Smart Card Based Authentication Scheme Research Articles

An efficient and provably secure authentication scheme based on elliptic curve signature using a smart card

Smart card-based authentication schemes play an important role in remote system access and provide a secure method for resource sharing. Over the past two decades, many password-based authenticatio...

An enhanced password authentication scheme for session initiation protocol with perfect forward secrecy.

The Session Initiation Protocol (SIP) is an extensive and esteemed communication protocol employed to regulate signaling as well as for controlling multimedia communication sessions. Recently, Kumari et al. proposed an improved smart card based authentication scheme for SIP based on Farash’s scheme. Farash claimed that his protocol is resistant against various known attacks. But, we observe some accountable flaws in Farash’s protocol. We point out that Farash’s protocol is prone to key-compromise impersonation attack and is unable to provide pre-verification in the smart card, efficient password change and perfect forward secrecy. To overcome these limitations, in this paper we present an enhanced authentication mechanism based on Kumari et al.’s scheme. We prove that the proposed protocol not only overcomes the issues in Farash’s scheme, but it can also resist against all known attacks. We also provide the security analysis of the proposed scheme with the help of widespread AVISPA (Automated Validation of Internet Security Protocols and Applications) software. At last, comparing with the earlier proposals in terms of security and efficiency, we conclude that the proposed protocol is efficient and more secure.

Security Enhanced Anonymous User Authenticated Key Agreement Scheme Using Smart Card

Nowadays, the password-based remote user authentication mechanism using smart card is one of the simplest and convenient authentication ways to ensure secure communications over the public network environments. Recently, Liu et al. proposed an efficient and secure smart card based password authentication scheme. However, we find that Liu et al.’s scheme is vulnerable to the off-line password guessing attack and user impersonation attack. Furthermore, it also cannot provide user anonymity. In this paper, we cryptanalyze Liu et al.’s scheme and propose a security enhanced user authentication scheme to overcome the aforementioned problems. Especially, in order to preserve the user anonymity and prevent the guessing attack, we use the dynamic identity technique. The analysis shows that the proposed scheme is more secure and efficient than other related authentication schemes.

Secure and Efficient User Authentication Scheme Based on Password and Smart Card for Multiserver Environment

The rapid development of information and network technologies motivates the emergence of various new computing paradigms, such as distributed computing, cloud computing, and edge computing. This also enables more and more network enterprises to provide multiple different services simultaneously. To ensure these services can only be accessed conveniently by authorized users, many password and smart card based authentication schemes for multiserver architecture have been proposed. Recently, Truong et al. introduced an identity based user authentication scheme on elliptic curve cryptography in multiserver environment and claimed that their scheme is secure against popular attacks. However, in this paper, we point out that their scheme suffers from offline password guessing and impersonation attack and fails to achieve security requirements of this kind of authentication scheme. Moreover, we put forward a new scheme to conquer security pitfalls in the above scheme. Security analysis indicates that the proposed scheme can be free from well-known attacks. Performance discussion demonstrates that our scheme has advantages in terms of both security property and computation efficiency and thus is more desirable for practical applications in multiserver environment.

Design and analysis of smart card-based authentication scheme for secure transactions

Remote authentication scheme utilising smart cards have become a prevalent concept due to their convenience and simplicity. Recently, Lee (2015) proposed a low cost authentication scheme without verifier tables. However, in this paper we show that Lee's scheme is susceptible to various attacks and fails to provide essential security properties. We then present our own scheme and perform an informal analysis to substantiate the claim that our scheme is able to resist the previous scheme's weaknesses.

Design and analysis of smart card-based authentication scheme for secure transactions

Remote authentication scheme utilising smart cards have become a prevalent concept due to their convenience and simplicity. Recently, Lee (2015) proposed a low cost authentication scheme without verifier tables. However, in this paper we show that Lee's scheme is susceptible to various attacks and fails to provide essential security properties. We then present our own scheme and perform an informal analysis to substantiate the claim that our scheme is able to resist the previous scheme's weaknesses.

Anonymous biometrics-based authentication scheme with key distribution for mobile multi-server environment

Significant advances in wireless communication technologies have led to the emergence and proliferation of a wide range of mobile devices and mobile services. However, the use of various cloud servers has made the traditional single-server architecture, where we have one server and many users, inefficient in terms of its performance. To address this drawback, multi-server architectures have been proposed. Password or smart card-based authentication schemes suffer from poor security in the multi-server environment and as a result biometrics have become a preferred choice for secure and robust authentication because of its close link with the physical characteristics of an individual. Recently Kumari and Li et al. proposed a biometrics-based authentication scheme for multi-server environment. However, we found that their scheme fails to meet user anonymity requirement and is vulnerable to several attacks. Therefore, first of our work, we describe the various possible attacks on the previous scheme. Then, to enhance user anonymity, we propose a new biometrics-based authentication scheme with key distribution for the mobile multi-server environment. Our proposed scheme is based on smart card and elliptic curve cryptosystem. Informal and formal security analyses demonstrate that our scheme can satisfy the security and functional requirements in the mobile multi-server environment. Moreover, performance results (such as computation and communication cost) obtained with our proposed scheme demonstrate significant improvements in the level of security.

Security analysis and enhanced user authentication in proxy mobile IPv6 networks.

The Proxy Mobile IPv6 (PMIPv6) is a network-based mobility management protocol that allows a Mobile Node(MN) connected to the PMIPv6 domain to move from one network to another without changing the assigned IPv6 address. The user authentication procedure in this protocol is not standardized, but many smartcard based authentication schemes have been proposed. Recently, Alizadeh et al. proposed an authentication scheme for the PMIPv6. However, it could allow an attacker to derive an encryption key that must be securely shared between MN and the Mobile Access Gate(MAG). As a result, outsider adversary can derive MN’s identity, password and session key. In this paper, we analyze Alizadeh et al.’s scheme regarding security and propose an enhanced authentication scheme that uses a dynamic identity to satisfy anonymity. Furthermore, we use BAN logic to show that our scheme can successfully generate and communicate with the inter-entity session key.

Applying Keystroke Dynamics for Personal Authentication

With the establishment of the information society, security had become the greatest concern for Institutions transacting business over the Internet. Home banking and on-line brokerage applications currently, use basic software-only security functions for the internet such as server authentications and Secure Sockets layer. Higher levels of protections are being achieved with Smart card based authentication schemes and transaction protocols. Password based security identifies users based on what they know – the password or PIN, which can be guessed, hacked, found or stolen. Smart Cards, tokens and badges identify users based on what they have which can also be lost, loaned or stolen. The objective of the thesis was to design and implement a biometric authentication scheme by means of keystroke dynamics to secure web applications. The scheme illustrates the effect of the template size and the number of biometric features used to improve performance of FAR, FRR and EER. The enrolment process is devoid of spurious outliers that may introduce significant variations to template data. Due to the dependence of the system on the user’s psychological characteristics, the adaptation module introduces dynamism into the template features per changes in the legitimate user’s login template variants. At the quest of attaining a zero bias in statistical variants, an off-line simulator tool was designed to regenerate impostor and genuine data set obtained from live users and set as input to the system. The report includes an architectural description of the system, conceptual models and analysis of field data of over 200 samples.

An Anonymous Authentication Scheme with the Enhanced Security for Wireless Communications

In wireless communication system, a good protocol should satisfy many requirements: user identity authentication, privacy protection, computational efficiency and resist some known attacks. Thus design a highly secure anonymous authentication protocols for wireless networks is a challenging task. Over recent years, many researchers have proposed their own solutions to address this issue. In 2014, Niu et al. analyzed Yoon et al.’s authentication scheme, then put forward a smart card based authentication scheme with anonymity for wireless networks. They claimed their scheme achieves many security requirements and resists some known threats. Nevertheless, after detailed analysis, we prove that the scheme of Niu et al. is prone to some malicious attacks such as replay attacks and DoS attacks. Moreover, the scheme does not work when large amount of mobile users access a foreign agent simultaneously. To overcome these drawbacks, we present a new secure authentication scheme with user anonymity by improving Niu et al.’s scheme. The proposed protocol not only satisfies many security properties, such as strong anonymity, mutual authentication and periodically update session key, but also resists well-known threats. Furthermore, the security and performance analyses indicates that the new scheme is well suitable for wireless communications when it is compared with previous protocols.

Cryptanalysis of a Multiple Server Smart Card based Authentication Scheme

Cryptanalysis of a Multiple Server Smart Card based Authentication Scheme

An Anonymous Authentication with Key-Agreement Protocol for Multi-Server Architecture Based on Biometrics and Smartcards

Authentication protocols for multi-server architectures have gained momentum in recent times due to advancements in computing technologies and associated constraints. Lu et al. recently proposed a biometrics and smartcards-based authentication scheme for multi-server environment. The careful analysis of this paper demonstrates Lu et al.’s protocol is susceptible to user impersonation attacks and comprises insufficient data. In addition, this paper proposes an improved authentication with key-agreement protocol for multi-server architecture based on biometrics and smartcards. The formal security of the proposed protocol is verified using the widely accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool to ensure that our protocol can withstand active and passive attacks. The formal and informal security analysis, and performance analysis sections determines that our protocol is robust and efficient compared to Lu et al.’s protocol and existing similar protocols.

A Novel Smart-Card Based Authentication Scheme Using Proactive Secret Sharing

A Novel Smart-Card Based Authentication Scheme Using Proactive Secret Sharing

A Provably Secure, Efficient, and Flexible Authentication Scheme for Ad hoc Wireless Sensor Networks

In 2014, Turkanovic et al. proposed a smart card-based authentication scheme for heterogeneous ad hoc wireless sensor network. This scheme is very efficient since it employs only hash function and XOR operation. However, we found that Turkanovic et al. ’s scheme is vulnerable to impersonation attack with node capture, stolen smart card attack, sensor node spoofing attack, stolen verifier attack, and fails to ensure backward secrecy. We propose an efficient scheme to overcome all those weaknesses. Moreover, we also propose an advanced scheme, which provides perfect forward secrecy without much modification from the first proposed scheme.

Efficient Anonym Smart Card Based Authentication Scheme for Multi-Server Architecture

Multi-server authentication schemes are very practical from a user point of view, since they allow a user to get access to different services on different servers with one single registration. Smart card based approaches lead to more secure systems because they offer two-factor authentication, based on the strict combination of user's password and the possession of the smart card. In this paper, we first show that a previously proposed scheme does not satisfy perfect forward secrecy and is not resistant against insider attacks. Next, we propose a very efficient smart card based authentication scheme, solely using xor and hash operations, which is resistant against dishonest users and servers. Also anonymity and untraceability of user's behaviour is avoided.

An improved smart card based authentication scheme for session initiation protocol

Sessioninitiation protocol (SIP) reformed the controlling routine of voice over Internet Protocol based communication over public channels. SIP is inherently insecure because of underlying open text architecture. A number of solutions are proposed to boost SIP security. Very recently Farash (Peer to Peer Netw. Appl. 1–10, 2014) proposed an enhanced protocol to improve the security of Tu et al.’s protocol (Peer to Peer Netw. Appl. 1–8, 2014). Further, Farash claimed his protocol to be secure against all known attacks. However, in this paper we show that Farash’s protocol is insecure against impersonation attack, password guessing attack, lacks user anonymity and is vulnerable to session-specific temporary information attack. Further, we have proposed an upgraded protocol to enhance the security. The security and performance analysis shows that the proposed protocol reduced one point multiplication as compared with Farash’s protocol, while resisting all known attacks. We have proved the security of proposed protocol using automated tool ProVerif.

Towards Smart Card Based Mutual Authentication Schemes in Cloud Computing

In the cloud environment, users pay more attentions to their data security since all of them are stored in the cloud server. Researchers have proposed many mutual authentication schemes for the access control of the cloud server by using the smart card to protect the sensitive data. However, few of them can resist from the smart card lost problem and provide both of the forward security and the backward security. In this paper, we propose a novel authentication scheme for cloud computing which can address these problems and also provide the anonymity for the user. The trick we use is using the password, the smart card and the public key technique to protect the processes of the user’s authentication and key exchange. Under the Elliptic Curve Diffie-Hellman (ECDH) assumption, it is provably secure in the random oracle model. Compared with the existing smart card based authentication schemes in the cloud computing, the proposed scheme can provide better security degree.

Design of a lightweight two-factor authentication scheme with smart card revocation

Smart card based authentication schemes present user-friendly and secure communication mechanism over insure public channel. Recently, Li et al. designed an authentication scheme with pre-smart card authentication to present efficient login phase and user-friendly password change phase. It can quickly detect illegitimate login attempt. We analyze the security of Li et al.'s scheme, and identify the scheme insecure. Moreover, their scheme requires the computation of public key operations. To address the security and efficiency of mutual authentication design, we propose a lightweight authentication scheme, which supports smart card revocation. The proposed scheme requires the computation of only hash function and exclusive-or operations. Furthermore, we verify the correctness of mutual authentication using the widely-accepted BAN (Burrows, Abadi, and Needham) logic. Through the security and performance analysis, we show that our scheme is secure and computationally efficient than the existing schemes. Furthermore, the proposed scheme present efficient login and password change phases where incorrect login is quickly detected, and a user can freely change his password without server assistance.

Cryptanalysis and improvement of ‘a secure authentication scheme for telecare medical information system’ with nonce verification

In 2009, Xu et al. presented an improved smartcard based authentication scheme while using a security model previously applied by Bellare et al. to prove the security of their authentication methods. Later on, in 2012, Wu et al. pointed out number of authentication attacks in Xu et al. scheme. To address these issues, Wu et al. presented a Smartcard based Two-Factor Authentication (2FA) scheme for Telecare Medical Information System (TMIS) facility. In this study, we prove that authentication scheme of Wu et al. is still vulnerable to impersonation attack, offline password guessing attack, forgery attack and many other attacks. Moreover, number of performance and verification issues are also outlined in the authentication scheme of Wu et al. To overcome these issues, an improved and enhanced 3FA Smartphone based authentication method is proposed on a Cloud Computing environment. The proposed scheme is further corroborated using Burrows-Abadi-Needham logic (BAN logic) nonce verification. The detailed BAN logic verification and further security analysis shows that the proposed authentication protocol is highly reliable and secure in terms of message verifications, message freshness and trustworthiness of its origin. Moreover, the comparative security, performance and feature analysis shows that the proposed work yields an even more improved and enhanced authentication framework as compared to Wu et al. authentication scheme.

Robust and efficient biometrics based password authentication scheme for telecare medicine information systems using extended chaotic maps.

The Telecare Medicine Information Systems (TMISs) provide an efficient communicating platform supporting the patients access health-care delivery services via internet or mobile networks. Authentication becomes an essential need when a remote patient logins into the telecare server. Recently, many extended chaotic maps based authentication schemes using smart cards for TMISs have been proposed. Li et al. proposed a secure smart cards based authentication scheme for TMISs using extended chaotic maps based on Lee's and Jiang et al.'s scheme. In this study, we show that Li et al.'s scheme has still some weaknesses such as violation the session key security, vulnerability to user impersonation attack and lack of local verification. To conquer these flaws, we propose a chaotic maps and smart cards based password authentication scheme by applying biometrics technique and hash function operations. Through the informal and formal security analyses, we demonstrate that our scheme is resilient possible known attacks including the attacks found in Li et al.'s scheme. As compared with the previous authentication schemes, the proposed scheme is more secure and efficient and hence more practical for telemedical environments.