Smart Card Based Password Authentication Research Articles

Quantum2FA: Efficient Quantum-Resistant Two-Factor Authentication Scheme for Mobile Devices

Smart-card based password authentication has been the most widely used two-factor authentication (2FA) mechanism for security-critical applications (e.g., e-Health, smart grid and e-Commerce) in the past decades, and it is likely to hold its status in the foreseeable future. Hundreds of this type of 2FA schemes have been proposed, yet to our knowledge, most of them are built on the intractability of conventional hard problems (e.g., discrete logarithm problems and integer factoring problems) which are no longer hard in the quantum era. With the recent advancements in quantum computing, the design of secure and efficient smart-card based password authentication schemes against quantum attacks is becoming increasingly urgent. However, it is not as simple as it seems, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">how to design such a quantum-resistant 2FA scheme is challenging due to the demanding security requirements and the resource-constrained nature of mobile devices</i> . In this work, we take the first step towards this issue by proposing Quantum2FA, a practical quantum-resistant smart-card-based password authentication scheme that employs Alkim <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> ’s lattice-based key exchange and Wang-Wang’s “fuzzy-verifier + honeywords” technique (IEEE TDSC’18). Particularly, Quantum2FA can thwart the newly revealed key-reuse attack (ACISP’18, CT-RSA’19) against lattice-based key exchange schemes in two aspects: signal leakage attacks and key mismatch attacks. Specifically, it restricts the necessary conditions (i.e., the attacker must be the initiator of the key exchange) for an adversary to analyze the signal; It introduces honeywords to detect the key mismatches between the smart card and the server, and thus smart card loss attack can be thwarted. We formally prove the security of Quantum2FA under the random oracle model and demonstrate its efficiency through experiments on a 32 MHz 8-bit AVR Embedded Processor. Comparison results show that Quantum2FA is not only more secure but also offers better computation efficiency than the state-of-the-art conventional 2FA schemes.

A New Remote Fuzzy User Password Authentication Scheme Using Sub-tree for Cloud Computing

Recent advancements in internet technology and the infrastructure have attracted more people and organizations to do everything online. Internet technologies have provided amazing and smooth ease for electronic sales and purchases. However, many people have refused to use these internet technologies in electronic purchases because of unstable and insecure forms. New hacking techniques and new types of attacks have been tackled to make these internet technologies better and safer. Smartcard-based password authentication schemes have been the mainstream in recent years, featuring their highly lightweight, easy-to-use equipment and lowcost apps. Various secure and faster authentication schemes have been proposed in the literature. However, most of the existing authentication schemes have found vulnerable to recent attacks and have security flaws. This paper provides and efficient way for authentication using the partial discrete logarithm and sub-tree structure. The proposed scheme has seen effective and more useful in cloud computing environment. The analysis based on the security and the computational cost shows that the proposed authentication scheme proves to be more secure and efficient compared to other protocols that serve the same purposes.

A Secure and Robust Smart Card Based Remote User Authentication Scheme

In the new era of technology, smart cards play a critical role in economic and social interactions. Security vulnerabilities of these smart cards are the main concern for many users as well as researchers. Authentication has been used as one of the basic security solution to protect the data from unauthorised access. In recent years, smart card-based password authentication has gotten more attention by researchers. This paper reviews different smart card authentication methods and proposes an improved authentication method to cover existing security weaknesses including security of verification. Finally, the proposed method is analysed and compared to the related works.

An Improved Mutual Authentication Scheme with Smart Cards and Password under Trusted Computing

In the traditional smart card-based password authentication schemes, the authentication is only applied to verify both of server and user, but not applied to verify the platform. Recently, Yang, Ma, and Jiang proposed a mutual authentication scheme with smart cards and password under trusted computing. Their scheme was designed to authenticate the platform. They claimed that their scheme could withstand most of the possible attacks, such as secure session key agreement, user identity anonymity, password free changing, and platform certification updating. However, we will show that their scheme is vulnerable to on-line guessing password attack with smart card, and man-in-the-middle attack. In this article, we also propose an improved Yang-Ma-Jiang’s mutual authentication scheme to withstand the vulnerability in their scheme.

Privacy Preserving User Authentication Scheme Based on Smart Card

One of the most commonly used user authentication mechanisms is two factor authentication based on smart card and password. The core feature of the scheme is to enforce that the user must have the smart card and know the password in order to gain access to server. Recently, Liu et al. proposed a smart card based password authentication scheme and argued that it is secure against insider attack, replay attack and man in the middle attack and provides perfect forward secrecy. In this paper, we show security weaknesses in Liu et al.’s scheme focused on off-line password guessing attack and masquerading attack and it does not provide perfect forward secrecy and anonymity. Accordingly, we propose a privacy preserving user authentication scheme based on smart card, denoted as PUAS, to remedy these security weaknesses and to provide anonymity and perfect forward secrecy. PUAS is more secure with a bit of computational overhead to support several positive properties in security and privacy.

The Weakness of Moon et al.’s Password Authentication Scheme

Using smart cards make remote transactions easier for users in Internet. It’s important to identity the legal users to have the access right to obtain the resources. In 2017, Liu et al. proposed an efficient and secure smart card based password authentication scheme. Recently, Moon et al. pointed some weaknesses of Liu et al.’s scheme. They also proposed a password authentication scheme to overcome Liu et al.’s weaknesses. They claim that their scheme is more secure and practical as a remote user authentication scheme. However, we find that some weaknesses of Moon et al.'s scheme. In this article, we will show that Moon et al.’s scheme is vulnerable to the guessing identity and impersonation attacks.

Secure Remote User Mutual Authentication Scheme with Key Agreement for Cloud Environment

Authentication schemes are widely used mechanisms to thwart unauthorized access of resources over insecure networks. Several smart card based password authentication schemes have been proposed in the literature. In this paper, we demonstrate the security limitations of a recently proposed password based authentication scheme, and show that their scheme is still vulnerable to forgery and offline password guessing attacks and it is also unable to provide user anonymity, forward secrecy and mutual authentication. With the intention of fixing the weaknesses of that scheme, we present a secure authentication scheme. We show that the proposed scheme is invulnerable to various attacks together with attacks observed in the analyzed scheme through both rigorous formal and informal security analysis. Furthermore, the security analysis using the widely-accepted Real-Or-Random (ROR) model ensures that the proposed scheme provides the session key (SK) security. Finally, we carry out the performance evaluation of the proposed scheme and other related schemes, and the result favors that the proposed scheme provides better trade-off among security and performance as compared to other existing related schemes.

An Improved and Secure Two-factor Dynamic ID Based Authenticated Key Agreement Scheme for Multiserver Environment

The smart card based password authentication scheme is one of the most important and efficient security mechanism, which is used for providing security to authorized users over an insecure network. In this paper, we analyzed major security flaws of Jangirala et al.’s scheme and proved that it is vulnerable to forgery attack, replay attack, user impersonation attack. Also, Jangirala et al.’s scheme fail to achieve mutual authentication as it claimed. We proposed an improved two factor based dynamic ID based authenticated key agreement protocol for the multiserver environment. The proposed scheme has been simulated using widely accepted AVISPA tool. Furthermore, mutual authentication is proved through BAN logic. The rigorous security and performance analysis depicts that the proposed scheme provides users anonymity, mutual authentication, session key agreement and secure against various active attacks.

Security Enhanced Anonymous User Authenticated Key Agreement Scheme Using Smart Card

Nowadays, the password-based remote user authentication mechanism using smart card is one of the simplest and convenient authentication ways to ensure secure communications over the public network environments. Recently, Liu et al. proposed an efficient and secure smart card based password authentication scheme. However, we find that Liu et al.’s scheme is vulnerable to the off-line password guessing attack and user impersonation attack. Furthermore, it also cannot provide user anonymity. In this paper, we cryptanalyze Liu et al.’s scheme and propose a security enhanced user authentication scheme to overcome the aforementioned problems. Especially, in order to preserve the user anonymity and prevent the guessing attack, we use the dynamic identity technique. The analysis shows that the proposed scheme is more secure and efficient than other related authentication schemes.

An efficient and secure remote user mutual authentication scheme using smart cards for Telecare medical information systems

Abstract Authentication schemes are widely used mechanisms to thwart unauthorized access of resources over insecure networks. Several smart card based password authentication schemes for Telecare Medical Information Systems (TMIS) have been proposed in the literature. Recently, Lee et al. proposed an authentication scheme for TMIS and then they claimed that their scheme is able to resist various attacks. However, in this paper we demonstrate that Lee et al. scheme is still vulnerable to forgery and offline password guessing attacks and it is also unable to provide user anonymity, forward secrecy and mutual authentication. With the intention of fixing the weaknesses of Lee et al. scheme, we present a secure authentication scheme for TMIS. Moreover, the proposed scheme can also resist all known attacks. We prove the security of the proposed scheme with the help of widely-accepted random Oracle model. Finally, we carry out the performance evaluation of the proposed scheme and other related schemes, and the result favors that the proposed scheme provides better trade-off among security and performance as compared to other existing related schemes.

Privacy Preserving User Authentication Scheme Based on Smart Card

One of the most commonly used user authentication mechanisms is two factor authentication based on smart card and password. The core feature of the scheme is to enforce that the user must have the smart card and know the password in order to gain access to server. Recently, Liu et al. proposed a smart card based password authentication scheme and argued that it is secure against insider attack, replay attack and man in the middle attack and provides perfect forward secrecy. In this paper, we show security weaknesses in Liu et al.’s scheme focused on off-line password guessing attack and masquerading attack and it does not provide perfect forward secrecy and anonymity. Accordingly, we propose a privacy preserving user authentication scheme based on smart card, denoted as PUAS, to remedy these security weaknesses and to provide anonymity and perfect forward secrecy. PUAS is more secure with a bit of computational overhead to support several positive properties in security and privacy.

Improvement of Efficient and Secure Smart Card Based Password Authentication Scheme.

Improvement of Efficient and Secure Smart Card Based Password Authentication Scheme.

Enabling Telecare Medical Information Systems with Strong Authentication and Anonymity

Telecare medical information system (TMIS) is highly desirable to users by allowing them to remotely access medical services or medical information and security, such as authentication and privacy preserving of users is challenging. Recently, some smart card-based password authentication (two-factor authentication) schemes have been proposed. In this paper, we use Chaudhry et al. ’s scheme as a case study and demonstrate that a family of two-factor authentication schemes for the TMIS are not secure against offline dictionary attack and fail to revoke the stolen/lost smart card. Furthermore, an improved two-factor authentication scheme with anonymity has been proposed to remedy the weakness of these schemes. The security analysis of the proposed solution is formally given with the random oracle model and Burrows–Abadi–Needham logic.

Cryptanalysis of Ahirwal-Sonwanshi ID-Based Remote User Authentication Scheme

Due to the rapid growth of computer and communication technologies, people obtain variety of online services quickly. However, all networks are vulnerable to lots of security threats and attacks. The remote authentication scheme provides an efficient method to validate the remote users and servers. Ahirwal and Sonwanshi proposed a remote user authentication scheme with smart card in 2012. They indicated that Song’s smart card based password authentication protocol cannot resist the offline password guessing attack, insider attack, forward secrecy and denial of service attack. They proposed an ID-based authentication scheme to fix security flaws. The scheme uses one-way hash function and bitwise XOR operation such that the computation complexity is very low. However, in this article, we will show that their scheme cannot withstand the offline password guessing attack as they declared. An adversary can use the intercepted messages of two login sessions to obtain the password.

Robust dynamic ID-based remote user authentication scheme using smart cards

Smart card–based password authentication scheme is one of the most simple and efficient method to identify the legitimacy of a user via an insecure channel. To protect the user from tracking by the attacker, many dynamic ID–based user authentication schemes have been proposed. Recently, Chen et al. proposed an efficient and secure dynamic ID–based authentication scheme using smart cards. However, we find that Chen et al.'s scheme cannot really protect user's anonymity and forward secrecy. Besides, their scheme is inefficient in the authentication phase and cannot resist stolen smart card attack. In this paper, we propose a robust dynamic ID–based user authentication scheme using smart cards to cover the above weaknesses, the proposed scheme can really protect the user's anonymity and is more secure comparing with other related schemes.

Cryptanalysis of a Sensor Smart Card Based Password Authentication Scheme with User Anonymity

Cryptanalysis of a Sensor Smart Card Based Password Authentication Scheme with User Anonymity

An enhanced smart card based remote user password authentication scheme

Smart card based password authentication is one of the simplest and efficient authentication mechanisms to ensure secure communication in insecure network environments. Recently, Chen et al. have pointed out the weaknesses of some password authentication schemes and proposed a robust smart card based remote user password authentication scheme to improve the security. As per their claims, their scheme is efficient and can ensure forward secrecy of the session key. However, we find that Chen et al.'s scheme cannot really ensure forward secrecy, and it cannot detect the wrong password in login phase. Besides, the password change phase of Chen et al.'s scheme is unfriendly and inefficient since the user has to communicate with the server to update his/her password. In this paper, we propose a modified smart card based remote user password authentication scheme to overcome the aforementioned weaknesses. The analysis shows that our proposed scheme is user friendly and more secure than other related schemes.

A new password authentication and user anonymity scheme based on elliptic curve cryptography and smart card

Password authentication has been widely used in computer networks to provide secure remote access control. In this study, the authors show that the improved password authentication and update scheme based on elliptic curve cryptography proposed by Islam and Biswas is vulnerable to offline password guessing, stolen-verifier and insider attacks. We propose an advanced smart card-based password authentication and update scheme and extend the scheme to provide the privacy of the client. By comparing the criteria with other related schemes, our scheme not only solves several hard security threats but also satisfies more functionality features.

Improved Dynamic ID-based Authentication Scheme for Telecare Medical Information Systems

In order to protect users' identity privacy, Chen et al. proposed an efficient dynamic ID-based authentication scheme for telecare medical information systems. However, Chen et al.'s scheme has some weaknesses. In Chen et al.'s scheme, an attacker can track a user by a linkability attack or an off-line identity guessing attack. Chen et al.'s scheme is also vulnerable to an off-line password guessing attack and an undetectable on-line password guessing attack when user's smart card is stolen. In server side, Chen et al.'s scheme needs large computational load to authentication a legal user or reject an illegal user. To remedy the weaknesses in Chen et al.'s scheme, we propose an improved smart card based password authentication scheme. Our analysis shows that the improved scheme can overcome the weaknesses in Chen et al.'s scheme.

Advanced Smart Card Based Password Authentication with User Anonymity

Advanced Smart Card Based Password Authentication with User Anonymity