Three-factor Authentication Scheme Research Articles

An efficient and secure three-factor based authenticated key exchange scheme using elliptic curve cryptosystems

Recently, many authentication schemes have been provided which are based on biometrics with password and smart cards. The three-factor schemes can provide high security for remote authentication between a user and a server. In 2015, Lu et al. proposed a three-factor authentication scheme based on elliptic curve cryptography. However, we show that Lu et al’s scheme leaks user’s identity and is vulnerable to impersonation attacks. To enhance the scheme’s security, we propose a new efficient three-factor authentication scheme. Furthermore, we give a formal security proof under BAN logic and random orale model. From comparative results of some recent ones, our scheme is efficient and secure for practical applications.

A novel three-factor authentication and key agreement scheme providing anonymity in global mobility networks

As an important service, global roaming is widely used in global mobility networks to make the stable connectivity when the user goes through between different networks. To keep the security of communication, mutual authentication among the foreign agent, the home agent, and the user is a necessary part before normal data flow of the communication. Besides that, the need that the user's personal information should be protected is also an urgent task in the intercourse. Until now, a host of two-factor authentication schemes has been presented, and many weaknesses are presented under security analysis. Here, we propose a new three-factor key agreement and authentication scheme to overcome the problems, which exist in the past schemes. The security of the scheme is proved with three ways. The first is the formal proof employing the random oracle model. The second is the formal verification with Proverif, and the last is the informal analysis. And the presented scheme has all common security properties and is practical for applications. Copyright © 2016 John Wiley & Sons, Ltd.

An Improved Lightweight Privacy Preserving Authentication Scheme for SIP-Based-VoIP Using Smart Card (MPhil – Dissertation)

In the past few years, secure information sharing became very popular in the area of immigration, military applications, healthcare, education, foreign affairs, etc. As secure communication utilizes both wireless and wired communication mechanizations for exchanging sensitive information, so security and privacy of the information exchange cannot be easily compromised. To moderate the security, integrity, authenticity, and privacy issues related to information exchange, numerous authentication mechanisms have been recommended by different researcher in the literature in recent times, but are vulnerable to prospective security flaws such as masquerade, insider, replay, impersonation, password guessing, server spoofing, denial-of-service attacks and in addition failed to deliver mutual authentication. In the past few years, we have also seen a balanced growth in the acceptance of VoIP (Voice over IP) facilities, because the numerous Web and VoIP applications depend on huge and extremely distributed infrastructures to process requests from millions of users in an appropriate manner. Due to their extraordinary desires, these large-scale Internet applications have frequently surrendered security for other objectives such as performance, scalability, and availability. As a result, these applications have characteristically favored weaker, but well-organized security mechanisms in their foundations. Session Initiation Protocol (SIP) is an application and presentation layers signaling protocol that initiates, modifies, and terminates IP-based multimedia sessions. Implementing SIP for secure communication has been a topic of study for the past decade, and several proposals are available in the research domain. However, security aspects are not addressed in most of these proposals, because SIP is exposed to several threats and faces security issue at these layers. Probes for SIP (Session Initiation Protocol) servers have been conveyed for many years, and to gather more details about these activities we simply design a for SIP servers in a network and composed data about some popular attacks. What will follow is an explanation of our interpretations and guidance on how to prevent these attacks from being successful. Biometrics a new field of research has also been materialized in this research, entitled “a three-factor authentication scheme in which one factor is biometrics. In biometric cryptosystems, the benefits of biometric confirmation are presented to basic cryptographic key supervisory systems to enhance security. Anyhow, this research delivers a general outline of the basics, permitting to biometrics as well as cryptography. This work also gives biometric cryptosystems based on iris biometrics and using smart card as well as a password for authentication.

Robust extended chaotic maps-based three-factor authentication scheme preserving biometric template privacy

Due to its high level of security, three-factor authentication combining password, smart card and biometrics has received much interest in the past decades. Recently, Islam proposed a dynamic identity-based three-factor authentication scheme using extended chaotic map which attempts to fulfill three-factor security and resist various known attacks, offering many advantages over existing works. However, in this paper we first show that the process of password verification in the login phase is invalid. Besides this defect, it is also vulnerable to user impersonation attack and off-line password guessing attack, under the condition that the smart card is lost or stolen. Furthermore, it fails to preserve biometric template privacy in the case that the password and the smart card are compromised. To remedy these flaws, we propose a robust three-factor authentication scheme, which not only resists various known attacks, but also provides more desired security features. We demonstrate that our scheme provides mutual authentication using the Burrows–Abadi–Needham logic. Our scheme provides high security strength as well as low computational cost.

Robust biometrics based authentication and key agreement scheme for multi-server environments using smart cards.

Biometrics authenticated schemes using smart cards have attracted much attention in multi-server environments. Several schemes of this type where proposed in the past. However, many of them were found to have some design flaws. This paper concentrates on the security weaknesses of the three-factor authentication scheme by Mishra et al. After careful analysis, we find their scheme does not really resist replay attack while failing to provide an efficient password change phase. We further propose an improvement of Mishra et al.’s scheme with the purpose of preventing the security threats of their scheme. We demonstrate the proposed scheme is given to strong authentication against several attacks including attacks shown in the original scheme. In addition, we compare the performance and functionality with other multi-server authenticated key schemes.

A novel and provably secure biometrics-based three-factor remote authentication scheme for mobile client–server networks

The biometrics, the password and the storage device are the elements of the three-factor authentication. In 2013, Yeh et al. proposed a three-factor user authentication scheme based on elliptic curve cryptography. However, we find that it has weaknesses including useless user identity, ambiguous process, no session key and no mutual authentication. Also, it cannot resist the user forgery attack and the server spoofing attack. Moreover, Khan et al. propose a fingerprint-based remote authentication scheme with mobile devices. Unfortunately it cannot withstand the user impersonation attack and the De-synchronization attack. Furthermore, the user’s identity cannot be anonymous, either. To overcome the disadvantages, we propose a new three-factor remote authentication scheme and give a formal proof with strong forward security. It could provide the user’s privacy and is secure. Compared to some recent three-factor authentication schemes, our scheme is secure and practical.

A secure user anonymity-preserving three-factor remote user authentication scheme for the telecare medicine information systems.

Recent advanced technology enables the telecare medicine information system (TMIS) for the patients to gain the health monitoring facility at home and also to access medical services over the Internet of mobile networks. Several remote user authentication schemes have been proposed in the literature for TMIS. However, most of them are either insecure against various known attacks or they are inefficient. Recently, Tan proposed an efficient user anonymity preserving three-factor authentication scheme for TMIS. In this paper, we show that though Tan's scheme is efficient, it has several security drawbacks such as (1) it fails to provide proper authentication during the login phase, (2) it fails to provide correct updation of password and biometric of a user during the password and biometric update phase, and (3) it fails to protect against replay attack. In addition, Tan's scheme lacks the formal security analysis and verification. Later, Arshad and Nikooghadam also pointed out some security flaws in Tan's scheme and then presented an improvement on Tan's s scheme. However, we show that Arshad and Nikooghadam's scheme is still insecure against the privileged-insider attack through the stolen smart-card attack, and it also lacks the formal security analysis and verification. In order to withstand those security loopholes found in both Tan's scheme, and Arshad and Nikooghadam's scheme, we aim to propose an effective and more secure three-factor remote user authentication scheme for TMIS. Our scheme provides the user anonymity property. Through the rigorous informal and formal security analysis using random oracle models and the widely-accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool, we show that our scheme is secure against various known attacks, including the replay and man-in-the-middle attacks. Furthermore, our scheme is also efficient as compared to other related schemes.

Cryptanalysis and improvement of a user authentication scheme preserving uniqueness and anonymity for connected health care.

Nowadays, connected health care applications are used more and more in the world. Service through the applications can save the patients' time and expense, such as telecare medical information system (TMIS) and integrated electronic patient record (EPR) information system. In the applications, preserving patients' privacy, transmitting messages securely and keeping mutual authentication should all be paid attention. Many authentication schemes have been proposed to make a secure communicating environment. Recently Xie et al. showed that Wen's scheme was insecure because it was under the off-line password guessing attack and without user anonymity and forward security. They gave a new three-factor authentication scheme and claimed that it was secure. However, we find that Xie et al's scheme is vulnerable to the De-synchronization attack and the server has too much storage burden in the scheme. Then we present an improved scheme which overcomes the usual weaknesses and keeps ordinary security characters. Compared with recent schemes of the same kind, our scheme is secure and practical.

An Efficient Generic Framework for Three-Factor Authentication With Provably Secure Instantiation

Remote authentication has been widely studied and adapted in distributed systems. The security of remote authentication mechanisms mostly relies on one of or the combination of three factors: 1) something users know—password; 2) something users have—smart card; and 3) something users are—biometric characteristics. This paper introduces an efficient generic framework for three-factor authentication. The proposed generic framework enhances the security of existing two-factor authentication schemes by upgrading them to three-factor authentication schemes, without exposing user privacy. In addition, we present a case study by upgrading a secure two-factor authentication scheme to a secure three-factor authentication scheme. Furthermore, implementation analysis, formal proof, and privacy discussion are provided to show that the derived scheme is practical, secure, and privacy preserving.

Three-factor anonymous authentication and key agreement scheme for Telecare Medicine Information Systems.

Nowadays, with comprehensive employment of the internet, healthcare delivery services is provided remotely by telecare medicine information systems (TMISs). A secure mechanism for authentication and key agreement is one of the most important security requirements for TMISs. Recently, Tan proposed a user anonymity preserving three-factor authentication scheme for TMIS. The present paper shows that Tan's scheme is vulnerable to replay attacks and Denial-of-Service attacks. In order to overcome these security flaws, a new and efficient three-factor anonymous authentication and key agreement scheme for TMIS is proposed. Security and performance analysis shows superiority of the proposed scheme in comparison with previously proposed schemes that are related to security of TMISs.

Remote three-factor authentication scheme based on Fuzzy extractors

In order to provide high-security remote authentication, the three-factor authentication scheme combining biometric with smart card and password has been proposed. With a careful review of the recently proposed Lee-Hsu's scheme, this paper points out some design flaws in it. In order to withstand them, a new scheme based on Fuzzy extractors is proposed. With a detail analysis, this paper demonstrates that the proposed scheme is more practical and reasonable. It also has higher security and deals with biometric more appropriately in spite of higher computation cost at client than Lee-Hsu's scheme. Furthermore, an access control method has been introduced in it for the purpose of making different users enjoy different access privileges with regard to the data. What is more, the proposed scheme can also achieve key agreement. Copyright © 2014 John Wiley & Sons, Ltd.

A User Anonymity Preserving Three-Factor Authentication Scheme for Telecare Medicine Information Systems

The telecare medicine information system enables the patients gain health monitoring at home and access medical services over internet or mobile networks. In recent years, the schemes based on cryptography have been proposed to address the security and privacy issues in the telecare medicine information systems. However, many schemes are insecure or they have low efficiency. Recently, Awasthi and Srivastava proposed a three-factor authentication scheme for telecare medicine information systems. In this paper, we show that their scheme is vulnerable to the reflection attacks. Furthermore, it fails to provide three-factor security and the user anonymity. We propose a new three-factor authentication scheme for the telecare medicine information systems. Detailed analysis demonstrates that the proposed scheme provides mutual authentication, server not knowing password and freedom of password, biometric update and three-factor security. Moreover, the new scheme provides the user anonymity. As compared with the previous three-factor authentication schemes, the proposed scheme is more secure and practical.

Geometric based remote password authentication using biometrics

Wu has discussed a geometric based remote password authentication using simple geometric properties of line. Chan and Cheng showed it to be vulnerable and suggested improvement. To provide more security to user authenticated applications combining biometrics with smart cards and passwords is a better solution. However, in such type of schemes, during the authentication phase, biometric characteristics are verified in smart cards only, not in the remote servers. From the remote server point of view, we do not really provide three-factor security, i,e., passwords, fingerprints and smart cards. Another limitation in the schemes available in literature is that they do not have two-way authentication i.e., a user can authenticate the server and the server can authenticate the user. In this paper, we propose a truly three-factor remote authentication scheme in which all three security factors - passwords, smart cards, and biometric data - are examined in the remote servers. This mechanism provides more security to the system. Furthermore, our scheme gives freedom to a user to choose his own password and flexibility to change his password whenever he desires.

Robust elliptic curve cryptography‐based three factor user authentication providing privacy of biometric data

Recently, to achieve privacy protection using biometrics, Fan and Lin proposed a three-factor authentication scheme based on password, smart card and biometrics. However, the authors have found that Fan and Lin's proposed scheme (i) has flaws in the design of biometrics privacy, (ii) fails to maintain a verification table, making it vulnerable to stolen-verifier attack and modification attack, and (iii) is vulnerable to insider attacks. Thus, the authors propose an elliptic curve cryptography-based authentication scheme that is improved with regard to security requirements. The authors’ proposed scheme overcomes the flaws of Fan and Lin's scheme and is secured from attacks. Furthermore, the authors have presented a security analysis of their scheme to show that their scheme is suitable for the biometric systems.

Cryptanalysis and improvement of TAKA<SUB>SIP</SUB> protocol

Session Initiation Protocol(SIP) provides authentication and session key agreement to ensure the security of the successive session.In 2010,Yoon et al.(YOON E-J,YOO K-Y.A three-factor authenticated key agreement scheme for SIP on elliptic curves.NSS '10: 4th International Conference on Network and System Security.Piscataway: IEEE,2010: 334-339.) proposed a three-factor authenticated key agreement scheme named TAKA_SIP for SIP.However,the scheme is vulnerable to insider attack,server-spoofing attack,off-line password attack,and losing token attack.Moreover,it does not provide mutual authentication.To overcome these flaws of TAKA_SIP,a new three-factor authentication scheme named ETAKA_SIP based on Elliptic Curve Cryptosystem(ECC) was proposed.ETAKA_SIP,on the basis of elliptic curve discrete logarithm problem,provides higher security than TAKA_SIP.It needs 7 elliptic curve scalar multiplication operations,1 additional operation and up to 6 Hash operations,and of high efficiency.

Provably Secure Remote Truly Three-Factor Authentication Scheme With Privacy Protection on Biometrics

<para xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> A three-factor authentication scheme combines biometrics with passwords and smart cards to provide high-security remote authentication. Most existing schemes, however, rely on smart cards to verify biometric characteristics. The advantage of this approach is that the user's biometric data is not shared with remote server. But the disadvantage is that the remote server must trust the smart card to perform proper authentication which leads to various vulnerabilities. To achieve truly secure three-factor authentication, a method must keep the user's biometrics secret while still allowing the server to perform its own authentication. Our method achieves this. The proposed scheme fully preserves the privacy of the biometric data of every user, that is, the scheme does not reveal the biometric data to anyone else, including the remote servers. We demonstrate the completeness of the proposed scheme through the GNY (Gong, Needham, and Yahalom) logic. Furthermore, the security of our proposed scheme is proven through Bellare and Rogaway's model. As a further benefit, we point out that our method reduces the computation cost for the smart card. </para>