Smart Card-based User Authentication Research Articles

A Secure Biometrics and PUFs-Based Authentication Scheme With Key Agreement For Multi-Server Environments

The emergence of multi-server authentication key protocol schemes provides a viable environment for users to easily access the services of multiple legitimate servers through a single registration. Biometric identification technology has the characteristics of forgery difficulty, duplication difficulty and guess difficulty, etc. Therefore, it is an indispensable authentication technology in smart card-based user authentication protocol. There are many shortcomings in the existing schemes based on biometrics, including leakages of biometrics information, smart card theft attack, lack of user anonymity, user impersonation attack, server impersonation, and so on. To overcome these shortcomings, we propose a new user authentication and key agreement scheme in the multi-server environment. To some extent, we not only are able to guarantee the communication security between the user and the servers, but also ensure the physical security of the smart card and biometrics information. In this respect, we use lightweight cryptographic primitives, such as Physically Unclonable Functions (PUFs), Fuzzy extractor and One-way hash functions, and so on. The proposed scheme can effectively protect user's anonymity without the use of password and provide mutual authentication and key agreement in the multi-server environment. Subsequently, we used informal analysis, Burrows-Abadi-Needham Logic (BAN-Logic) proof, and a widely accepted Real-Or-Random model to prove the security and robustness of proposed scheme. Finally, our authentication protocol can protect the security of communication.

An improved Chang-Lee’s smart card-based authentication scheme

It is useful to verify a legal user from a remote terminal through the Internet with the user authentication schemes based on the smart card. Usually, the remote user has to use his/her identification accompanying the password to access the system. This action is an important scheme to protect the user’s privacy and confidentiality. To achieve the robustness and the efficiency, Chang and Lee proposed a scheme that employs a smart card-based user authentication with the characters of implementation practically and easily. Also, Chang and Lee claim that the scheme could resist the replay attacks, the impersonation attacks, the identity disclosure attacks, and the perfect forward secrecy. However, this work shows that the scheme is in the risk with an on-line guessing identity and password attacks and denial of service attack. Hence, in this paper, it proposes an improved user authentication scheme that holds the capacity to withstand the vulnerability as that in Chang-Lee’s smart card-based scheme.

Attacks and Solutions on the Quan et al.’s Smart Card Based Remote User Authentication with a Key Agreement Scheme

Recently, Quan et al. proposed a smart card based user authentication scheme to conquer the existing defects in An’s scheme. In their paper, they claimed that their proposed scheme could resist various attacks. However, by analysing their scheme, we demonstrate that it still suffers from a traceable attack and an off-line password guessing attack. To erase the weaknesses and enhance the security, we then suggest some modification in their scheme. Compared with Quan et al.’s and other related schemes, our modified one performs better in terms of security.

A Novel Smart Card Based User Authentication and Key Agreement Scheme for Heterogeneous Wireless Sensor Networks

Due to the open environment in which hierarchical wireless sensor networks (HWSNs) are typically deployed, it is important to authenticate transmitted data. In recent years, a number of user authentication schemes with smart card for HWSNs have been proposed. In 2014, Turkanovic et al. proposed a novel user authentication and key agreement scheme for heterogeneous ad hoc wireless sensor networks (HADWSNs). Their scheme is a lightweight, which requires the computation of only hash functions. In this paper, we first analyze Turkanovic et al.’s scheme and then demonstrate that their scheme cannot really protect against user masquerade, off-line password guessing, and node capture attacks. To overcome these security weaknesses, we further propose an advanced smart card based user authentication while inherits the original merits of their scheme. Through the informal and formal security analysis, we demonstrate that our scheme is resilient possible known attacks including the attacks found in Turkanovic et al.’s scheme. In addition, we compare the proposed scheme with related ones to prove that the computation cost of the proposed scheme are well suitable for practical applications in HADWSNs.

A provably secure biometrics-based authenticated key agreement scheme for multi-server environments

An authentication scheme handling multiple servers offers a feasible environment to users to conveniently access the rightful services from various servers using one-time registration. The practical realization of distribution of online services efficiently and transparently in multiple-server systems has come true by virtue of multi-server user authentication schemes. Due to distinguished properties like, difficulty to forge or copy, in-feasibility to lose or guess or forget, etc., biometrics have been widely preferred as a third authenticating factor in password and smart card based user authentication protocols. In this paper, we design a new biometrics-based multi-server authentication scheme based on trusted multiple-servers. We harness the concept of fuzzy extractor to provide the proper matching of biometric patterns. We evaluate our scheme through informal discussions on performance and also using Burrows-Abadi-Needham logic (BAN-logic) & random oracle model for formal security analysis. We also compose a comparative assessment of our scheme and the related ones. Outcome of the analysis and assessment shows our scheme an edge above many related and contemporary schemes.

Design of an anonymity-preserving three-factor authenticated key exchange protocol for wireless sensor networks

Recently, Farash et al. pointed out some security weaknesses of Turkanović et al.’s protocol, which they extended to enhance its security. However, we found some problems with Farash et al.’s protocol, such as a known session-specific temporary information attack, an off-line password-guessing attack using a stolen-smartcard, a new-smartcard-issue attack, and a user-impersonation attack. Additionally, their protocol cannot preserve user-anonymity, and the secret key of the gateway node is insecure. The main intention of this paper is to design an efficient and robust smartcard-based user authentication and session key agreement protocol for wireless sensor networks that use the Internet of Things. We analyze its security, proving that our protocol not only overcomes the weaknesses of Farash et al.’s protocol, but also preserves additional security attributes, such as the identity change and smartcard revocation phases. Moreover, the results of a simulation using AVISPA show that our protocol is secure against active and passive attacks. The security and performance of our work are also compared with a number of related protocols.

A Secure and Robust User Authenticated Key Agreement Scheme for Hierarchical Multi-medical Server Environment in TMIS.

The telecare medicine information system (TMIS) helps the patients to gain the health monitoring facility at home and access medical services over the Internet of mobile networks. Recently, Amin and Biswas presented a smart card based user authentication and key agreement security protocol usable for TMIS system using the cryptographic one-way hash function and biohashing function, and claimed that their scheme is secure against all possible attacks. Though their scheme is efficient due to usage of one-way hash function, we show that their scheme has several security pitfalls and design flaws, such as (1) it fails to protect privileged-insider attack, (2) it fails to protect strong replay attack, (3) it fails to protect strong man-in-the-middle attack, (4) it has design flaw in user registration phase, (5) it has design flaw in login phase, (6) it has design flaw in password change phase, (7) it lacks of supporting biometric update phase, and (8) it has flaws in formal security analysis. In order to withstand these security pitfalls and design flaws, we aim to propose a secure and robust user authenticated key agreement scheme for the hierarchical multi-server environment suitable in TMIS using the cryptographic one-way hash function and fuzzy extractor. Through the rigorous security analysis including the formal security analysis using the widely-accepted Burrows-Abadi-Needham (BAN) logic, the formal security analysis under the random oracle model and the informal security analysis, we show that our scheme is secure against possible known attacks. Furthermore, we simulate our scheme using the most-widely accepted and used Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. The simulation results show that our scheme is also secure. Our scheme is more efficient in computation and communication as compared to Amin-Biswas's scheme and other related schemes. In addition, our scheme supports extra functionality features as compared to other related schemes. As a result, our scheme is very appropriate for practical applications in TMIS.

A Secure Authentication Scheme with User Anonymity for Roaming Service in Global Mobility Networks

In global mobility networks, user authentication is an essential security mechanism that permits mobile users to use the roaming services offered by foreign agents with the support of home agent in mobile network environment. Recently, Rhee et al. analyzed Wu et al. and Wei et al. authentication scheme, and proposed a smart card based user authentication scheme with user anonymity in global mobility networks. However, in this paper, we find that Rhee et al. scheme is vulnerable to user impersonation attacks and off-line password guessing attacks. Moreover, the scheme does not preserve user anonymity; does not provide perfect forward secrecy, and an option to change/update the password; and does not detect wrong password quickly. Hence we propose a secure authentication scheme with user anonymity for roaming service in global mobility networks. Furthermore, performance analysis shows that compared with existing authentication schemes, our proposed scheme is simple and secure.

A novel user authentication and key agreement protocol for accessing multi-medical server usable in TMIS.

Telecare Medical Information System (TMIS) makes an efficient and convenient connection between patient(s)/user(s) at home and doctor(s) at a clinical center. To ensure secure connection between the two entities (patient(s)/user(s), doctor(s)), user authentication is enormously important for the medical server. In this regard, many authentication protocols have been proposed in the literature only for accessing single medical server. In order to fix the drawbacks of the single medical server, we have primarily developed a novel architecture for accessing several medical services of the multi-medical server, where a user can directly communicate with the doctor of the medical server securely. Thereafter, we have developed a smart card based user authentication and key agreement security protocol usable for TMIS system using cryptographic one-way hash function. We have analyzed the security of our proposed authentication scheme through both formal and informal security analysis. Furthermore, we have simulated the proposed scheme for the formal security verification using the widely-accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool and showed that the scheme is secure against the replay and man-in-the-middle attacks. The informal security analysis is also presented which confirms that the protocol has well security protection on the relevant security attacks. The security and performance comparison analysis confirm that the proposed protocol not only provides security protection on the above mentioned attacks, but it also achieves better complexities along with efficient login and password change phase.

An Efficient Dynamic ID-based User Authentication Scheme using Smart Cards without Verifier Tables

Smart-card based user authentication schemes provide that legal users conveniently and securely access remote services with smart cards through unsecure networks. Lee recently showed that the dynamic ID-based remote user authentication scheme proposed by Das et al. cannot resist password guessing attacks and impersonation attacks. In order to solve these weaknesses, Lee also presented an improved authentication scheme and claimed that the proposed scheme can resist modification, password guessing, imper sonation and smart-card-theft attacks. However, this investigation in dicates that the authentication scheme of Lee cannot resist the above attacks and violates users' untracibility. Additionally, this invest igation also develops an efficient and secure dynamic ID-bas ed user authentication scheme based on the quadratic residues. The proposed scheme not only avoids the weakness in the previous schemes, but also does not require verifier tables in the authentication server and sti ll retains low computational cost in clients.

An Extended Multi-Server-Based User Authentication and Key Agreement Scheme with User Anonymity

With the explosive growth of computer networks, many remote service providing servers and multi-server network architecture are provided and it is extremely inconvenient for to remember numerous different identities and passwords. Therefore, it is important to provide a mechanism for a remote user to use single identity and password to access multi-server network architecture without repetitive registration and various multi-server authentication schemes have been proposed in recent years. Recently, Tsaur et al. proposed an efficient and secure smart card based user authentication and key agreement scheme for multi-server environments. They claimed that their scheme satisfies all of the requirements needed for achieving secure password authentication in multi-server environments and gives the formal proof on the execution of the proposed authenticated key agreement scheme. However, we find that Tsaur et al.s scheme is still vulnerable to impersonation attack and many logged-in attack. We propose an extended scheme that not only removes the aforementioned weaknesses on their scheme but also achieves user anonymity for hiding login users real identity. Compared with other previous related schemes, our proposed scheme keeps the efficiency and security and is more suitable for the practical applications.

Cryptanalysis of a Smartcard-Based User Authentication Scheme for Multi-Server Environments

Cryptanalysis of a Smartcard-Based User Authentication Scheme for Multi-Server Environments

A Smartcard-Based User Authentication Scheme to Ensure the PFS in Multi-Server Environments

Nowadays, a user authentication is very important in network environments. For safe authentication, they came up with six essential conditions in earlier studies. And a variety of mechanisms is presented by research scientists. However, they could not achieve the PFS. Because, though all these schemes are assumed that the communication between a smart card and a host is safe, actually it is not. Therefore, in this paper, we will point out what the communication between a smart card and a host is not safe, and propose a new user authentication mechanism that can reach to the PFS. And also, an encryption algorithm is used about 45% less than earlier studies in our proposed scheme. Thus, we can say that enhance the efficiency.

Cryptanalysis of a mutual authentication scheme based on nonce and smart cards

To prevent the forged login attacks, Liu et al. recently proposed a new mutual authentication scheme using smart cards. However, we demonstrate that the attacker without any secret information can successfully not only impersonate any user to cheat the server but also impersonate the server to cheat any user. That is, Liu et al.’s scheme fails to defend the forged login attack as the previous version. Our cryptanalysis result is important for security engineers, who are responsible for the design and development of smart card-based user authentication systems.