Secure Session Research Articles

An Improved Mutual Authentication Scheme with Smart Cards and Password under Trusted Computing

In the traditional smart card-based password authentication schemes, the authentication is only applied to verify both of server and user, but not applied to verify the platform. Recently, Yang, Ma, and Jiang proposed a mutual authentication scheme with smart cards and password under trusted computing. Their scheme was designed to authenticate the platform. They claimed that their scheme could withstand most of the possible attacks, such as secure session key agreement, user identity anonymity, password free changing, and platform certification updating. However, we will show that their scheme is vulnerable to on-line guessing password attack with smart card, and man-in-the-middle attack. In this article, we also propose an improved Yang-Ma-Jiang’s mutual authentication scheme to withstand the vulnerability in their scheme.

An Effective Data Privacy Mechanism through Secure Session Key Exchange Model for MANET

<p>Data privacy in the mobile ad-hoc network is a problem due to wireless medium, frequent node movement and lack of any centralized infrastructure support. In such case, it is very important to build a reliable and secure network and achieve high throughput in MANET. The reliability and security of a network depend on whether the network remains linked to different failures and malicious activities, which is the fundamental issue that needs to be focused when designing a secure routing protocol in MANET. This paper proposes an effective privacy mechanism to handle data security through a novel secure session key exchange model, which provides the node data privacy and network stability for a longer period of time and prevents abnormal behavior changes due to malicious behavior and different type of attacks in the network. The simulation results show improvement in throughput with nominal overhead and end-to-end delay in different malicious conditions against existing protocols.</p>

Efficient Design of a Novel ECC-Based Public Key Scheme for Medical Data Protection by Utilization of NanoPi Fire

Investigating the literature reveals the fact that the key management protocols play a vital role in protecting the security and privacy of medical data in telecare medical information systems. Recently, Tseng et al . have proposed an interesting elliptic curve cryptosystem (ECC) based self-certified key management scheme that can yield secure channel for the communications of secure sensors (cluster members) and access point (cluster head). After careful consideration, we found that their scheme suffers from the cluster head impersonation, replay, and key replicating attacks. In addition, in the secure session phase, there are some errata and a point multiplication that is undefined in the ECC and hence is mathematically incorrect. Finally, yet importantly, their presented scheme has been adopted for a similar application by other authors with the same problem. Therefore, in this paper, we first try to elaborate the existing errata and security threats. Second, we propose a modified version, which is free from the challenges of their scheme. Eventually, we propose a novel anonymous ECC-based self-certified two-factor key management scheme that not only provides the desired security features, but also has much better efficiency than several recently-published schemes, such as the presented one by Tseng et al . Our formal security verification and proof besides the efficiency analysis support our claim.

An efficient and secure session key establishment scheme for health-care applications in wireless body area networks

Wireless Body Area Network (WBAN) is special breed of Wireless Sensor Network (WSN). Due to the increasing interest and the tremendous advancement in miniaturization and sensor technology, WBAN has emerged as an active filed of research. WBAN has many unique applications especially in medical and health-care. This kind of network provides support in on-the-spot decision making and therapeutic treatments. However, one of the main issues with WBAN in medical applications is security and patients’ information privacy. In such applications ensuring human vital sign privacy and security is very important. To address this important issue, in this paper we propose a novel secure session key establishment scheme for WBAN in health-care domain to ensure security and privacy of vital sign related to human body. In the proposed scheme, session key is established for a specific period of time in order to communicate important data related to vital signs of patients’ health securely. Hence, on the basis of this reliable and secure data transmission, efficient required medical decision can be taken. As a result, on the spot health-care operation can be performed by utilizing different health-care units. The proposed scheme is dynamic in nature, i.e. if a node in the network is compromised or a new node joins the network, the process of session key establishment is re-initiated. The proposed scheme has been evaluated through extensive simulation, and the results are compared with an existing scheme. The simulation results show that our scheme is efficient and cost effective in terms of communication and computation cost, and key establishment delay, hence conserves energy and enhances security.

A Robust Authentication Scheme for Client-Server Architecture With Provable Security Analysis

Client-server computing is the analytical development of compatible programming with significant supposition and the detachment of a massive program into its fundamental parts ("modules"), which can create the chance for extra enhancement, inconsiderable improvement, and prominent maintainability. In client-server computing, total extensive modules don't need to be accomplished within the similar memory space totally but can execute independently on a suitable hardware and software platform according to their behavior. The user authentication is the dominant constraint for client-server computing that limits the illegitimate right of entry into the main workstation. This research is mainly focused on the design of a robust authentication scheme for client-server architecture computing. It carries some additional features like security, virtualization, user's programs security, individuality supervision, integrity, control access to server and authentication. The proposed background also delivers the characteristic supervision, mutual authentication, and establishment of secure session key among users and the remote server.

Short voice imitation man-in-the-middle attacks on Crypto Phones: Defeating humans and machines1

Establishing secure voice, video and text over Internet (VoIP) communications is a crucial task necessary to prevent eavesdropping and man-in-the-middle attacks. The traditional means of secure session establishment (e.g., those relying upon PKI or KDC) require a dedicated infrastructure and may im pose unwanted trust onto third-parties. “Crypto Phones” (popular instances such as PGPfone and Zfone), in contrast, provide a purely peer-to-peer user-centric secure mechanism claiming to completely address the problem of wiretapping. The secure association mechanism in Crypto Phones is based on cryptographic protocols employing Short Authenticated Strings (SAS) validated over the voice medium. The security of Crypto Phones crucially relies on the assumption that the voice channel, over which SAS is validated, provides the properties of integrity and source authentication. In this paper, we challenge this assumption, and report on automated SAS voice imitation man-in-the-middle attacks that can compromise the security of Crypto Phones in both two-party and multi-party settings, even if users pay due diligence and even if an automated software (voice biometrics systems) is used to detect voice manipulation. The first attack, called the short voice reordering attack, builds arbitrary SAS strings in a victim’s voice by reordering previously eavesdropped SAS strings spoken by the victim. The second attack, called the short voice morphing attack, builds arbitrary SAS strings in a victim’s voice from a few previously eavesdropped sentences (less than 3 minutes) spoken by the victim. We design and implement our attacks using off-the-shelf speech recognition/synthesis tools, and comprehensively evaluate them with respect to both manual detection (based on a user study with 30 participants) and automated detection via a speaker verification tool. The results demonstrate the effectiveness of our attacks against three prominent forms of SAS encodings: numbers, PGP word lists and Madlib sentences. These attacks can be used by a wiretapper to compromise the confidentiality and privacy of Crypto Phones voice, video and text communications (plus authenticity in case of text conversations).

An Indoor Positioning-Based Mobile Payment System Using Bluetooth Low Energy Technology.

The development of information technology has paved the way for faster and more convenient payment process flows and new methodology for the design and implementation of next generation payment systems. The growth of smartphone usage nowadays has fostered a new and popular mobile payment environment. Most of the current generation smartphones support Bluetooth Low Energy (BLE) technology to communicate with nearby BLE-enabled devices. It is plausible to construct an Over-the-Air BLE-based mobile payment system as one of the payment methods for people living in modern societies. In this paper, a secure indoor positioning-based mobile payment authentication protocol with BLE technology and the corresponding mobile payment system design are proposed. The proposed protocol consists of three phases: initialization phase, session key construction phase, and authentication phase. When a customer moves toward the POS counter area, the proposed mobile payment system will automatically detect the position of the customer to confirm whether the customer is ready for the checkout process. Once the system has identified the customer is standing within the payment-enabled area, the payment system will invoke authentication process between POS and the customer’s smartphone through BLE communication channel to generate a secure session key and establish an authenticated communication session to perform the payment transaction accordingly. A prototype is implemented to assess the performance of the proposed design for mobile payment system. In addition, security analysis is conducted to evaluate the security strength of the proposed protocol.

Privacy Protection for E-Health Systems by Means of Dynamic Authentication and Three-Factor Key Agreement

During the past decade, the electronic healthcare (e-health) system has been evolved into a more patient-oriented service with smaller and smarter wireless devices. However, these convenient smart devices have limited computing capacity and memory size, which makes it harder to protect the user's massive private data in the e-health system. Although some works have established a secure session key between the user and the medical server, the weaknesses still exist in preserving the anonymity with low energy consumption. Moreover, the misuse of biometric information in key agreement process may lead to privacy disclosure, which is irreparable. In this study, we design a dynamic privacy protection mechanism offering the biometric authentication at the server side whereas the exact value of the biometric template remains unknown to the server. And the user anonymity can be fully preserved during the authentication and key negotiation process because the messages transmitted with the proposed scheme are untraceable. Furthermore, the proposed scheme is proved to be semantic secure under the real-or-random model. The performance analysis shows that the proposed scheme suits the e-health environment at the aspect of security and resource occupation.

A novel efficient MAKA protocol with desynchronization for anonymous roaming service in Global Mobility Networks

In the roaming service system of Global Mobile Networks (GLOMONET), mutual authentication and key agreement (MAKA) protocol is used to identify legitimate roaming users and establish a secure session between users and servers. In recent years, many MAKA protocols are proposed. Among them, the most representative is Gope-Hwang's, which uses the low-cost cryptographic primitives, and hence is more suitable for battery-powered mobile devices. In this paper, we analyze the deficiencies of Gope-Hwang's protocol and propose a novel efficient MAKA protocol with desynchronization for anonymous roaming service in GLOMONET. Gope-Hwang's protocol is lightweight but is susceptible to replay attacks and have a large storage burden. We utilize symmetric encryption to implement dynamic random pseudo-ID, which can achieve anonymity, solve storage burden problem and reach desynchronization. Informal analysis and automated security validation with AVISPA Tool show that our protocol can resist many common attacks such as replay attack, lost smart card attack, forgery attack etc. Moreover, compared to the other four selected protocols in our performance analysis, the efficiency of our protocol outperforms all the other work and is increased by 9.6% than that of Gope-Hwang's.

Client Centric Model for Secure Session Management for SAAS in Cloud Environment

Now days Cloud computing is playing major role in IT Sector in terms of reducing expenditure and also playing major part in earning revenue but security and privacy issues making clients in doubt of adapting Cloud environment. Since cloud environment is new which contains three parties (i.e., Cloud service user, Cloud service provider/Cloud user, Cloud provider) the way of protecting the users private information will be different which may not be same as in older web application environments. For this reason, we propose in this paper that at the time of Service Level Agreement (SLA) provider provides online registered Software Component (SC) to be installed at the consumer (Client side) as add-on or as a software component as part of Browser (runtime component) which will have an unique-id and will be activated by the provider at the time of installation of component at client side over SSL protocol. The ID of the component is generated by an Application key or an enterprise key. When the client sends data (user-id, password, message) every time it is encrypted by SC along with ID by using Encryption scheme. So by using this mechanism we propose some of the solutions in this paper to session management and attacks at the client side in Cloud computing environment (SaaS).

A Survey on Secure and Resilient Session Schemes: Technical Comparison and Assessment

Cyber threats become more and more pervasive on the Internet and on distributed/decentralized systems. In order to secure communication over these infrastructures and respond to mobility constraint, a new class of Virtual Private Networks (VPN), which support both security and mobility, has emerged in the course of last years. Mobile Virtual Private Networks, called mobile VPN, provide not only secure tunnels but also session continuity mechanism despite location change or connection disruptions. This mechanism enables secure sessions to survive in dynamic/mobile environments without requiring a renegotiation of security keys during the session resumption phase. In this paper, on the one hand, we survey the recent literature on the mobile VPN systems followed by a detailed analysis and a technical comparison in tabulated form of existing technologies. On the other hand, we carry out experiments on open source mobile VPN infrastructures. We subsequently outline and discuss major features and performances of various assessed mobile VPN infrastructures.

SplitPass: A Mutually Distrusting Two-Party Password Manager

Using a password manager is known to be more convenient and secure than not using one, on the assumption that the password manager itself is safe. However recent studies show that most popular password managers have security vulnerabilities that may be fooled to leak passwords without users’ awareness. In this paper, we propose a new password manager, SplitPass, which vertically separates both the storage and access of passwords into two mutually distrusting parties. During login, all the parties will collaborate to send their password shares to the web server, but none of these parties will ever have the complete password, which significantly raises the bar of a successful attack to compromise all of the parties. To retain transparency to existing applications and web servers, SplitPass seamlessly splits the secure sockets layer (SSL) and transport layer security (TCP) sessions to process on all parties, and makes the joining of two password shares transparent to the web servers. We have implemented SplitPass using an Android phone and a cloud assistant and evaluated it using 100 apps from top free apps in the Android official market. The evaluation shows that SplitPass securely protects users’ passwords, while incurring little performance overhead and power consumption.

An authentication and key agreement mechanism for OPC Unified Architecture in industrial Internet of Things

As an industrial communication data interaction specification, OPC Unified Architecture effectively solves the industrial Internet of Things system integration problem. This article designs an authentication and key agreement scheme based on implicit certificate using the security model provided by OPC Unified Architecture. It establishes the secure channel and provides a guarantee for secure session for the OPC Unified Architecture server and client. Then, the test verification platform is implemented to verify the feasibility of the scheme. The result shows that the mechanism is feasible, and the system security and availability are effectively improved.

A Secure Fair Exchange for SMS‐Based Mobile Payment Protocols Based on Symmetric Encryption Algorithms with Formal Verification

Information security and fair exchange are essential to creating trust among all the parties participating in any sale transaction. However, implementing them in any mobile commerce is challenging due to the limitation of resources on mobile devices. Numerous m‐commerce protocols that have been proposed so far still lack those two important aspects. In this paper, we propose mobile payment (m‐payment) protocols, a crucial part of m‐commerce, that incorporate both information security and fair exchange while retaining their own lightweight property. To allow convenience of use, the proposed protocols can be implemented on the existing Short Message Service (SMS) infrastructure. Our approach is based on the secure session key generation technique to enhance information security under lightweight conditions and involves a trusted third party to guarantee fair exchange without information disclosure. We have formally proven that our protocols are more effective and efficient than others in terms of fairness, security, and lightweight properties. In addition, the soundness and completeness of the protocols have been analyzed and proven using BAN logic and an automated security protocol proof tool named Scyther.

Концепція впровадження автоматизованої системи розпізнавання мовця у процес автентифікації для доступу до критичної системи

In the article, ISO/IEC 27001: 2013, an effective and user-friendly concept of reliable authentication for accessing a multi-server information critical system, which includes, in particular, a set of users, a set of servers and a dedicated server —a registration center for a system objects registration without the maintenance of verification tables, is proposed. Information exchange between the objects of the system is organized using secure sessions based on an secret keys with a matching mechanism based on one-way hash functions and cryptography of elliptic curves, which now provides the best correlation between encryption reliability and a size of a secret key among existing cryptosystems. Work with users is personalized using individual access cards, which are protected based on the provisions of the cryptographic theory of elliptical curves. Access cards, in addition to identification information and password, store biometric information about the features of the user's voice in the form of a information features vector. The application for authentication, which is installed on the user's computing device, is initiated by a two-step user recognition procedure (with an identification card) — according to the individual features of his voice and the entered password, which together with convenience ensures the reliability of the authentication process. The basic concept of introduction of the automated speaker recognition system in the authentication process for access to the critical system was proposed in the article, and according to the results of the tests it was concluded that it conforms to the requirements of the ISO/IEC 27001: 2013 standard. However, experience in the practical use of the authentication system for accessing information critical system found a number of vulnerabilities in the basic concept, for the purpose of eliminating them, an improved concept was created that also fully meets the requirements of ISO/IEC 27001: 2013. The article evaluates the computational efficiency of the proposed concepts on the basis of calculating the number of the most computationally complex operations — scalable multiplication Tm and calculating the hash function Th for authentication of objects as part of the information critical system (user, server, registration center and all these objects together). The final computational complexity of the basic concept was 4Tm + 15Th, and of the advanced one — 6Tm + 17Th, which in absolute terms is an average result in comparison with analogues. However, the use of cryptography of elliptical curves makes hashing operations about 6 times faster than hashing with the use of a public key, as in analogues.

Usage issues of SSL/TLS issues

One of the means of creating a secure communication ses-sion is using the SSL/TLS cryptographic protocol, how-ever it does not guarantee full protection and also has its own vulnerabilities and disadvantages, which must be ana-lyzed and eliminated in the future. In particular, in this pa-per the basic terminology is analyzed, vulnerabilities of the protocol are analyzed and generalized, some aspects that make possible implementation of the “man in the middle” attack and it’s variations,the problem of certificates substi-tution and self-signed certificates, authentication defects, application libraries vulnerabilities, key exchange problem, including the Bleichenbacher’s threat, public key infra-structure problems, the problem of interoperability in Ukraine and the most recent vulnerabilities of this protocol are presented (SWEET32, DROWN, ROBOT). The result of the research is the arranged list of unsolved problems and recommendations to increase cryptoresistability level of the protocol.

Provably leakage-resilient three-party password-based authenticated key exchange

Three-party password-based authenticated key exchange (3PAKE) protocol is an important practical cryptographic primitive in the client-client communication environments, where two clients could generate a shared secure session key using their human-memorable passwords with a server’s help. Many 3PAKE protocols were proposed, but these protocols were only secure in the traditional model where no leakage attacks exist. In Mobile Internet, Wireless Networks and Sensor Networks environments, 3PAKE systems are very vulnerable to side-channel attacks. Therefore, it is very necessary to design 3PAKE protocols that are secure in the leakage environments. However, there is no previous works for formalizing the security model for leakage-resilient (LR) 3PAKE and designing the LR 3PAKE protocols. In the paper, we first define a continuous after-the-fact LR eCK-security model for 3PAKE and propose a LR 3PAKE protocol, then present a formal security proof in the standard model.

Integrity and Privacy through Authentication Key Exchange Protocols for Distributed Systems

Networking is the practice of connecting several computing devices together in order to share resources.In real world, attacks via force and fraud are privacy (unauthorized release of information), Integrity (tampering with data), Service (denial of service).The goals are disallow unauthorized access, allow authorized access, resist DOS attacks .In recent years, many efficient AKE protocols have been proposed to achieve user privacy and integrity in the communications. A communication model is a representation where there are a large number of clients accessing multiple remote and distributed storage devices in parallel. Authenticated key exchange (AKE) protocol allows a user and a server to authenticate each other and generate a session key for the later communications. This paper focuses on how to exchange key materials and establish parallel secure sessions between the clients and the storage devices in the Network in an efficient and scalable manner.

Protecting Touch: Authenticated App-To-Server Channels for Mobile Devices Using NFC Tags

Traditional authentication methods (e.g., password, PIN) often do not scale well to the context of mobile devices in terms of security and usability. However, the adoption of Near Field Communication (NFC) on a broad range of smartphones enables the use of NFC-enabled tokens as an additional authentication factor. This additional factor can help to improve the security, as well as usability of mobile apps. In this paper, we evaluate the use of different types of existing NFC tags as tokens for establishing authenticated secure sessions between smartphone apps and web services. Based on this evaluation, we present two concepts for a user-friendly secure authentication mechanism for mobile apps, the Protecting Touch (PT) architectures. These two architectures are designed to be implemented with either end of the spectrum of inexpensive and widely-available NFC tags while maintaining a reasonable trade-off between security, availability and cost.

Security Vulnerabilities and Improvements of SPAM: a Secure Password Authentication Mechanism for Seamless Handover in Proxy Mobile IPv6 Networks

The main contribution of this paper is to analyze a secure passwordauthentication mechanism (SPAM), proposed by Chuang et al. in 2013(IEEE Syst J.). The SPAM was used for designing a secure handover inProxy Mobile IPv6 (PMIPv6) networks. Chuang et al. in the originalpaper claimed that SPAM provides high security properties and canresist various attacks. However, in this paper we point out thatSPAM is vulnerable to the critical attacks, such as stolen smartcard and off-line dictionary attack, replay attack and impersonationattack. In addition, we show that the identity of MNs and thesession key between MN and MAG can be disclosed by an insiderattacker; resultantly, anonymity and confidentiality between MNs andMAG will be completely broken in SPAM. As a remedy, we also propose an improved scheme which not only conquers the problems of the previous schemes but also provides a reduction in computational cost. Moreover, the proposed scheme provides the user anonymity and untraceability and secure session key agreement. Finally, the security of the improved protocol is proved in the random oracle model.DOI: http://dx.doi.org/10.5755/j01.itc.46.2.12118