Three-factor User Authentication Scheme Research Articles

A Provably Secure Three-Factor Authentication Protocol Based on Chebyshev Chaotic Mapping for Wireless Sensor Network

Wireless sensor network has been widely used and plays a vital role in the Internet of Things, smart cities, military, and other fields, and its security has also attracted the attention of many researchers. In view of the security defects in Shin and Kwon’s scheme such as failure to provide three-factor security, lack of anonymity and untraceability, user impersonation attack, desynchronization attack and privileged insider attack, we suggest an improved provably secure three-factor user authentication scheme based on Chebyshev chaotic mapping for wireless sensor network, which employs fuzzy verifier technique to prevent attacker from offline guessing attack on user identity and password when the stolen/lost smartcard is acquired by the attacker. During the authentication phase, a dynamic identity mechanism is used to ensure the anonymity of the user and sensor to prevent desynchronization attack, and the Chebyshev chaotic mapping is introduced to improve security and reduce computation overhead. The rigorous security proof under the random oracle model and the formal verification via ProVerif show that our protocol overcomes the weaknesses in Shin and Kwon’s scheme. In addition, by comparing the performance of our proposed scheme with that of others, we demonstrate that our proposal not only solves the security risks of Shin and Kwon.’s protocol, but also achieves a better tradeoff between security and efficiency, therefore, it is more suitable for user authentication in wireless sensor network environments.

Designing Secure User Authentication Protocol for Big Data Collection in IoT-Based Intelligent Transportation System

Secure access of the real-time data from the Internet-of-Things (IoT) smart devices (e.g., vehicles) by a legitimate external party (user) is an important security service for big data collection in the IoT-based intelligent transportation system (ITS). To deal with this important issue, we design a new three-factor user authentication scheme, called UAP-BCIoT, which relies on elliptic-curve cryptography (ECC). The mutual authentication between the user and an IoT device happens via the semitrusted cloud-gateway (CG) node in UAP-BCIoT. UAP-BCIoT supports several functionality features needed for IoT-based ITS environment including IoT smart device credential validation and big data analytics. A detailed security analysis is conducted based on the defined threat model to show that UAP-BCIoT is resilient against many known attacks. A thorough comparative study reveals that UAP-BCIoT supports better security, offers various functionality attributes, and also provides similar costs in communication as well computation as compared to other relevant schemes Finally, the practical demonstration of the proposed UAP-BCIoT is also provided to measure its impact on the network performance parameters.

Cryptanalysis and improvement of a three-factor user authentication scheme for smart grid environment

Nowadays, smart grid technology has become popular because it provides intelligent and distributed electrical power transmission systems. One of its main applications is to charge the electric vehicles. To provide a secure communication between a user and a smart meter and during the peak hours, authentication is necessary between them. Recently, Wazid et al. have discussed a three factor authentication (3FA) scheme for smart grid environment using ECC and showed that it is more secure than the related protocols. Here, we first cryptanalyze their scheme and find the user impersonation and stolen mobile terminal attacks in it. To remove these limitations, we design an improved authentication protocol for smart grid environment. We formally verify the security of our scheme using ProVerif tool. Also we present its informal security analysis to prove that it is invulnerable to many known attacks. In comparative study, we show that our scheme provides more security features than the existing schemes.

A three-factor anonymous user authentication scheme for Internet of Things environments

To accelerate the deployment of fifth-generation (5G) cellular networks, millions of devices are being connected to massive Internet of Things (IoT) networks. However, advances in the scale of connectivity on 5G networks may increase the attack surface of these devices, thereby increasing the number of attack opportunities. To address the potential security risks in IoT systems, one feasible security practice involves the development of secure and efficient user authentication schemes. In 2017, Dhillon and Kalra proposed a three-factor user authentication scheme for IoT. We noted that their scheme suffers from several security weaknesses. In this study, we specifically demonstrate that the scheme proposed by Dhillon and Kalra (1) is not secured from a stolen mobile device attack; (2) does not prevent a user impersonation attack; (3) does not provide a session key agreement; (4) does not have a contingency plan (e.g., a revocation phase) for situations where a user’s private key is compromised, or a mobile device is stolen or lost. We propose an improved three-factor user authentication scheme to resolve these security issues. Furthermore, we demonstrate that the proposed scheme provides desirable attributes for IoT environments and that its computation and communication costs are suitable for extremely low-cost IoT devices.

타원곡선 암호화와 퍼지 추출자를 이용한 강건한 삼중요소 사용자 인증 방식 연구

타원곡선 암호화와 퍼지 추출자를 이용한 강건한 삼중요소 사용자 인증 방식 연구

An Improved Three-Factor User Authentication and Key Agreement Scheme for Wireless Medical Sensor Networks

As wireless communication technology and semiconductor technology developed fast, the wireless medical sensor networks (WMSNs) have been applied to the modern health-care area at large. The physiological data can be obtained by medical sensor nodes deployed in the patient’s body and sent to the special devices of the health professionals through wireless communication. Thus, the status of a patient is monitored by the health professional in that way. However, there are still two important issues that how to guarantee secure communication and protect the privacy of the patient for the reason of the open feature of wireless communication. In this paper, initially, an improved three-factor user authentication scheme is proposed to overcome those flaws utilizing password, smart card, and biometric feature. Furthermore, formal security analysis shows that the proposed scheme defends against various security pitfalls. Finally, the comparison results with other surviving relevant schemes show that our scheme is more efficient in terms of computational cost, communication cost, and estimated time. Therefore, the proposed scheme is suitable for practical application in WMSN.

Secure Three-Factor User Authentication Scheme for Renewable-Energy-Based Smart Grid Environment

Smart grid (SG) technology has recently received significant attention due to its usage in maintaining demand response management in power transmission systems. In SG, charging of electric vehicles becomes one of the emerging applications. However, authentication between a vehicle user and a smart meter is required so that both of them can securely communicate for managing demand response during peak hours. To address the above mentioned issues, in this paper, we propose a new efficient three-factor user authentication scheme for a renewable energy-based smart grid environment (TUAS-RESG), which uses the lightweight cryptographic computations such as one-way hash functions, bitwise XOR operations, and elliptic curve cryptography. The detailed security analysis shows the robustness of TUAS-RESG against various well-known attacks. Moreover, TUAS-RESG provides superior security with additional features, such as dynamic smart meter addition, flexibility for password and biometric update, user and smart meter anonymity, and untraceability as compared to other related existing schemes. The practical demonstration of TUAS-RESG is also proved using the widely accepted NS2 simulation.

Cryptanalysis and improvement on anonymous three-factor authentication scheme for mobile networks

User authentication protocol is an important security mechanism for mobile networks. Recently, Wu et al. proposed a biometrics-based three-factor user authentication scheme using elliptic curve cryptography for mobile networks. However, in this paper, we find out that their scheme is vulnerable to the impersonation attack, because de/encryption key of the server and the user can be computed by an adversary. And then an improved three-factor authentication scheme for mobile client-server networks is proposed to overcome the weakness. The proposed scheme uses a random nonce to decrypt and encrypt messages without using the server's public key for reducing computation cost and avoiding the key management problem, and it also achieves user's anonymity. In addition, we apply the pi calculus-based formal verification tool ProVerif for security evaluations, and compare our scheme with some related schemes to show that the proposed scheme is both secure and efficient.

An improved and provably secure three-factor user authentication scheme for wireless sensor networks

In wireless sensor networks(WSNs), the process that a legal user retrieving the information in real-time from the sensor nodes should be based on mutual authentication among the user, the sensors and the gateway. So security issues have attracted researchers. In 2014, A. K. Das proposed a new three-factor user authentication scheme for WSNs to overcome the disadvantages in Jiang et al.’s two-factor user authentication scheme. However, we find that the scheme has several weaknesses including susceptibility to the off-line guessing attack and the de-synchronization attack and destitution of strong forward security. We also find weaknesses in two three-factor user authentication schemes for WSNs presented by A. K. Das in 2015, containing under the off-line password guessing attack and the user forgery attack. Also, the two schemes lack user anonymity and strong forward security. Then we give an improved three-factor remote authentication scheme for WSNs to eliminate the above weaknesses. To illustrate the security of our scheme, we give a standard formal proof in the random oracle model, a formal verification with ProVerif and the informal analysis of security properties. The results demonstrate that our scheme is robust enough to keep away from various security vulnerabilities. Through the comparison with some other recent schemes, ours is suitable for the application.

A novel and provably secure biometrics-based three-factor remote authentication scheme for mobile client–server networks

The biometrics, the password and the storage device are the elements of the three-factor authentication. In 2013, Yeh et al. proposed a three-factor user authentication scheme based on elliptic curve cryptography. However, we find that it has weaknesses including useless user identity, ambiguous process, no session key and no mutual authentication. Also, it cannot resist the user forgery attack and the server spoofing attack. Moreover, Khan et al. propose a fingerprint-based remote authentication scheme with mobile devices. Unfortunately it cannot withstand the user impersonation attack and the De-synchronization attack. Furthermore, the user’s identity cannot be anonymous, either. To overcome the disadvantages, we propose a new three-factor remote authentication scheme and give a formal proof with strong forward security. It could provide the user’s privacy and is secure. Compared to some recent three-factor authentication schemes, our scheme is secure and practical.

A Secure and Efficient User Anonymity-Preserving Three-Factor Authentication Protocol for Large-Scale Distributed Wireless Sensor Networks

Critical applications in wireless sensor network (WSN) are real-time based applications. Therefore, users are generally interested in accessing real-time information. This is possible, if the users (called the external parties) are allowed to access the real-time data directly from the sensor nodes inside WSN and not from the base station. The sensory information from nodes are gathered periodically by the base station and so, the gathered information may not be real-time. In order to get the real-time information from the sensor nodes, the user needs to be first authorized to the sensor nodes as well as the base station so that the illegal access to nodes do not happen. In this paper, we propose a novel three-factor user authentication scheme suited for distributed WSNs. Our scheme is light-weight, because it only requires the efficient cryptographic hash function, and symmetric key encryption and decryption operations. Further, our scheme is secure against different known attacks which are proved through the rigorous informal and formal security analysis. In addition, we simulate our scheme for the formal security verification using Automated Validation of Internet Security Protocols and Applications tool. The simulation results clearly demonstrate that our scheme is secure against passive and active adversaries.

An efficient and novel three-factor user authentication scheme for large-scale heterogeneous wireless sensor networks

In this paper, we propose a new three-factor user authentication mechanism in heterogeneous wireless sensor networks, which is a biometric-based scheme that makes use of smart card along with the user's password. The proposed protocol provides strong authentication as compared to traditional related password-based schemes and achieves good properties such as it works without synchronised clock, it freely changes password, and it provides low computation, communication and sensor's energy costs, and mutual authentication. Our scheme establishes a symmetric secret session key shared between a legal user and a sensor node so that the secret session key can be used later for secure future communications between them. Moreover, the proposed scheme provides unconditional security against node capture attack and it is also resilient against different attacks. Furthermore, the simulation results of our scheme using the automated validation of internet security protocols and applications AVISPA tool ensure that our scheme is secure.

A secure and robust temporal credential-based three-factor user authentication scheme for wireless sensor networks

User authentication is one of the most important security services required for the resource-constrained wireless sensor networks (WSNs). In user authentication, for critical applications of WSNs, a legitimate user is allowed to query and collect the real-time data at any time from a sensor node of the network as and when he/she demands for it. In order to get the real-time information from the nodes, the user needs to be first authenticated by the nodes as well as the gateway node (GWN) of WSN so that illegal access to nodes do not happen in the network. Recently, Jiang et al. proposed an efficient two-factor user authentication scheme with unlinkability property in WSNs Jiang (2014). In this paper, we analyze Jiang et al.’s scheme. Unfortunately, we point out that Jiang et al.’s scheme has still several drawbacks such as (1) it fails to protect privileged insider attack, (2) inefficient registration phase for the sensor nodes, (3) it fails to provide proper authentication in login and authentication phase, (4) it fails to update properly the new changed password of a user in the password update phase, (5) it lacks of supporting dynamic sensor node addition after initial deployment of nodes in the network, and (6) it lacks the formal security verification. In order to withstand these pitfalls found in Jiang et al.’s scheme, we aim to propose a three-factor user authentication scheme for WSNs. Our scheme preserves the original merits of Jiang et al.’s scheme. Our scheme is efficient as compared to Jiang et al.’s scheme and other schemes. Furthermore, our scheme provides better security features and higher security level than other schemes. In addition, we simulate our scheme for the formal security analysis using the widely-accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool. The simulation results clearly demonstrate that our scheme is also secure.