Smart Card Loss Attack Research Articles

Lightweight Certificate-Less Anonymous Authentication Key Negotiation Scheme in the 5G Internet of Vehicles

In the current 5G vehicle network system, there are security issues such as wireless intrusion, privacy leakage, and remote control. To address these challenges, an improved lightweight anonymous authentication key negotiation scheme based on certificate-less aggregate signatures is proposed and its security and efficiency are analyzed. The result shows that the scheme can offer security attributes including anonymity, traceability, and revocability, as well as effective identity authentication, and it can resist forgery attacks, man-in-the-middle attacks, tampering attacks, and smart card loss attacks. Moreover, compared with similar schemes, it possesses superior security and more efficient computational efficiency and less communication overhead, thereby being more appropriate for high-speed, large-capacity, low-latency, and resource-constrained 5G vehicle network application scenarios.

A novel two-factor multi-gateway authentication protocol for WSNs

With Wireless Sensor Networks(WSNs) rapid development, it is a hot topic that designing a secure and effective authentication protocol to guarantee the safety of WSNs. Many two-factor multi-gateway authentication protocols have been proposed for WSNs. However, almost all the known protocols were found insecure. Especially, all the existing two-factor multi-gateway authentication protocols cannot resist the password and identity(ID) guessing together with the smart card loss attack. We present a novel two-factor multi-gateway authentication protocol based on password and smart card in multi-gateway wireless sensor networks in this paper. Thanks to “fuzzy-verifier” and “honeywords” technique, the new protocol can effectively resist the joint password and identity guessing with the smart card loss attack. In addition, key negotiation is based on discrete elliptic curve encryption, which ensures forward security of the protocol and resists sensor capture attack. Subsequently, we use BAN-logic to ensure the authentication is implemented, and the session key is negotiated. Moreover, a formal security proof of the new protocol based on the game sequence is conducted in Random Oracle model (RO model). Finally, we compare our work with other schemes in the same field in terms of security, communication efficiency and computational efficiency.

Quantum2FA: Efficient Quantum-Resistant Two-Factor Authentication Scheme for Mobile Devices

Smart-card based password authentication has been the most widely used two-factor authentication (2FA) mechanism for security-critical applications (e.g., e-Health, smart grid and e-Commerce) in the past decades, and it is likely to hold its status in the foreseeable future. Hundreds of this type of 2FA schemes have been proposed, yet to our knowledge, most of them are built on the intractability of conventional hard problems (e.g., discrete logarithm problems and integer factoring problems) which are no longer hard in the quantum era. With the recent advancements in quantum computing, the design of secure and efficient smart-card based password authentication schemes against quantum attacks is becoming increasingly urgent. However, it is not as simple as it seems, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">how to design such a quantum-resistant 2FA scheme is challenging due to the demanding security requirements and the resource-constrained nature of mobile devices</i> . In this work, we take the first step towards this issue by proposing Quantum2FA, a practical quantum-resistant smart-card-based password authentication scheme that employs Alkim <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> ’s lattice-based key exchange and Wang-Wang’s “fuzzy-verifier + honeywords” technique (IEEE TDSC’18). Particularly, Quantum2FA can thwart the newly revealed key-reuse attack (ACISP’18, CT-RSA’19) against lattice-based key exchange schemes in two aspects: signal leakage attacks and key mismatch attacks. Specifically, it restricts the necessary conditions (i.e., the attacker must be the initiator of the key exchange) for an adversary to analyze the signal; It introduces honeywords to detect the key mismatches between the smart card and the server, and thus smart card loss attack can be thwarted. We formally prove the security of Quantum2FA under the random oracle model and demonstrate its efficiency through experiments on a 32 MHz 8-bit AVR Embedded Processor. Comparison results show that Quantum2FA is not only more secure but also offers better computation efficiency than the state-of-the-art conventional 2FA schemes.

An improved lightweight anonymous user authenticated session key exchange scheme for Internet of Things

Due to the myriad applications of the Internet of Things (IoT) in various sectors like healthcare, military, industry, safety, etc., there is also a need to secure these systems efficiently. The devices in such networks need to provide services to users in a secure manner. User authentication is a mechanism through which we can provide secure communication between IoT devices. Recently Banerjee et al. outlined a lightweight anonymous user authenticated session key exchange scheme for Internet of Things deployment, which uses three-factor authentication of a user such as smart card, password and biometric. In this paper, we cryptanalyze their scheme and find that it is not secure against smart card loss attack and stolen verifier attack. Then we have proposed an improved scheme to overcome the weaknesses of their scheme. We present the formal security analysis of our scheme using the random oracle model and informal security analysis to show that our scheme is secure against many known attacks. Its formal security verification is carried out using ProVerif tool. Its performance analysis is carried out with the related schemes which shows that our scheme is more secure than other schemes. Also, our scheme does not contain any storage table at the gateway side for authentication.

Understanding Node Capture Attacks in User Authentication Schemes for Wireless Sensor Networks

Despite decades of intensive research, it is still challenging to design a practical multi-factor user authentication scheme for wireless sensor networks (WSNs). This is because protocol designers are confronted with a long-standing “security versus efficiency” dilemma: sensor nodes are lightweight devices with limited storage and computation capabilities, while the security requirements are demanding as WSNs are generally deployed for sensitive applications. Hundreds of proposals have been proposed, yet most of them have been found to be problematic, and the same mistakes are repeated again and again. Two of the most common security failures are regarding smart card loss attacks and node capture attacks. The former has been extensively investigated in the literature, while little attention has been given to understanding the node capture attacks. To alleviate this undesirable situation, this article takes a substantial step towards systematically exploring node capture attacks against multi-factor user authentication schemes for WSNs. We first investigate the various causes and consequences of node capture attacks, and classify them into ten different types in terms of the attack targets, adversary’s capabilities and vulnerabilities exploited. Then, we elaborate on each type of attack through examining 11 typical vulnerable protocols, and suggest corresponding countermeasures. Finally, we conduct a large-scale comparative measurement of 61 representative user authentication schemes for WSNs under our extended evaluation criteria. We believe that such a systematic understanding of node capture attacks would help design secure user authentication schemes for WSNs.

An Efficient Lightweight Authentication Scheme With Adaptive Resilience of Asynchronization Attacks for Wireless Sensor Networks

Until now, the pseudonym ID and one-time hash chain as the key technologies solve anonymous and forward secrecy properties, respectively, in lightweight authentication protocols for wireless sensor networks (WSNs) environment. However, both techniques have to face the limitation of asynchronization attack, which will cause the pseudonym ID and one-time hash chain value between participants to be loss of synchronization when the transmitted message is blocked. Most recently, a serial of lightweight anonymous authentication scheme with forward secrecy (LAASFS) have been built to resolve this problem. Unfortunately, they failed to handle this question satisfactorily. Besides, most of them are still vulnerable to smart card loss attack (SCLA). In this article, to address these issues and make more effective, we combine pseudonym ID, one-time hash chain and tag techniques to construct an LAASFS for WSNs environment. The proposed LAASFS can be adaptive resilience of asynchronization attacks. In addition, it is also able to resist a variety of known attacks like SCLA and wrong password login attack. Formal analyses are taken by BAN logic and ProVerif tool to demonstrate the security of properties of our LAASFS. Compared with several previous related schemes, the proposed LAASFS possesses obvious advantages in computation and communication costs.

ESEAP: ECC based secure and efficient mutual authentication protocol using smart card

Smart card based user server mutual authentication framework is famous for safe communication via unfavorable and insecure communication system. The authenticated user and server communicate to each other and share information via Internet. Recently, Wang et al. suggested a lightweight password-assisted two factor authentication framework using smart card. We reviewed their scheme and observed that it does maintain security and privacy off-line password guessing attack and also impersonation attack. We proposed enhance elliptic curve cryptography(ECC) based authentication framework for the same environment. The proposed scheme ESEAP is secure resilience of many attractive security attributes and features like off-line password guessing attack, no password verifier-table, smart card loss attack, anonymity, mutual authentication, replay attack, impersonation attack, server spooling attack, no clock-synchronization attack, forward secrecy, insider attack, message authentication, provision of key agreement, parallel attack, sound repairability, no password exposure, timely typo detection, resistance to know attacks, password friendly, user unlinkability and server unlinkability. Further, the paper shows formal security analysis of the ESEAP which based on random oracle model. We compared the presented protocol with other related protocols in the same environment, and show that ESEAP is more efficient in terms of computation and communication cost. As a result, the presented protocol can be utilized over public communication channel.

A Novel Multiserver Authentication Protocol with Multifactors for Cloud Service

Secure and efficient authentication protocols are necessary for cloud service. Multifactor authentication protocols taking advantage of smart card, user’s password, and biometric, are more secure than password-based single-factor authentication protocols which are widely used in practice. However, most of the multiserver authentication protocols may have weak points, such as smart card loss attack, man-in-the-middle attack, anonymity, and high computation cost of authentication center. In order to overcome the above weaknesses, we propose a novel multiserver multifactor authentication protocol based on the Kerberos protocol using the extended Chebyshev chaotic mapping as a cryptographic algorithm. The proposed protocol achieves anonymity without sharing secret keys in advance and needs the user to register with the authentication center only once. Finally, we prove the security of the new protocol with BAN logic and compare it with other multifactor authentication protocols for multiserver environment. The results show that our proposed protocol is more secure and efficient and better for practical application.

Security Analysis of Improved User Authentication Schemes Using Smart Cards

Smart card based remote user authentication is a broadly adopted method of authentication within insecure communication channels. Recently, Wen and Li proposed a dynamic ID-based remote user authentication protocol with key agreement. Unfortunately, Kim, Nam and Won pointed out that Wen and Li’s authentication protocol suffers from leakage of some key information to an adversary and a man-in-the-middle attack. Kim et al. proposed an improved ID-based remote user authentication scheme. In this work, we revisit Kim et al.’s protocol. Our results indicate that their scheme is vulnerable to smart card loss attack, stolen verifier attack and privileged insider attack. Furthermore, the authentication protocol cannot provide perfect forward secrecy and user anonymity. These weaknesses also exist in Wen and Li’s authentication scheme.

Lightweight mutual authentication scheme for protecting identity in insecure environment

Many improved authentication solutions were put forward, on purpose of authenticating more quickly and securely. However, neither the overuse of hash function, or additional symmetric encryption, can truly increase the overall security. Instead, extra computation cost degraded the performance. They were still vulnerable to a variety of threats, such as smart card loss attack and impersonation attack, due to hidden loopholes and flaws. Even worse, user's identity can be parsed in insecure environment, even became traceable. Aiming to protect identity, a lightweight mutual authentication scheme is proposed. Redundant operations are removed, which make the verification process more explicit. It gains better performance with average cost compared to other similar schemes. Cryptanalysis shows the proposed scheme can resist common attacks and achieve user anonymity. Formal security is further verified by using the widely accepted Automated Validation of Internet Security Protocols and Applications (AVISPA) tool.

A study on user authentication and key agreement protocol in wireless sensor network

Background/Objectives: The user authentication and key agreement protocol proposed by Jung et al., which is suitable for a wireless sensor network environment is vulnerable to an attack in which a user who is issued a smart card from the gateway, completing the registration step disguises as a random user.Methods/Statistical analysis: This study proposed a method of improving the problem of the security technique proposed by Jung et al., which is vulnerable to a user impersonation attack. This method uses the variable that recorded the times of a user’s request for registration to the gateway in the registration step in which the user is registered to the gateway and a smart card is issued and the login step in which the user issued the smart card is authenticated as a legitimate user.Findings: The security technique proposed in this study consists of four steps, same as the security technique of user authentication and key agreement proposed by Jung et al. In the first step, the registration step, if a user requests for registration to the gateway, the variables that recorded the times of the user’s request for registration (User: Un and Gateway: Gn) are renewed and stored respectively by the user and the gateway. Once the registration step is completed, the user who got a smart card issued from the gateway is authenticated as a legitimate user in the login step, using the issued smart card, ID, password and Un. When the login step is completed, in the third step, the authentication step, the authentication procedures are carried out for the gateway and the sensor node.An attacker obtains a user’s information through various attacks, such as smart-card loss attack, ID-guessing attack or password-guessing attack and attempts the login step, using the obtained information. However, the technique proposed in this study needs the variable that recorded the times of the user’s request for registration to the gateway in addition to a smart card, ID and password to proceed with user authentication in the login step. This variable is a value that only the user and the gateway know, not transmitted in any steps. The attacker who does not know the times of requests for registration cannot proceed with the login step, and the attacker cannot be authenticated as a legitimate user without proceeding to the login step. Thus, the user authentication and key agreement protocol proposed in this study is safe from an attacker’s attack of impersonation as a user.Improvements/Applications: This study proposed a technique of using the variable that recorded the times of the user’s request for registration to the gateway, managed and stored only by the user and the gateway, not transmitted in any steps in user authentication. The proposed technique is safe from an attacker’s attack of impersonation as a user.

Cryptanalysis and improvement of an authentication protocol for wireless sensor networks applications like safety monitoring in coal mines

The wireless sensor networks have several applications in different areas like medical, military, industry, safety, etc. Recently, Kumari and Om have discussed an authentication protocol for wireless sensor networks in coal mines for safety monitoring. In this paper, we cryptanalyze their scheme and find that it is vulnerable to the smart card loss attack, stolen verifier attack, and denial of service attack, besides other problems: (1) user traceability and (2) the sensor nodes are not anonymous. Here, we purpose an improved scheme by overcoming these limitations. We formally show the security analysis of our proposed scheme using random oracle and its security verification using the AVISPA tool. We carry out its informal analysis to show its resistivity to various known attacks. It requires less computational and storage costs, and is more secured than the related schemes. We also show its practical demonstration using NS2 simulator.

Cryptanalysis and Security Enhancement of Three Authentication Schemes in Wireless Sensor Networks

Nowadays wireless sensor networks (WSNs) have drawn great attention from both industrial world and academic community. To facilitate real‐time data access for external users from the sensor nodes directly, password‐based authentication has become the prevalent authentication mechanism in the past decades. In this work, we investigate three foremost protocols in the area of password‐based user authentication scheme for WSNs. Firstly, we analyze an efficient and anonymous protocol and demonstrate that though this protocol is equipped with a formal proof, it actually has several security loopholes been overlooked, such that it cannot resist against smart card loss attack and violate forward secrecy. Secondly, we scrutinize a lightweight protocol and point out that it cannot achieve the claimed security goal of forward secrecy, as well as suffering from user anonymity violation attack and offline password guessing attack. Thirdly, we find that an anonymous scheme fails to preserve two critical properties of forward secrecy and user friendliness. In addition, by adopting the “perfect forward secrecy (PFS)” principle, we provide several effective countermeasures to remedy the identified weaknesses. To test the necessity and effectiveness of our suggestions, we conduct a comparison of 10 representative schemes in terms of the underlying cryptographic primitives used for realizing forward secrecy.

A Lightweight Anonymous Authentication Protocol with Perfect Forward Secrecy for Wireless Sensor Networks

Due to their frequent use in unattended and hostile deployment environments, the security in wireless sensor networks (WSNs) has attracted much interest in the past two decades. However, it remains a challenge to design a lightweight authentication protocol for WSNs because the designers are confronted with a series of desirable security requirements, e.g., user anonymity, perfect forward secrecy, resistance to de-synchronization attack. Recently, the authors presented two authentication schemes that attempt to provide user anonymity and to resist various known attacks. Unfortunately, in this work we shall show that user anonymity of the two schemes is achieved at the price of an impractical search operation—the gateway node may search for every possible value. Besides this defect, they are also prone to smart card loss attacks and have no provision for perfect forward secrecy. As our main contribution, a lightweight anonymous authentication scheme with perfect forward secrecy is designed, and what we believe the most interesting feature is that user anonymity, perfect forward secrecy, and resistance to de-synchronization attack can be achieved at the same time. As far as we know, it is extremely difficult to meet these security features simultaneously only using the lightweight operations, such as symmetric encryption/decryption and hash functions.

Lightweight three-factor authentication and key agreement protocol for internet-integrated wireless sensor networks

Wireless sensor networks (WSNs) will be integrated into the future Internet as one of the components of the Internet of Things, and will become globally addressable by any entity connected to the Internet. Despite the great potential of this integration, it also brings new threats, such as the exposure of sensor nodes to attacks originating from the Internet. In this context, lightweight authentication and key agreement protocols must be in place to enable end-to-end secure communication. Recently, Amin et al. proposed a three-factor mutual authentication protocol for WSNs. However, we identified several flaws in their protocol. We found that their protocol suffers from smart card loss attack where the user identity and password can be guessed using offline brute force techniques. Moreover, the protocol suffers from known session-specific temporary information attack, which leads to the disclosure of session keys in other sessions. Furthermore, the protocol is vulnerable to tracking attack and fails to fulfill user untraceability. To address these deficiencies, we present a lightweight and secure user authentication protocol based on the Rabin cryptosystem, which has the characteristic of computational asymmetry. We conduct a formal verification of our proposed protocol using ProVerif in order to demonstrate that our scheme fulfills the required security properties. We also present a comprehensive heuristic security analysis to show that our protocol is secure against all the possible attacks and provides the desired security features. The results we obtained show that our new protocol is a secure and lightweight solution for authentication and key agreement for Internet-integrated WSNs.

Comments on 'An improved authentication scheme for mobile satellite communication systems'

Recently, Lee et al. (2012) proposed an authentication scheme for satellite communication systems. Then Zhang et al. (2015) found that their scheme is vulnerable to smart card loss attack, denial of service attack and replay attack. In addition, they proposed an improved authentication scheme for satellite communication systems, and claimed resistance against these attacks. Nevertheless, in this paper, we show that the Zhang et al.'s (2015) scheme is as insecure as the original protocol against the denial of service attack. Then an improved version is proposed to avoid this security flaw. Finally, the security, reliability and performance analysis of the improved protocol are given. It demonstrates that the improved version meets the security requirements and has lower computation costs, which is more suitable for mobile satellite communication systems.

Comments on 'An improved authentication scheme for mobile satellite communication systems'

Recently, Lee et al. (2012) proposed an authentication scheme for satellite communication systems. Then Zhang et al. (2015) found that their scheme is vulnerable to smart card loss attack, denial of service attack and replay attack. In addition, they proposed an improved authentication scheme for satellite communication systems, and claimed resistance against these attacks. Nevertheless, in this paper, we show that the Zhang et al.'s (2015) scheme is as insecure as the original protocol against the denial of service attack. Then an improved version is proposed to avoid this security flaw. Finally, the security, reliability and performance analysis of the improved protocol are given. It demonstrates that the improved version meets the security requirements and has lower computation costs, which is more suitable for mobile satellite communication systems.

스마트 카드 분실 공격에 안전한 사용자 인증 스킴의 취약점 및 개선방안

스마트 카드 분실 공격에 안전한 사용자 인증 스킴의 취약점 및 개선방안

An efficient authentication and key agreement scheme for multi-gateway wireless sensor networks in IoT deployment

Wireless sensor networks (WSNs) for Internet of Things (IoT) can be deployed in a wide range of industries such as agriculture and military. However, designing a secure and reliable authentication scheme for WSNs that can be deployed in IoT remains a research and operational challenge. For example, recently in 2016, Amin and Biswas showed that the Turcanović et al.'s scheme is vulnerable to smart card loss attack, user impersonation attack, etc. They then proposed a new authentication scheme for WSNs with multi-gateway. In this paper, we revisit the scheme of Amin and Biswas and reveal previously unknown vulnerabilities in the scheme (i.e. sensor capture attack, user forgery attack, gateway forgery attack, sensor forgery attack and off-line guessing attack). In addition, we demonstrate that the user in the scheme can be tracked due to the use of a constant pseudo-identity and previously established session keys can be calculated by the attacker. Rather than attempting to fix a broken scheme, we present a novel authentication scheme for multi-gateway based WSNs. We then demonstrate the security of the proposed scheme using Proverif, as well as evaluating the good performance of the scheme using NS-2 simulation.

A PERFORMANCE COMPARISON OF PROPOSED APPROACH OF MULTISERVER AUTHENTICATION AND KEY AGREEMENT WITH USER PROTECTION WITH JAUNG APPROACH

Use of smart card makes remote user verification and key agreement easy, elastic to making a secure scattered system environment. It is very important to provide user privacy protection in authentication phase. In this paper, we are describing the performance comparison of Jung approach for multiple server authentication and key agreement schemes with user protection in network security with our proposed approach. First we are describing the jaung approach then overview of our approach with comparison. All the areas those can be improved by us are also defined. Our approach is works for single server as well as multi sever environment. According to our analysis the jaung approach is open to the element, leak-of-verifier attack and session key discovery attack and smart card loss attack. We are saving data into the server table in form of digital identity, smart card is removed by us, and so the new approach is safe from smart card loss attack.