Stolen Smart Card Attack Research Articles

A privacy preserving four-factor authentication protocol for internet of medical things

Medical applications of the Internet of Things (IoT) have gained significant attention, especially in the context of monitoring health-related information for elderly individuals living alone and patients receiving home-based care, especially during the COVID-19 pandemic. These applications offer immense convenience and contribute to the reduction of infection risk. Consequently, safeguarding the privacy of patient data has become increasingly vital. However, the resource limitations inherent to IoT present challenges in implementing complex algorithms. Numerous researchers have proposed authentication schemes based on three factors: passwords, biometric features, and smart cards. While three-factor authentication protocols are generally more secure than two-factor ones, recent studies have unveiled vulnerabilities in existing protocols designed for IoT environments, particularly concerning sensor node capture attack and smart card stolen attack. Only a few protocols provide reliable solutions to address these issues. To tackle this challenge, we propose a lightweight authentication protocol that introduces the Physical Unclonable Function (PUF) as the fourth factor, enhancing the security and privacy of the system. By integrating PUF technology into servers and embedding it into the integrated circuit chips of sensors, our protocol is specifically designed to thwart attacks like sensor node capture and smart card stolen. We validate the security of our proposed protocol using formal BAN logic and ProVerif simulator tool, demonstrating its capability to provide secure mutual authentication. Moreover, through informal analysis, we illustrate that our scheme can withstand multiple attacks. Furthermore, our proposed protocol outperforms existing protocols in terms of computational cost, storage cost, communication cost, and security requirements.

An improved authentication and key management scheme in context of IoT-based wireless sensor network using ECC

Wireless sensor network (WSN) is used for sensing data/information from the nearby environment with the help of various spatially dispersed miniature sensor devices/nodes and forwarding the data to the direction of the base station which is connected to the network through the Internet for processing the collected data. Currently, Internet of Things (IoT) based smart computing applications are becoming popular in which WSN is used to run a process to output information from sensed data or events. However, these sensor nodes have less computation ability and low power capacity. In these resource-constrained WSNs, remote user authentication is a serious challenge that demands the attention of the researchers’ community. Several authentication protocols which address a variety of security concerns are present in the literature. Ghani et al. proposed an efficient authentication and key management scheme that claims to be resistant to known attacks. During the study of their scheme, we found that it is efficient and effective for protecting against a few attacks. However, it does not have the ability to counter several security threats like user impersonation attack, insider attack, database attack, and stolen smart card attack. To counter these aforesaid security loopholes, in this paper a new ECC integrated scheme suitable for IoT-based WSN with a higher level of protection is proposed. The informal security analysis using mathematical approaches and the formal security analysis using a well-accepted AVISPA simulator and BAN logic ensures that the suggested work is highly secure from all the relevant threats. Moreover, the performance analysis and comparison of the proposed scheme with the most recent relevant schemes proves that our scheme is much more efficient in terms of computation, communication, and storage overheads than all the available schemes in the literature.

An Effective Privacy-Preserving Blockchain-Assisted Security Protocol for Cloud-Based Digital Twin Environment

Recently, the Digital Twin (DT) technology has procured a lot of attention because of its applicability in the manufacturing and space industries. The DT environment involves the formation of a clone of the tangible object to perform simulations in the virtual space. The combination of conceptual development, predictive maintenance, real-time monitoring, and simulation characteristics of DT has increased the utilization of DT in different scenarios, such as medical environments, healthcare, manufacturing industries, aerospace, etc. However, these utilizations have also brought serious security pitfalls in DT deployment. Towards this, several authentication protocols with different security and privacy features for DT environments have been proposed. In this article, we first review a recently proposed two-factor authentication protocol for DT environments that utilizes the blockchain technology. However, the analyzed scheme is unable to offer the desirable security and cannot withstand various security attacks like offline password-guessing attack, smart card stolen attack, anonymity property, and known session-specific temporary information attack. We also demonstrate that an attacker can impersonate the analyzed protocol’s legal user, owner, and cloud server. To mitigate these security loopholes, we devise an effective three-factor privacy-preserving authentication scheme for DT environments. The proposed work is demonstrated to be secure by performing the informal security analysis, the formal security analysis using the widely recognized Burrows-Abadi-Needham (BAN) logic, and the Real-or-Random (ROR) model. A detailed comparative study with the existing competing schemes including the analyzed scheme demonstrates that the devised framework furnishes better security features while also having lower computation costs and comparable communication costs than the existing schemes.

A modified lightweight authenticated key agreement protocol for Internet of Drones

Drones can be embedded in the system Internet of Drones can make a military observation of a region, a transport system embedded with sensors. Drones played a highly important role in different fields and brought great convenience to production and lifestyle. But we know all the data collected by sensors embedded in drones suffer from security challenges and privacy issues. There are a lot of authenticated key agreement protocols for the security of transmitted data through drones. We have analyzed a recent protocol, “A lightweight authentication and key agreement scheme for Internet of Drones” by Zhang et al. in the year 2020. We have found that this protocol is not secure against stolen smart card attacks, and the control server stores extra data. We have tried to address security issues of password guessing, anonymity, user/server impersonation, insider attack, and stolen smart card attacks, and man in the middle attack. We have proposed a modified lightweight authenticated key agreement protocol for Internet of Drones. We have proved its security in the random oracle model. We have done a performance analysis of the proposed protocol with relevant protocols that ensures its efficiency and security as well.

A construction of post quantum secure and signal leakage resistant authenticated key agreement protocol for mobile communication

AbstractMobile communication is very important for an individual users, enterprisers, industries, businesses, and organizations. Since the nodes communicate through a public channel, security, and privacy become essential component for mobile communication. Both key exchange and authentication are two important security attributes to establish secure communication between two parties. In the past few years, various post‐quantum secure authentication protocols have been designed, but we have found that either some of the protocols are vulnerable to stolen smart card attack, invalid login, or signal leakage attack. In this article, we have discussed how the protocol Dharminder et al (Dharminder D, Chandran KP. J Ambient Intell Humaniz Comput. 2020; 11:4089‐4100.) is vulnerable to modified version of signal leakage attack, and sometimes called improved signal leakage attack. We have also suggested a remedy over the current existing protocol suffering from signal leakage attacks. The proposed protocol is secure against quantum attacks. We have proved the security of the proposed protocol under ring learning with errors assumption. The proposed authentication and key agreement needs only two messages exchange. We have also found the proposed is efficient in terms of computation with respect to relevant protocols.

Lightweight Two-Factor-Based User Authentication Protocol for IoT-Enabled Healthcare Ecosystem in Quantum Computing.

The healthcare ecosystem is migrating from legacy systems to the Internet of Things (IoT), resulting in a digital environment. This transformation has increased importance on demanding both secure and usable user authentication methods. Recently, a post-quantum fuzzy commitment scheme (PQFC) has been constructed as a reliable and efficient method of biometric template protection. This paper presents a new two-factor-based user authentication protocol for the IoT-enabled healthcare ecosystem in post-quantum computing environments using the PQFC scheme. The proposed protocol is proved to be secure using random oracle model. Furthermore, the functionality and security of the proposed protocol are analyzed, showing that memoryless-effortless, user anonymity, mutual authentication, and resistance to biometric templates tampering and stolen attacks, stolen smart card attack, privileged interior attack are fulfilled. The costs of storage requirement, computation, communication and storage are estimated. The results demonstrate that the proposed protocol is more efficient than Mukherjee et al., Chaudhary et al., and Gupta et al. protocols.

A construction of Chebyshev chaotic map based authenticated key agreement protocol for satellite communication system

AbstractIn this article, we have discussed various authentication and key agreement protocols for satellite communication system and their flaws off‐line passwords guess, stolen smart card attack, insider attack and replay attack and so forth. We have analyzed the security of a recently published Uddeshaya et al's protocol for satellite communication, and discussed how it suffers from design flaws and insider attack. This protocol cannot stop the Bergamo attack, but the proposed protocol is applicable in specific environment against Bergamo attack. We have compared and illustrated the performance and security analysis of several existing protocols for satellite communication. The proposed authenticated key agreement protocol possesses both low computation and low communication cost. This protocol establishes a verified session key with only two messages of exchange. We have discussed the security of proposed framework in the random oracle model.

A Secure User Authentication Protocol Based on ECC for Cloud Computing Environment

Cloud computing relies on on-demand sharing of the computing resources and data without the user’s direct involvement in resource management over the network, but it has major security threats. Recently, an it is Elliptic Curve Cryptography (ECC) based three-factor authentication and key negotiation protocol for fog computing has been discussed by Wazid et al. In this paper, we show that the Wazid et al.’s protocol requires high communication as well as storage cost, and also, it is susceptible to the denial-of-service attack, stolen smart card attack, and privileged insider attack. We further propose a new protocol that overcomes these problems. We carry out informal and formal security analysis and also simulate it using the it is Automated Validation of Internet Security Protocols and Applications tool (AVISPA) to prove its robustness against the security threats. Its performance analysis illustrates that it is efficient and lightweight in comparison with the existing schemes.

AMAPG: Advanced Mobile Authentication Protocol for GLOMONET

Roaming is when the mobile user goes out of his/her home agent network coverage and loses its signal. Loss of coverage and signals may be limited to a remote area or may occur when mobile user leaves the country and moves to a country where his/her mobile carrier network is not available. In this case, the mobile device is in roaming mode. In this mode, mobile user through connection to a Foreign Agent can still use its home agent services if his/her authentication be successful. In such situations, the authentication mechanism plays a key and important role, where the mobile user often needs to integrate and secure roaming service over multiple foreign agents. Designing a secure mechanism in Global Mobility Network (GLOMONET) is a difficult and complex task due to the computational and processing limitations of most mobile devices, as well as the wireless nature of communication environment. Unfortunately, most of the authentication schemes that have been proposed so far to meet this goal have failed to achieve their goal. In this line, Shashidhara et al. recently reported security vulnerabilities of Xu et al.'s mobile authentication scheme, and also presented an amended version of it. This paper shows that this proposed scheme has security flaws against impersonation, traceability, forward secrecy contradiction, and stolen smart card attacks, which implies that this protocol may not be a proper choice to be used on GLOMONET. On the other hand, we propose AMAPG, as a cost-efficient remedy version of the protocol which provides desired security against various attacks and also prove its security using BAN logic. We also evaluate AMAPG's security using Scyther as a widely used formal tool to evaluate the security correctness of the cryptographic protocols.

A Lightweight Authentication and Authorization Framework for Blockchain-Enabled IoT Network in Health-Informatics

Blockchain and IoT are being deployed at a large scale in various fields including healthcare for applications such as secure storage, transactions, and process automation. IoT devices are resource-constrained, have no capability of security and self-protection, and can easily be hacked or compromised. Furthermore, Blockchain is an emerging technology with immutability features which provide secure management, authentication, and guaranteed access control to IoT devices. IoT is a cloud-based internet service in which processing and collection of user’s data are accomplished remotely. Smart healthcare also requires the facility to provide the diagnosis of patients located remotely. The smart health framework faces critical issues such as data security, costs, memory, scalability, trust, and transparency between different platforms. Therefore, it is important to handle data integrity and privacy as the user’s authenticity is in question due to an open internet environment. Several techniques are available that primarily focus on resolving security issues i.e., forgery, timing, denial of service and stolen smartcard attacks, etc. Blockchain technology follows the rules of absolute privacy to identify the users associated with transactions. The motivation behind the use of Blockchain in health informatics is the removal of the centralized third party, immutability, improved data sharing, enhanced security, and reduced overhead costs in distributed applications. Healthcare informatics has some specific requirements associated with the security and privacy along with the additional legal requirements. This paper presents a novel authentication and authorization framework for Blockchain-enabled IoT networks using a probabilistic model. The proposed framework makes use of random numbers in the authentication process which is further connected through joint conditional probability. Hence, it establishes a secure connection among IoT devices for further data acquisition. The proposed model is validated and evaluated through extensive simulations using the AVISPA tool and the Cooja simulator, respectively. Experimental results analyses show that the proposed framework provides robust mutual authenticity, enhanced access control, and lowers both the communication and computational overhead cost as compared to others.

Lightweight authentication protocol for e-health clouds in IoT-based applications through 5G technology

Modern information technology has been utilized progressively to store and distribute a large amount of healthcare data to reduce costs and improve medical facilities. In this context, the emergence of e-Health clouds offers novel opportunities, like easy and remote accessibility of medical data. However, this achievement produces plenty of new risks and challenges like how to provide integrity, security, and confidentiality to the highly susceptible e-Health data. Among these challenges, authentication is a major issue that ensures that the susceptible medical data in clouds is not available to illegal participants. The smart card, password and biometrics are three factors of authentication which fulfill the requirement of giving high security. Numerous three-factor ECC-based authentication protocols on e-Health clouds have been presented so far. However, most of the protocols have serious security flaws and produce high computation and communication overheads. Therefore, we introduce a novel protocol for the e-Health cloud, which thwarts some major attacks, such as user anonymity, offline password guessing, impersonation, and stolen smart card attacks. Moreover, we evaluate our protocol through formal security analysis using the Random Oracle Model (ROM). The analysis shows that our proposed protocol is more efficient than many existing protocols in terms of computation and communication costs. Thus, our proposed protocol is proved to be more efficient, robust and secure.

A secure and improved multi server authentication protocol using fuzzy commitment

The advancement in communication and computation technologies has paved a way for connecting large number of heterogeneous devices to offer specified services. Still, the advantages of this advancement are not realized completely due to inherent security issues. Most of the existing authentication mechanisms ensure the legitimacy of requesting user thorough single server leading towards multiple registrations and corresponding credentials storage on user side. Intelligent multimedia networks (IMN) may encompass wide range of networks and applications. However, the privacy and security of IMN cannot be apprehended through traditional multi sign on/single server authentication systems. The multi-server authentication systems can enable a user to acquire services from multiple servers using single registration and with single set of credentials (i.e.Password/smart card etc.) and can be accomplish IMN security and privacy needs. In 2018, Barman et al. proposed a multi-server authentication protocol using fuzzy commitment. The authors claimed that their protocol provides anonymity while resisting all known attacks. In this paper, we analyze that Barman et al.’s protocol is still vulnerable to anonymity violation attack and impersonation based on stolen smart card attack; moreover, it has incomplete login request and is prone to scalability issues. We then propose an enhanced protocol to overcome the security weaknesses of Barman et al.’s scheme. The security of the proposed protocol is verified using BAN logic and widely accepted automated AVISPA tool. The BAN logic and automated AVISPA along with the informal analysis ensure the robustness of the scheme against all known attacks.

A privacy preserving two-factor authentication protocol for the Bitcoin SPV nodes

In the Bitcoin network, the simplified payment verification protocol (SPV) enables a lightweight device such as a mobile phone to participate in the bitcoin network without needed todownload and store the whole Bitcoin blocks. A Bitcoin SPV node initiates and verifies transactions of the Bitcoin network through the Bitcoin wallet software which is deployed on a resource constrained device such as a mobile phone.Thus, the security of the wallet is critical for the SPV nodes as it may affect the security of users cryptocurrencies. However, there are some concerns about the security flaws within the SPV nodes which could lead to significant economic losses. Most of these vulnerabilities can be resolved by employing a secure user authentication protocol. Over the years, researchers have engaged in designing a secure authentication protocol. However, most proposals have security flaws or performance issues. Recently, Park et al. proposed a two-party authenticated key exchange protocol for the mobile environment. They claimed that their protocol is not only secure against various attacks but also can be deployed efficiently. However, after a thorough security analysis, we find that the Park et al.s protocol is vulnerable to user forgery attack, smart card stolen attack and unable to provide user anonymity. To enhance security, we proposed an efficient and secure user authentication protocol for the SPV nodes in the mobile environment which can fulfill all the security requirements and has provable security. Additionally, we provide performance analysis which shows our proposed protocol is efficient for the SPV nodes in the Bitcoin network.

A secure three factor-based fully anonymous user authentication protocol for multi-server environment

A single sign-on authentication scheme is required protocol in multi-server environment. Recently, an authentication protocol based on Lagrange interpolation polynomial to satisfy multi-server environment with low computational and communication cost is proposed. In this paper, we have analysed the above scheme and show that their scheme is vulnerable to various attacks like insider attack, server impersonation attack, user impersonation attack and stolen smart card attack. We also show that their scheme fails to provide server anonymity, user revocation in case smart card is lost/stolen or users authentication parameters are revealed. We have also proposed enhanced multi-server authentication protocol using biometric-based smart card and Lagrange interpolation which is more secure. The proposed protocol is analysed using BAN logic to show that the proposed protocol provides secure authentication. In addition, we have simulated our scheme using widely accepted and used AVISPA tool to prove that our scheme is secure against passive and active attacks. The proposed protocol provides high security and anonymity along with low communication and computational cost and various security functions.

A secure three factor-based fully anonymous user authentication protocol for multi-server environment

A single sign-on authentication scheme is required protocol in multi-server environment. Recently, an authentication protocol based on Lagrange interpolation polynomial to satisfy multi-server environment with low computational and communication cost is proposed. In this paper, we have analysed the above scheme and show that their scheme is vulnerable to various attacks like insider attack, server impersonation attack, user impersonation attack and stolen smart card attack. We also show that their scheme fails to provide server anonymity, user revocation in case smart card is lost/stolen or users authentication parameters are revealed. We have also proposed enhanced multi-server authentication protocol using biometric-based smart card and Lagrange interpolation which is more secure. The proposed protocol is analysed using BAN logic to show that the proposed protocol provides secure authentication. In addition, we have simulated our scheme using widely accepted and used AVISPA tool to prove that our scheme is secure against passive and active attacks. The proposed protocol provides high security and anonymity along with low communication and computational cost and various security functions.

On the Design of Secure and Efficient Three-Factor Authentication Protocol Using Honey List for Wireless Sensor Networks

The Internet of Thing (IoT) is useful for connecting and collecting variable data of objects through the Internet, which makes to generate useful data for humanity. An indispensable enabler of IoT is the wireless sensor networks (WSNs). Many environments, such as smart healthcare, smart transportation and smart grid, have adopted WSN. Nonetheless, WSNs remain vulnerable to variety of attacks because they send and receive data over public channels. Moreover, the performance of IoT enabled sensor devices has limitations since the sensors are lightweight devices and are resource constrained. To overcome these problems, many security authentication protocols for WSNs have been proposed. However, many researchers have pointed out that preventing smartcard stolen and off-line guessing attacks is an important security issue, and guessing identity and password at the same time is still possible. To address these weaknesses, this paper presents a secure and efficient authentication protocol based on three-factor authentication by taking advantage of biometrics. Meanwhile, the proposed protocol uses a honey_list technique to protect against brute force and stolen smartcard attacks. By using the honey_list technique and three factors, the proposed protocol can provide security even if two of the three factors are compromised. Considering the limited performance of the sensors, we propose an efficient protocol using only hash functions excluding the public key based elliptic curve cryptography. For security evaluation of the proposed authentication protocol, we perform informal security analysis, and Real-Or-Random (ROR) model-based and Burrows Abadi Needham (BAN) logic based formal security analysis. We also perform the formal verification using the widely-used Automated Validation of Internet Security Protocols and Applications (AVISPA) simulation software. Besides, compared to previous researches, we demonstrate that our proposed authentication protocol for WSNs systems is more suitable and secure than others.

Cryptanalysis of hash based multi-server key exchange protocol using smart card

In multi-server environment, many authentication algorithms have been proposed. Most of the algorithms are based on registration of client and server on the single control server. Recently Gupta and Dhar (Wirel Pers Commun 87(1):225–244, 2016) proposed an authentication scheme, in which client and server belong to different control servers. According to them their proposed scheme is secured against different security attacks like—user impersonation, smart card stolen and password guessing attack. However, in this article, we have found some weaknesses of their scheme and shown that it does not provide security against denial of service attack, user impersonation and stolen smart card attack.

An Improved Biometric Multi-Server Authentication Scheme for Chang et al.'s Protocol

The remote authentication has been advancing with the growth of online services being offered on remotely basis. This calls for an optimal authentication framework other than single-server authentication. In this connection, the multi-server authentication architecture has been introduced in the literature that enables the users to avail variety of services of various servers, using a single pair of identity and password. Lately, we have witnessed a few multi-server authentication schemes in the literature, although security with loopholes. One of those multi-server authentication schemes has been presented by Chang et al. recently. Our analysis shows that the Chang et al. is vulnerable to impersonation attack, stolen smart card attack. In this study, we have reviewed the protocol thoroughly, and proposed an improved model, that is resistant to all known and identified attacks. The formal and informal security analysis for proposed model is also presented in this study, besides performance and its evaluation analysis.

An ECC Based Secure Authentication and Key Exchange Scheme in Multi-server Environment

For providing strong mutual authentication in a multi-server environment many algorithms have been proposed. Most of the algorithms provide mutual authentication between client and multiple servers by using single control server for registration. In this paper, we consider a scenario, in which client and server belong to the different control server. We have proposed a protocol for providing authentication in the multi-control server environment. In our scheme, for strong authentication, we use user’s biometric and registered password value in the authentication process. We also use the concept of elliptic curve cryptography to provide security features in our scheme. Furthermore, Burrows–Abadi–Needham logic has been used for formal security analysis in our work. With informal security analysis, we prove that our scheme is secure against popular security attacks like—denial of service attack, man-in-the-middle attack, replay attack and stolen smart card attack.

ELAKA: Energy-Efficient and Lightweight Multi-Server Authentication and Key Agreement Protocol Based on Dynamic Biometrics

Authentication and key agreement (AKA) provides flexible and convenient sercices. Most traditional AKA protocols are designed to apply in single-server environment, where a user has to register at different servers to access different types of network services and the user have to remember or manage a large number of usernames and passwords. Later, multi-server AKA protocols resolve the repeated registration problem of single-server AKA protocols, where a user can access different servers to get different services using a single registration and the same username and password. Recently, in 2015, Lu et al proposed a light-weight ID based authentication and key agreement protocol for multi-server architecture, referred to as LAKA protocol. They claimed their protocol can overcome all shortcomings which existed in Xue et al’s protocol. Unfortunately, our further research shows that LAKA protocol still suffers from server spoofing attack, stolen smart card attack etc. To overcome the weakness of LAKA protocol, an energy-efficient and lightweight authentication and key agreement protocol for multi-server architecture is proposed (abbreviated to ELAKA). The ELAKA protocol not only provides the security features declared by LAKA protocol, but also has some other advantages. First, the ELAKA protocol can realize authentication and key agreement just by three handshakes with extremely low communication cost and computation cost between users and servers, which can achieve a delicate balance of security and performance. Second, ELAKA protocol can enable the user enjoy the remote services with privacy protection. Finally the ELAKA protocol is proved secure against known possible attacks by using BAN logic. As a result, these features make ELAKA protocol is very suitable for computation-limited mobile devices (such as smartphone, PAD, tablets) in comparison to other related existing protocols.