Two-factor Authentication Scheme Research Articles

A secure and robust temporal credential-based three-factor user authentication scheme for wireless sensor networks

User authentication is one of the most important security services required for the resource-constrained wireless sensor networks (WSNs). In user authentication, for critical applications of WSNs, a legitimate user is allowed to query and collect the real-time data at any time from a sensor node of the network as and when he/she demands for it. In order to get the real-time information from the nodes, the user needs to be first authenticated by the nodes as well as the gateway node (GWN) of WSN so that illegal access to nodes do not happen in the network. Recently, Jiang et al. proposed an efficient two-factor user authentication scheme with unlinkability property in WSNs Jiang (2014). In this paper, we analyze Jiang et al.’s scheme. Unfortunately, we point out that Jiang et al.’s scheme has still several drawbacks such as (1) it fails to protect privileged insider attack, (2) inefficient registration phase for the sensor nodes, (3) it fails to provide proper authentication in login and authentication phase, (4) it fails to update properly the new changed password of a user in the password update phase, (5) it lacks of supporting dynamic sensor node addition after initial deployment of nodes in the network, and (6) it lacks the formal security verification. In order to withstand these pitfalls found in Jiang et al.’s scheme, we aim to propose a three-factor user authentication scheme for WSNs. Our scheme preserves the original merits of Jiang et al.’s scheme. Our scheme is efficient as compared to Jiang et al.’s scheme and other schemes. Furthermore, our scheme provides better security features and higher security level than other schemes. In addition, we simulate our scheme for the formal security analysis using the widely-accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool. The simulation results clearly demonstrate that our scheme is also secure.

An Efficient Generic Framework for Three-Factor Authentication With Provably Secure Instantiation

Remote authentication has been widely studied and adapted in distributed systems. The security of remote authentication mechanisms mostly relies on one of or the combination of three factors: 1) something users know—password; 2) something users have—smart card; and 3) something users are—biometric characteristics. This paper introduces an efficient generic framework for three-factor authentication. The proposed generic framework enhances the security of existing two-factor authentication schemes by upgrading them to three-factor authentication schemes, without exposing user privacy. In addition, we present a case study by upgrading a secure two-factor authentication scheme to a secure three-factor authentication scheme. Furthermore, implementation analysis, formal proof, and privacy discussion are provided to show that the derived scheme is practical, secure, and privacy preserving.

On the anonymity of two-factor authentication schemes for wireless sensor networks: Attacks, principle and solutions

Anonymity is among the important properties of two-factor authentication schemes for wireless sensor networks (WSNs) to preserve user privacy. Though impressive efforts have been devoted to designing schemes with user anonymity by only using lightweight symmetric-key primitives such as hash functions and block ciphers, to the best of our knowledge none has succeeded so far. In this work, we take an initial step to shed light on the rationale underlying this prominent issue. Firstly, we scrutinize two previously-thought sound schemes, namely Fan et al.’s scheme and Xue et al.’s scheme, and demonstrate the major challenges in designing a scheme with user anonymity.Secondly, using these two foremost schemes as case studies and on the basis of the work of Halevi–Krawczyk (1999) [44] and Impagliazzo–Rudich (1989) [43], we put forward a general principle: Public-key techniques are intrinsically indispensable to construct a two-factor authentication scheme that can support user anonymity. Furthermore, we discuss the practical solutions to realize user anonymity. Remarkably, our principle can be applied to two-factor schemes for universal environments besides WSNs, such as the Internet, global mobility networks and mobile clouds. We believe that our work contributes to a better understanding of the inherent complexity in achieving user privacy, and will establish a groundwork for developing more secure and efficient privacy-preserving two-factor authentication schemes.

An efficient two-factor user authentication scheme with unlinkability for wireless sensor networks

User authentication with unlinkability is one of the corner stone services for many security and privacy services which are required to secure communications in wireless sensor networks (WSNs). Recently, Xue et al. proposed a temporal-credential-based mutual authentication and key agreement scheme for WSNs, and claimed that their scheme achieves identity and password protection, and the resiliency of stolen smart card attacks. However, we observe that Xue et al.’s scheme is subject to identity guessing attack, tracking attack, privileged insider attack and weak stolen smart card attack. In order to fix the drawbacks, we propose an enhanced authentication scheme with unlinkability. Additionally, the proposed scheme further cuts the computational cost. Therefore, the proposed scheme not only remedies its security flaws but also improves its performance. It is more suitable for practical applications of WSNs than Xue et al.’s scheme.

Security analysis and improvements of two-factor mutual authentication with key agreement in wireless sensor networks.

User authentication and key management are two important security issues in WSNs (Wireless Sensor Networks). In WSNs, for some applications, the user needs to obtain real-time data directly from sensors and several user authentication schemes have been recently proposed for this case. We found that a two-factor mutual authentication scheme with key agreement in WSNs is vulnerable to gateway node bypassing attacks and user impersonation attacks using secret data stored in sensor nodes or an attacker's own smart card. In this paper, we propose an improved scheme to overcome these security weaknesses by storing secret data in unique ciphertext form in each node. In addition, our proposed scheme should provide not only security, but also efficiency since sensors in a WSN operate with resource constraints such as limited power, computation, and storage space. Therefore, we also analyze the performance of the proposed scheme by comparing its computation and communication costs with those of other schemes.

Understanding security failures of two-factor authentication schemes for real-time applications in hierarchical wireless sensor networks

Understanding security failures of cryptographic protocols is the key to both patching existing protocols and designing future schemes. In this work, we investigate two recent proposals in the area of smart-card-based password authentication for security-critical real-time data access applications in hierarchical wireless sensor networks (HWSN). Firstly, we analyze an efficient and DoS-resistant user authentication scheme introduced by Fan et al. in 2011. This protocol is the first attempt to address the problems of user authentication in HWSN and only involves lightweight cryptographic primitives, such as one-way hash function and XOR operations, and thus it is claimed to be suitable for the resource-constrained HWSN environments. However, it actually has several security loopholes being overlooked, and we show it is vulnerable to user anonymity violation attack, smart card security breach attack, sensor node capture attack and privileged insider attack, as well as its other practical pitfalls. Then, A.K. Das et al.’s protocol is scrutinized, and we point out that it cannot achieve the claimed security goals: (1) It is prone to smart card security breach attack; (2) it fails to withstand privileged insider attack; and (3) it suffers from the defect of server master key disclosure. Our cryptanalysis results discourage any practical use of these two schemes and reveal some subtleties and challenges in designing this type of schemes. Furthermore, using the above two foremost schemes as case studies, we take a first step towards investigating the underlying rationale of the identified security failures, putting forward three basic principles which we believe will be valuable to protocol designers for advancing more robust two-factor authentication schemes for HWSN in the future.

Two-factor face authentication using matrix permutation transformation and a user password

Although authentication using biometric techniques is convenient, security issues such as the loss of personal bio-information are serious problems. However, the development of a secure biometrics scheme poses considerable challenges because users’ bio-information is not precisely the same for each authentication attempt. This uncertainty during the authentication process obstructs direct application of cryptographic one-way functions in the authentication system. In this paper, we suggest a two-factor face authentication scheme using matrix transformations and a user password. Our scheme is designed with a secure cancellation feature, in that templates composed of permutation and feature vectors can be freely changed. Through experimental scenarios and results, we introduce the notable features of our scheme. Furthermore, we consider possible attacks on the proposed scheme and suggest security enhancement methods.

Secure Authentication System for Hybrid Cloud Service in Mobile Communication Environments

We want more cloud service because of computer resource reuse, server device cost, and space problems. So, related researchers suggest private cloud service to solve these problems in internetwork environment for only inner users. Therefore if outside users want to use private cloud service using mobile device, they do not support any services to outside user. Public cloud services can overcome private cloud services with the existing constraints. Amazon was the first public cloud service. In Korea, KT provide computing power and storage devices with payment. But this service is very expensive, so hybrid cloud service is developed. Hybrid cloud service operates mobile communication environment. User can contact to service using smart phone, tablet and PC. So, it has many security threats such as internet environment with server-client system. Furthermore, mobile device user wants more nomadic attribute and free contact to server through outside communication environments. So it can make many security problems to server. Therefore researcher must solve security threats in mobile communication environment with hybrid cloud service system. But now anybody have no idea about these problems. In this paper, we approach to user and mobile device authentication system with hybrid cloud service server. They have smart phone, Tablet, Ultrabook and PC to uses hybrid cloud service such as attribute based services. Our proposed authentication system can support user authorization, device certification and service authentication service to user very easily. It uses RADIUS method and Two-factor authentication schemes. So, we propose a secure authentication system for the hybrid cloud service in mobile communication environments in this paper. Our proposal scheme can provided security, availability, applicability, and resistance about Man-In-The-Middle attack.

Robust Chaotic Map-based Authentication and Key Agreement Scheme with Strong Anonymity for Telecare Medicine Information Systems

To ensure only authorized access to medical services, several authentication schemes for telecare medicine information systems (TMIS) have been proposed in the literature. Due to its better performance than traditional cryptography, Hao et al. proposed an authentication scheme for TMIS using chaotic map based cryptography. They claimed that their scheme could resist various attacks, including the smart card stolen attack. However, we identify that their scheme is vulnerable to the stolen smart card attack. The reason causing the stolen smart card attack is that the scheme is designed based on the assumption that the scheme itself achieves user untraceability. Then, we propose a robust authentication and key agreement scheme. Compared with the previous schemes, our scheme not only enjoys more security features, but also has better efficiency. Our analysis indicates that designing a two-factor authentication scheme based on the assumption that privacy protection is achieved in the scheme itself may pose potential security risks. The lesson learned is that, we should avoid this situation in the future design of two-factor authentication schemes.

Two-Factor User Authentication with Key Agreement Scheme Based on Elliptic Curve Cryptosystem

A password authentication scheme using smart card is called two-factor authentication scheme. Two-factor authentication scheme is the most accepted and commonly used mechanism that provides the authorized users a secure and efficient method for accessing resources over insecure communication channel. Up to now, various two-factor user authentication schemes have been proposed. However, most of them are vulnerable to smart card loss attack, offline password guessing attack, impersonation attack, and so on. In this paper, we design a password remote user authentication with key agreement scheme using elliptic curve cryptosystem. Security analysis shows that the proposed scheme has high level of security. Moreover, the proposed scheme is more practical and secure in contrast to some related schemes.

A Secure and Efficient Authentication and Key Agreement Scheme Based on ECC for Telecare Medicine Information Systems

In the field of the Telecare Medicine Information System, recent researches have focused on consummating more convenient and secure healthcare delivery services for patients. In order to protect the sensitive information, various attempts such as access control have been proposed to safeguard patients' privacy in this system. However, these schemes suffered from some certain security defects and had costly consumption, which were not suitable for the telecare medicine information system. In this paper, based on the elliptic curve cryptography, we propose a secure and efficient two-factor mutual authentication and key agreement scheme to reduce the computational cost. Such a scheme enables to provide the patient anonymity by employing the dynamic identity. Compared with other related protocols, the security analysis and performance evaluation show that our scheme overcomes some well-known attacks and has a better performance in the telecare medicine information system.

사용자 편의성을 강화한 모바일 메신저 기반의 two-factor 인증 기법

When you log in websites using a password, it has vulnerabilities such as shoulder surfing attack, guessing attack, etc. Two-factor authentication schemes using OTP token, mobile OTP, SMS authentication code, etc. are used to make up for the vulnerabilities of password-based authentication scheme. But, currently existing two-factor authentication schemes have some onerousness which always carry the authentication device or install applications that each web server provides. And it is inconvenient that user 접수일(2013년08월16일), 심사의뢰일(2013년08월17일), 심사완료일(1차:2013년09월03일, 2차:2013년09월23일) 게재일(2013년10월31일) 136-713 서울시 성북구 안암동 5가, 고려대학교 정보보호대학원 email: jjebal777@korea.ac.kr 136-713 서울시 성북구 안암동 5가, 고려대학교 정보보호대학원 email: bkcloud18@daum.net (교신저자) 136-713 서울시 성북구 안암동 5가, 고려대학교 정보보호대학원 email: donghlee@korea.ac.kr *본 연구는 미래창조과학부 및 한국인터넷진흥원의 고용계약형 지식정보보안 석사과정 지원사업의 연구결과로 수행되었음. 사용자 편의성을 강화한 모바일 메신저 기반의 two-factor 인증 기법 Copyright c 2013 SERSC 550 should enter the one time password created from the device or one time password transmitted from the web server to own PC. We propose two-factor authentication scheme with improved usability which creates authentication URL and send to user's mobile messenger. After that, the user just clicks the authentication URL. Also in this paper, our scheme is compared with currently existing two-factor authentication schemes and we proved the applicability on system through the implementation.

Cryptanalysis and Improvement of a Two-Factor User Authentication Scheme Providing Mutual Authentication and Key Agreement over Insecure Channels

Abstract — A two-factor remote authentication scheme was presented by Chun-Ta Li et al. in 2010. We present the framework of an impersonation attack against their scheme if the smart card gets stolen. We show that it is easy for an attacker to compute password of a user by using information extracted from the stolen smart card. We also propose a simple and easy solution to fix this problem. Index Terms — Authentication schemes, cryptanalysis, mutual authentication, smart card. I. I NTRODUCTION To avoid unauthorized access, some security mechanism is needed to authenticate legitimate users. There are three common ways to authenticate a user: what you know (a pin or a password), what you have (a hardware token) and what you are (a biometric trait). The most commonly used mechanism for authentication is password. As it is not easy to remember strong passwords especially when a user has multiple accounts, this leads to either using same password for all accounts or selecting passwords with low entropy that can easily be guessed. Hardware token-based schemes are also vulnerable because the hardware token can be lost, stolen, forged or compromised. Biometric-based authentication schemes are resistive for most of the problems in token-based and password systems and provide better security then the other two techniques, yet these are not widely adopted mainly because they are expensive to implement and use. Due to the above-mentioned problems with the individual authentication techniques, researchers have proposed to use two-factor authentication where, in most cases, the two factors being used are a password and a hardware token typically a smart card. Using two-factors increases both security and reliability of the overall system. In this paper, we have analyzed one of the two factor authentication schemes proposed by Chun-Ta Li

An enhanced two-factor user authentication in wireless sensor networks

Since wireless sensor networks (WSN) are often deployed in an unattended environment and sensor nodes are equipped with limited computing power modules, user authentication is a critical issue when a user wants to access data from sensor nodes. Recently, M.L. Das proposed a two-factor user authentication scheme in WSN and claimed that his scheme is secure against different kinds of attack. Later, Khan and Alghathbar (K-A) pointed out that Das' scheme has some security pitfalls and showed several improvements to overcome these weaknesses. However, we demonstrate that in the K-A-scheme, there is no provision of non-repudiation, it is susceptible to the attack due to a lost smart card, and mutual authentication between the user and the GW-node does not attained. Moreover, the GW-node cannot prove that the first message comes from the user. To overcome these security weaknesses of the K-A-scheme, we propose security patches and prove our scheme.

Robust Anonymous Two-Factor Authentication Scheme for Roaming Service in Global Mobility Network

Two-factor authentication scheme for roaming service in global mobility network enables the mobile user in possession of a password and a smart card to achieve mutual authentication and session key establishment with the foreign agent. In this paper, we first identify six properties of this type of schemes: (1) Anonymity and untraceability; (2) Robustness; (3) Authentication; (4) Session key security and fairness; (5) User friendliness; and (6) Efficiency, then propose a new scheme which satisfies all these requirements. Our result is validated applying the formal verification tool ProVerif based on applied pi calculus.

A Novel Tri-Factor Mutual Authentication with Biometrics for Wireless Body Sensor Networks in Healthcare Applications

Abstract User authentication, as a fundamental security protocol, has been addressed with more concerns recently. Unlike normal authentication processes invoked by a user to access the network, biosensors with healthcare applications normally need to be validated automatically, followed by data transmission to the remote server without any explicit request. Hence, implied authentication procedure involved in such application scenarios shall be addressed. In this paper, a novel tri-factor user authentication protocol with mutual access is proposed for the body sensor networks (BSN) in healthcare application. It is demonstrated that the proposed protocol has its advantages over the existing two-factor user authentication schemes.

An improved remote password authentication scheme with smart card

This paper analyzes the security performance of a latest proposed remote two-factor user authentication scheme and proposes an improved scheme based on the dynamic ID to avoid the attacks it suffers. Besides this, in our proposed scheme the password is no longer involved in the calculation of verification phase which makes our scheme more secure and costs less than the old one. At last we analyze the performance of our proposed scheme to prove it provides mutual authentication between the user and the server. Moreover, it also resists password guessing attack, server and user masquerade attack and replay attack effectively.

Improvement of a security enhanced one-time two-factor authentication and key agreement scheme

In 2010, Hölbl et al. showed that Shieh et al.’s mutual authentication and key agreement scheme is vulnerable to the smart card lost attack, not achieving perfect forward secrecy, and proposed a security enhanced scheme to eliminate these weaknesses. In this paper, we show that Hölbl et al.’s security enhancement is still vulnerable to the smart card lost attacks. In addition, their scheme cannot resist impersonation attacks and parallel session attacks. Seeing that the existing mutual authentication schemes using smart cards are almost vulnerable to the smart card lost attacks, we further propose a new one-time two-factor mutual authentication and key agreement scheme to eliminate these weaknesses.

Construction of a secure two-factor user authentication system using fingerprint information and password

User authentication is highly necessary technology in a variety of services. Many researchers have proposed a two-factor authentication scheme using certificate and OTP, smartcard and password, and so on. Two-factor authentication requires an additional factor rather than one-factor authentication. Therefore, loss or exposure can occur, since users always must carry and manage the additional device or factor. For this reason, biometric authentication, used in many services, needs a verification method of the user without an additional factor. Fingerprinting is widely used in service due to excellent recognition, low cost device, and less user-hostile. However, fingerprint recognition always uses the same fingerprint template, due to the inalterability. This causes a problem of reusable fingerprint by a malicious attacker. Therefore, we proposed a secure two-factor user authentication system using fingerprint information and password to solve the existing two-factor problem. The proposed scheme is secure against reuse of a fingerprint. It does not need an extra device, so efficiency and accessibility are improved.

On the security and improvement of a two-factor user authentication scheme in wireless sensor networks

User authentication is a basic security requirement during the deployment of the wireless sensor network (WSN), because it may operate in a rather hostile environment, such as a military battlefield. In 2010, Khan and Alghathbar (KA) found out that Das's two-factor user authentication scheme for WSNs is vulnerable to the gateway node (GW-node) bypassing attack and the privileged-insider attack. They further presented an improved scheme to overcome the security flaws of Das's scheme. However, in this paper, we show that KA's scheme still suffers from the GW-node impersonation attack, the GW-node bypassing attack, and the privileged-insider attack. Hence, to fix the security flaws in KA's scheme, we propose a new user authentication scheme for WSNs. The security of the user authentication session in the proposed scheme is reduced by the model of Bellare and Rogaway. The security of partial compromise of secrets in the proposed scheme is reduced and analyzed by our adversarial model. Based on the performance evaluation, the overall cost of the proposed scheme is less than that of KA's scheme. Hence, we believe that the proposed scheme is more suitable for real security applications than KA's scheme.