Server Impersonation Attack Research Articles

Cryptanalysis and improvement of REAS‐TMIS: Resource‐efficient authentication scheme for telecare medical information system

AbstractRecently, Tanveer et al. proposed a resource‐efficient authentication scheme for telecare medical information systems employing the authenticated key exchange. Tanveer et al. vehemently claimed that the protocol is safe against smart card stolen attacks, password guessing attacks, anonymity and untraceability, replay attacks, man‐in‐the‐middle attacks, impersonation attacks, and so forth. We have scrutinized the Tanveer et al. protocol. Based on his attack model, we have analyzed that this protocol is not secured against session key disclosure attacks, privileged insider attacks, and medical server impersonation attacks. We have also discussed improvement mechanisms to protect the mentioned security threats.

Improved Secure and Efficient Chebyshev Chaotic Map-Based User Authentication Scheme

A Chebyshev chaotic map is a method for implementing efficient authentication. Recently, Chatterjee <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> proposed an authentication scheme for multi-server/multi-client environments using a Chebyshev chaotic map. However, we found four critical vulnerabilities in the proposed authentication method. To begin with, the method is open to user as well as server impersonation attacks. User revocation is also infeasible. Finally, there is a possibility of critical information leakage. We propose a new scheme that overcomes the four weaknesses listed previously using a symmetric Chebyshev chaotic map. We tested our proposed scheme using ProVerif and AVISPA, and compared its performance with that of the conventional authentication method. Results indicate that our scheme is 44.025 times more efficient than the conventional method.

A secure blockchain-oriented data delivery and collection scheme for 5G-enabled IoD environment

−There are innumerable ways the Internet of Drones (IoD) technology can impact our society. With the deployment of an airborne network, the IoD can support real-time low-cost delivery of services ranging from military surveillance to a myriad of civilian applications. Nevertheless, the drones employ insecure wireless communication channels to communicate with other entities in the system, inhibiting its induction in sensitive installations if insecure or inefficient Authenticated Key Agreement (AKA) schemes are employed. The blockchain, an open distributed ledger-based technology, is increasingly being adopted to address the security concern as discussed. Recently, Bera et al. presented an efficient blockchain-enabled AKA scheme for data management among various entities in IoD network. However, their scheme does not support anonymity and untraceability for the drones; also, it does not provide resistance to Ground station server impersonation attack, while the protocol has a few redundancies. Later, we proposed an enhanced blockchain-enabled AKA scheme BOD5-IOD to authenticate drones in the system. The BOD5-IOD, other than supporting a robust access control mechanism between drones and GSS, also ensures safe transactions among all entities in the IoD environment. The formal analysis and performance evaluation endorse that our scheme supports security requirements with computational and communication efficiency of 34.4% and 23.3%, respectively.

Improved ECC-Based Three-Factor Multiserver Authentication Scheme

A multiserver environment can improve the efficiency of mobile network services more effectively than a single server in managing the increase in users. Because of the large number of users, the security of users’ personal information and communication information is more important in a multiserver environment. Recently, Wang et al. proposed a multiserver authentication scheme based on biometrics and proved the security of their scheme. However, we first demonstrate that their scheme is insecure against a known session-specific temporary information attacks, user impersonation attacks, and server impersonation attacks. To solve the security weakness, we propose an improved scheme based on Wang et al.’s scheme. The security of our improved scheme is also validated based on the formal security analysis, Burrows–Abadi–Needham (BAN) logic, ProVerif, and informal security analysis. Security and performance comparisons prove the security and efficiency of our scheme.

Provable Privacy Preserving Authentication Solution for Internet of Things Environment

The Internet of Things (IoT) has become an important technology which permits different devices and machines to interconnect with each other using heterogeneous networks. The integration of numerous techniques is expected to offer extraordinary growth in future and current promising applications of IoT. In these days, the secure communication among interconnected IoT components has become an important issue of concern. Therefore, it has become a foremost need to design such authentication protocol which can make the secure communication among IoT components. In this article, we proposed an identity-based authentication and key agreement protocol for the IoT environment in order to offer the secure communication between various IoT entities. The devised protocol utilizes the physically unclonable function which helps to robustly resist the physical attack on IoT components. We analyze the proposed protocol informally which clearly shows that the proposed protocol offers the perfect forward secrecy, device anonymity and untraceability and also resists the desynchronization, IoT node impersonation and server impersonation attacks. The security features of proposed protocol are also analyzed formally using well known Random Oracle Model (ROM). Moreover, the performance of the devised protocol has also been determined in terms of communication and computational overhead. The performance and security analysis shows the supremacy of the devised protocol over the various related protocols.

An enhanced mutual authentication and key establishment protocol for TMIS using chaotic map

Telecare Medical Information System (TMIS) is a platform for the patients and the medical server to communicate and exchange data through the Internet. As the Internet is an insecure medium, the shared sensitive data is at troublesome situation. To protect sensitive data over the public network, it is essential to have secure communication. The authentication and key establishment protocol supports building a secure communication between the patients and the medical server. Recently, Madhusudhan-Nayak proposed an enhanced chaotic map-based authentication and key establishment protocol for TMIS. In this work, we demonstrate that the Madhusudhan-Nayak scheme does not provide user anonymity, fails to achieve mutual authentication and susceptible to traceability attack, insider attack, server impersonation attack and replay attack. To overcome the weaknesses found in Madhusudhan-Nayak protocol, we propose an improved mutual authentication scheme suitable for TMIS with key establishment technique. The proposed protocol is analyzed against many security threats informally and using the formal method BAN logic, the protocol is proven to be mutually authenticated. As there are numerous authentication protocols for TMIS have been put forward in the literature, we compared the proposed scheme with the related existing schemes in several security aspects. The comparison results illustrate that the proposed protocol surpasses these competing schemes.

Comments on “AKM-IoV: Authenticated Key Management Protocol in Fog Computing-Based Internet of Vehicles Deployment”

Internet of Vehicles (IoV) has become an intelligent application of Internet of Things (IoT) in smart transportation. IoV takes intelligent commitments to the passengers for improving the efficiency and safety of traffic. It also creates an enjoyable riding atmosphere. Another variation of mobile cloud computing is fog cloud-based IoV, where Internet and vehicular cloud can co-operate in an effective way in IoV. Moreover, IoV is becoming dangerous to various attacks due to the increasing dependency of wireless communication and computing technologies. Recently, Wazid et al. proposed “AKM-IoV: Authenticated Key Management Protocol in Fog Computing-Based IoV Deployment” to make the communication secure between vehicles, fog servers, roadside units (RSUs), and cloud servers. In this comment, we cryptanalyzed the protocol of Wazid et al. and found it vulnerable to vehicle impersonation, fog server impersonation, RSU impersonation, and cloud server impersonation attacks.

A secure three factor-based fully anonymous user authentication protocol for multi-server environment

A single sign-on authentication scheme is required protocol in multi-server environment. Recently, an authentication protocol based on Lagrange interpolation polynomial to satisfy multi-server environment with low computational and communication cost is proposed. In this paper, we have analysed the above scheme and show that their scheme is vulnerable to various attacks like insider attack, server impersonation attack, user impersonation attack and stolen smart card attack. We also show that their scheme fails to provide server anonymity, user revocation in case smart card is lost/stolen or users authentication parameters are revealed. We have also proposed enhanced multi-server authentication protocol using biometric-based smart card and Lagrange interpolation which is more secure. The proposed protocol is analysed using BAN logic to show that the proposed protocol provides secure authentication. In addition, we have simulated our scheme using widely accepted and used AVISPA tool to prove that our scheme is secure against passive and active attacks. The proposed protocol provides high security and anonymity along with low communication and computational cost and various security functions.

A secure three factor-based fully anonymous user authentication protocol for multi-server environment

A single sign-on authentication scheme is required protocol in multi-server environment. Recently, an authentication protocol based on Lagrange interpolation polynomial to satisfy multi-server environment with low computational and communication cost is proposed. In this paper, we have analysed the above scheme and show that their scheme is vulnerable to various attacks like insider attack, server impersonation attack, user impersonation attack and stolen smart card attack. We also show that their scheme fails to provide server anonymity, user revocation in case smart card is lost/stolen or users authentication parameters are revealed. We have also proposed enhanced multi-server authentication protocol using biometric-based smart card and Lagrange interpolation which is more secure. The proposed protocol is analysed using BAN logic to show that the proposed protocol provides secure authentication. In addition, we have simulated our scheme using widely accepted and used AVISPA tool to prove that our scheme is secure against passive and active attacks. The proposed protocol provides high security and anonymity along with low communication and computational cost and various security functions.

An Improved Authentication Scheme for Remote Data Access and Sharing Over Cloud Storage in Cyber-Physical-Social-Systems

Cyber-physical-social systems (CPSSs) epitomize an evolving paradigm, including the social, physical, and cyber world. The vital goal of CPSSs is to offer personalized, high-quality, and proactive services for the end-users. An ingenious framework for reliable services is required for CPSSs to achieve this purpose. In this regard, the cloud storage environment of cloud computing (having a great connection with the physical, cyber, and social world) requires a reliable framework for secure communication between cloud and users. Cloud storage provides various services that need scalable, cost-effective, and secure facilities of data management. Public cloud storage bound its users to maintain strict security considerations that are offered by cloud service providers. On the other hand, an opportunity for users is offered by private cloud storage to construct a controlled and self-managed model of data security. This mobile model is responsible for managing the sharing and accessing of data privately. Despite that, it induces new challenges of data security. One censorious problem is to ensure the authenticated and secure model of data-storage for accessing the data under the controlled environment of data accessibility. To tackle this challenge, many protocols have been developed. The problem is that all these protocols are unable to fulfill the required security efficiency and are susceptible to various security attacks. Recently, Tiwari et al. presented an authentication scheme for data sharing and access with a biometric feature. They claimed that their scheme resists significant security attacks. However, in this article, we show that the claim of Tiwari et al. for developing a secure scheme is not valid, and their protocol is insecure against user and server impersonation attacks. Moreover, the protocol of Tiwari et al. do not provide user anonymity. Therefore, we present an enhanced, secure, and convenient scheme for data access. Besides, in order to add the flexible distribution of data that is controlled by data-owner, our protocol provides proxy re-encryption in which the cloud server utilizes the proxy re-encryption key. Then, the data-owner generates the credential token during decryption for controlling user’s accessibility. The security analysis determines that our proposed protocol resists numerous security attacks. Furthermore, performance analysis determines that our protocol has practical computation, communication, and storage costs as compared to various related protocols. Consequently, our introduced protocol achieves not only the security goals but also has performance efficiency comparable to numerous relevant protocols of cloud storage.

Enhanced secure data backup scheme using multi‐factor authentication

Remote data backup technology facilitates data storage for users. However, an attacker may intercept some sensitive data on transfer. To solve this problem, sensitive data should be encrypted before uploading to the remote storage. Thus, protecting the secret encryption key is very important. Liu et al. have designed a scheme to protect the secret key using the secret-sharing method and multi-factor authentication. Unfortunately, the authors find some security weaknesses of Liu et al. 's scheme. Liu et al. 's scheme cannot resist offline password guessing attack, the server impersonation attack, the user impersonation attack and an attacker updating password/biometrics attack. They present an enhanced secure data backup scheme using multi-factor authentication to overcome all above-mentioned security threats. The user first divided a secret used to encrypt sensitive data into three shares using Shamir's secret sharing. Moreover, then the user uses the own password and biometrics to hide the true shares, and stores the pseudo three shares in the smart card, the laptop and the server, separately. Furthermore, the proposed scheme is illustrated in detail, and they give a security comparison of their scheme with Liu et al. 's scheme and computational costs.

A Provably Secure Biometrics-Based Authentication Scheme for Multiserver Environment

With the rapid development of mobile services, multiserver authentication protocol with its high efficiency has emerged as an indispensable security mechanism for mobile services. Recently, Ali et al. introduced a biometric-based multiserver authentication scheme and claimed the scheme is resistant to various attacks. However, after a careful examination, we find that Ali et al.’s scheme is vulnerable to various security attacks, such as user impersonation attack, server impersonation attack, privileged insider attack, denial of service attack, fails to provide forward secrecy and three-factor secrecy. To overcome these weaknesses, we propose an improved biometric-based multiserver authentication scheme using elliptic curve cryptosystem. Formal security analysis under the random oracle model proves that our scheme is provably secure. Furthermore, BAN (Burrows-Abadi-Needham) logic analysis demonstrates our scheme achieves mutual authentication and session key agreement. In addition, the informal analysis proves that our scheme is secure against all current known attacks and achieves desirable features. Besides, the performance and security comparison shows that our scheme is superior to related schemes.

RETRACTION: Cryptanalysis and enhancement of multi factor remote user authentication scheme based on signcryption

&lt;p style='text-indent:20px;'&gt;Advances in Mathematics of Communications, (2020)&lt;/p&gt;&lt;p style='text-indent:20px;'&gt;This paper is retracted by decision of one of the Editors in Chief of the journal Advances in Mathematics of Communications.&lt;/p&gt;

A robust authentication scheme for telecare medical information systems

With the speedy progress in technology, the Internet has become a non-separable part of human life. It is obvious to use the Internet in all fields and medical field is no exception. The concept of establishing telecare medicine information systems(TMIS) for patients is gaining more popularity recently. To ensure the privacy of patients and to allow authorized access to remote medical servers, many authentication schemes have been proposed. Li et al., in 2016, proposed a secure dynamic identity and chaotic maps based user authentication and key agreement scheme. They claimed that the scheme is resistant to most of the known attacks. However, from thorough cryptanalysis, we have proved that their scheme is vulnerable to user impersonation attack, password guessing attack and server impersonation attack. We have also illustrated that their scheme does not provide user anonymity, convenient smart card revocation and security to session key. To overcome the aforementioned security weaknesses, we have proposed an enhanced authentication scheme using chaotic maps, which has been discussed in this paper along with its cryptanalysis. Cryptanalysis of the proposed scheme proves that the scheme is more robust and suitable for implementation.

Key Distribution Protocol for Industrial Internet of Things Without Implicit Certificates

The deployment of the Internet of Things (IoT) in industry, called the Industrial IoT (IIoT), is supporting the introduction of very desirable improvements, such as increasing production flexibility, self-organization, and real-time and quick response to events. However, security and privacy challenges are still to be well addressed. The IIoT requires different properties to achieve secure and reliable systems and these requirements create extra challenges considering the limited processing and communication power available to IIoT field devices. In this research article, we present a key distribution protocol for IIoT that is computationally and communicationally lightweight (requires a single message exchange) and handles node addition and revocation, as well as fast rekeying. The scheme can also resist the consequences of node capture attacks (we assume that captured nodes can be detected by the gateway and previous works have shown this assumption to be acceptable in practice), server impersonation attacks and provides forward/backward secrecy. We show formally the correctness of our protocol and evaluate its energy consumption under realistic scenarios using a real embedded platform compared to previous state-of-the-art key-exchange protocols, to show our protocol reliability for IIoT.

A Robust Mutual Authentication Scheme Based on Elliptic Curve Cryptography for Telecare Medical Information Systems

The telecare medical information systems (TMISs) provide the convenience to the patients/users to be served at home. Along with such ease, it is essential to preserve the privacy and to provide the security to the patients/users in TMIS. Often, authentication protocols are adopted to guarantee privacy and secure interaction between the patients/users and remote server. Recently, Chaudhry et al. pointed out that Islam et al. ’s scheme based on smart card is prone to user impersonation and server impersonation attacks. Chaudhry et al. later presented an enhanced scheme based on elliptic curve cryptography to remedy the weaknesses of Islam et al. ’s scheme. Unfortunately, we find some important limitations in both schemes. We remark that their scheme is prone to off-line password guessing attack, user/server impersonation attack, and man-in-middle attack. To overcome these limitations, we present an improved authentication scheme keeping apart the threats encountered in the design of Chaudhry et al. ’s scheme. Moreover, the presented scheme can also resist all known attacks. We prove the security of the proposed scheme with the help of widespread Burrows–Abadi–Needham logic. A brief comparison with the previous works provides that the presented protocol is more efficient and more secure than other related schemes.

A robust mutual authentication scheme for session initiation protocol with key establishment

The Session Initiation Protocol (SIP) is a communication protocol that controls multimedia communication sessions. As the Internet users widely use SIP services, mutual authentication between the user and SIP server becomes an important issue. Several authentication protocols for SIP have been proposed for enhancing security and better complexities. Very recently, Lu et al. proposes an authenticated key agreement protocol for SIP and claims that it withstands various attacks and efficient. This paper points out that their protocol does not provide one of the most important features user anonymity. In addition, the same protocol is not able to resist user impersonation attack, server impersonation attack and fails to provide mutual authentication. The paper also presents an improved mutual authentication and key establishment protocol that conquers the security weaknesses in Lu et al.’s protocol. Informal security analysis is also carried out for several security properties. The formal proof for the correctness of mutual authentication and session key agreement is provided using BAN logic. It is shown that the proposed protocol is provably secure against identity and password guessing attacks in the random oracle model. The performance of the proposed scheme is compared with that of the existing related Elliptic Curve Cryptography (ECC) based schemes for SIP and shown that our scheme outperforms the others.

Security analysis and improvement of bio-hashing based three-factor authentication scheme for telecare medical information systems

The deployment of telecare medical information system (TMIS) over public networks gives rise to the threat of exposing sensitive medical information to illegal entities. Although a number of three-factor authentication (3FA) schemes have been developed to address this challenge, most of them are found to be flawed. Understanding security and privacy failures of authentication protocols is a prerequisite to both fixing existing protocols and designing future ones. In this paper, we investigate the 3FA protocol of Lu et al. for TMIS (J Med Syst 39:32, 2015) and reveal that it cannot achieve the claimed security and privacy goals. (1) It fails to provide anonymity and untraceability, and is susceptible to the following attacks targeting user privacy: identity revelation attack, identity guessing attack and tracking attack. (2) It is susceptible to offline password guessing attack, user impersonation attack, and server impersonation attack. Then we present an improved 3FA scheme and show that the new scheme fulfills session key secrecy and mutual authentication using the formal verification tool ProVerif. Moreover, detailed heuristic security analysis is also presented to demonstrate that our new scheme is capable of withstanding various attacks, and provides desired security features. Additionally, performance analysis shows that our proposed protocol is a practical solution for TMIS.

Design of a secure anonymity-preserving authentication scheme for session initiation protocol using elliptic curve cryptography

The session initiation protocol (SIP) is a signaling protocol which is used to controlling communication in the Internet. It is also used for initiating, terminating and maintaining the sessions. A strong authentication scheme plays a pivotal role in safeguarding communications over the Internet. In order to ensure the secure communication, several authentication schemes have been proposed for SIP in the literature. Recently, Lu et al. proposed an authentication scheme for SIP-based communications and proved that their scheme can resist various network attacks. In this paper, we show that their scheme is susceptible to the user and server impersonation attacks. Also, their scheme fails to achieve user anonymity and mutual authentication. Hence, there is a need to propose a secure ECC-based authentication scheme with user anonymity for SIP to overcome the shortcomings of Lu et al.’s scheme. Security analysis shows that the proposed scheme is able to fix the flaws found in Lu et al.’s scheme. In addition to informal security discussions, we give formal security analysis of the proposed scheme under the generic group model of cryptography. Performance analysis also shows that the proposed scheme is suitable for SIP based communication.

Design of Mutually Authenticated Key Agreement Protocol Resistant to Impersonation Attacks for Multi-Server Environment

Three-factor mutually authenticated key agreement protocols for multi-server environments have gained momentum in recent times due to advancements in wireless technologies and associated constraints. Several authors have put forward various authentication protocols for multi-server environment during the past decade. Wang et al. recently proposed a biometric-based authentication with key agreement protocol for multi-server environment and claimed that their protocol is efficient and resistant to prominent security attacks. The careful investigation of this paper shows that Wang et al. protocol’s users are sharing personal identifiable information with the application servers during the registration and authentication process. This nature of disclosing credentials leads to severe threats particularly insider attacks, user impersonation attacks, and server impersonation attacks. As a remedy of the aforementioned problems, this paper proposes a novel biometric-based mutually authenticated key agreement protocols for multi-server architecture based on elliptic curve cryptography. We prove that the proposed protocol achieves secure mutual authentication property using the broadly used Burrows–Abadi–Needham logic. The formal security of the proposed protocol is verified using the widely accepted automated validation of Internet security protocols and applications tool to show that our protocol can withstand active and passive attacks including the replay and man-in-the-middle attacks. The proposed protocol is robust and efficient compared with the existing related protocols.