, and RSA algorithm. Performance comparison shows that the proposed scheme is efficient in terms of communication and computation overhead. Furthermore we demonstrate the validity of our proposed through BAN logic, which confirm that the proposed scheme achieve mutual authentication and session key agreement securely.

Secure and Efficient Smart-Card-Based Remote User Authentication Scheme for Multiserver Environment

The growth of the Internet and telecommunication technology has facilitated remote access. During the last decade, many secure dynamic identity (ID)-based remote user authentication schemes have been proposed for the multiserver environment using smart cards. Recently, Li et al. point that the Lee et al. scheme is vulnerable to forgery attack, server spoofing attack, improper authentication, and unfriendly and inefficient password change. To overcome these security weaknesses, Li et al. propose a novel smart-card- and dynamic ID-based remote user authentication scheme for multiserver environments. In this paper, we show that the Li et al. scheme is also vulnerable to offline password guessing attack, stolen smart-card attack, forgery attack, and poor reparability. Their scheme does not also provide two-factor security. To provide a secure remote user authentication scheme for the multiserver environment and to overcome the security weaknesses, we propose an enhanced scheme. Our scheme is aimed at logically securing the data stored in the smart card and improving the dynamic property of the ID using password randomization for each session. Our scheme resists forgery attack, replay attack, stolen smart-card attack, offline password guessing attack, and spoofing attack. Our scheme's efficiency has been established analytically and confirmed through simulation.

A two‐factor authentication scheme with anonymity for multi‐server environments

AbstractIn a multi‐server environment, remote user authentication is essential for secure communication. Recently, Liao and Wang, Hsiang and Shih, and Lee et al. have successively proposed various remote user authentication schemes for multi‐server environments. However, each of these schemes exhibits distinct security weaknesses. The Liao–Wang scheme is vulnerable to insider attacks and masquerade attacks, and fails to provide two‐factor security and mutual authentication. The Hsiang–Shih scheme is vulnerable to masquerade attacks and cannot provide mutual authentication. This paper shows that the Lee et al. scheme does not provide two‐factor security and cannot withstand masquerade attacks. Their scheme demonstrates poor reparability and fails to provide mutual authentication. Its password change process is inconvenient and inefficient for users who wish to update passwords. Therefore, we propose a novel two‐factor authentication scheme with anonymity for multi‐server environments and use the Burrows–Abadi–Needham logic method to verify our scheme. We compare the performance and functionality of the proposed scheme with those of previous schemes. Cryptanalysis demonstrated that our improved scheme not only overcomes the drawbacks of the Lee et al., Hsiang–Shih, and Liao–Wang schemes but also satisfies crucial design criteria for secure remote user authentication schemes in multi‐server environments. This paper presents a real‐case scenario and provides practical examples. We show that our improved authentication scheme provides more functionality than the mentioned schemes do, and can enhance effectiveness in protecting multi‐server environments. We also show that the proposed scheme is efficient and can enhance the efficiency of the authentication scheme in a multi‐server environment. Copyright © 2014 John Wiley & Sons, Ltd.

A Secure and Efficient Remote User Authentication Scheme for Multi-server Environments Using ECC

With the rapid growth of the communication technology, intelligent terminals (i.e. PDAs and smartphones) are widely used in many mobile applications. To provide secure communication in mobile environment, in recent years, many user authentication schemes have been proposed. However, most of these authentication schemes suffer from various attacks and cannot provide provable security. In this paper, we propose a novel remote user mutual authentication scheme for multi-server environments using elliptic curve cryptography (ECC). Unlike other ECC-based schemes, the proposed scheme uses ECC in combination with a secure hash function to protect the secure communication among the users, the servers and the registration center (RC). Through this method, the proposed scheme requires less ECC-based operations than the related schemes, and makes it possible to significantly reduce the computational cost. Security and performance analyses demonstrate that the proposed scheme can solve various types of security problems and can meet the requirements of computational complexity for low-power mobile devices.

A novel remote user authentication and key agreement scheme for mobile client-server environment

Recently, many identity (ID)-based user authentication and key agreement schemes for mobile client-server environment were proposed. However, these schemes are subjected to an inherent design weakness, namely, the server knows all users' private keys. Under this problem, these schemes cannot provide insider attack resistance or mutual authentication. Furthermore, some of these schemes cannot simultaneously provide user anonymity, perfect forward secrecy, or leakage of session temporary secrets resistance. In this paper, we propose a strongly secure remote user authentication and key agreement scheme to solve these security weaknesses. Security proof shows that the proposed scheme can achieve mutual authentication and key agreement, and provide perfect forward secrecy. Further security analysis shows that the proposed scheme can provide user anonymity, insider attack resistance and leakage of session temporary secrets resistance. In addition, the proposed sche me possesses low computation cost and low power consumption. Thus the proposed scheme is more suitable for mobile client-server environment.