Design of a provably secure biometrics-based multi-cloud-server authentication scheme

Authenticated key exchange (AKE) protocol allows a user and a server to authenticate each other and generate a session key for the subsequent communications. With the rapid development of low-power and highly-efficient networks, such as pervasive and mobile computing network in recent years, many efficient AKE protocols have been proposed to achieve user privacy and authentication in the communications. Besides secure session key establishment, those AKE protocols offer some other useful functionalities, such as two-factor user authentication and mutual authentication. However, most of them have one or more weaknesses, such as vulnerability against lost-smart-card attack, offline dictionary attack, de-synchronization attack, or the lack of forward secrecy, and user anonymity or untraceability. Furthermore, an AKE scheme under the public key infrastructure may not be suitable for light-weight computational devices, and the security model of AKE does not capture user anonymity and resist lost-smart-card attack. In this paper, we propose a novel dynamic ID-based anonymous two-factor AKE protocol, which addresses all the above issues. Our protocol also supports smart card revocation and password update without centralized storage. Further, we extend the security model of AKE to support user anonymity and resist lost-smart-card attack, and the proposed scheme is provably secure in extended security model. The low-computational and bandwidth cost indicates that our protocol can be deployed for pervasive computing applications and mobile communications in practice.

Provably Secure Dynamic ID-Based Anonymous Two-Factor Authenticated Key Exchange Protocol With Extended Security Model

Recently, Mun et al. analyzed Wu et al.'s authentication scheme and proposed a enhanced anonymous authentication scheme for roaming service in global mobility networks. However, through careful analysis, we find that Mun et al.'s scheme is vulnerable to impersonation attacks, off-line password guessing attacks and insider attacks, and cannot provide user friendliness, user's anonymity, proper mutual authentication and local verification. To remedy these weaknesses, in this paper we propose a novel anonymous authentication scheme for roaming service in global mobility networks. Security and performance analyses show the proposed scheme is more suitable for the low-power and resource-limited mobile devices, and is secure against various attacks and has many excellent features.

A secure and effective anonymous authentication scheme for roaming service in global mobility networks

Recently, Mun et al. analyzed Wu et al.'s authentication scheme and proposed an enhanced anonymous authentication scheme for roaming service in global mobility networks. However, through careful analysis, we find that Mun et al.'s scheme is vulnerable to impersonation attacks and insider attacks, and cannot provide user friendliness, user's anonymity, proper mutual authentication and local verification. To remedy these weaknesses, we propose a novel anonymous authentication scheme for roaming service in global mobility networks. Compared with previous related works, our scheme has many advantages. Firstly, the secure authenticity of the scheme is formally validated by an useful formal model called BAN logic. Secondly, the scheme enjoys many important security attributes including prevention of various attacks, user anonymity, no verification table, local password verification and so on. Thirdly, the scheme does not use timestamp, thus it avoids the clock synchronization problem. Further, the scheme contains the authentication and establishment of session key scheme when mobile user is located in his/her home network, therefore it is more practical and universal for global mobility networks. Finally, performance and cost analysis show our scheme is more suitable for low-power and resource limited mobile devices and thus availability for real implementation.

A Secure and Effective Anonymous Authentication Scheme for Roaming Service in Global Mobility Networks

A multi-server authentication scheme enables a remote user to access the services provided by multiple servers after registering with the registration center. Recently, Pippal et al. (Wirel Pers Commun 2013, doi: 10.1007/s11277-013-1039-6 ) introduced a robust smart card authentication scheme for multi-server architecture. They also illustrated that their scheme could be free from potential network attacks, and validated the scheme by using BAN logic. In this paper, by presenting concrete attacks, we demonstrate that Pippal et al.'s scheme can not withstand off-line password guessing attacks, impersonation attacks and privileged insider attacks. Furthermore, to overcome these attacks, we propose an improved authentication scheme for multi-server architecture using smart card and password. Security and efficiency analysis indicates that our scheme not only actually achieves intended security goals (e.g., two-factor authentication, perfect forward secrecy etc.), but also is efficient enough to be implemented for practical applications.

Cryptanalysis and Improvement of a Robust Smart Card Authentication Scheme for Multi-server Architecture

Communication network has grown to the stage where it becomes ubiquitous. It allows us to access to on-line services at anytime, anywhere and by any devices. This brings out new services, that was previous only accessible via computers, now are available on mobile devices such as e-commerce applications. These applications require mobile users to be authenticated in order to use the services. In this paper, we proposed a novel authenticated key agreement scheme that allows users and servers mutually authenticate each other. Our scheme also conceals users' identities from adversaries; this is provided in initiator untraceability property of the scheme. Furthermore, the scheme has good computation cost as well as communication and storage costs; thus, the proposed scheme is suitable for the mobile devices.

Novel Untraceable Authenticated Key Agreement Protocol Suitable for Mobile Communication

Authentication and key agreement protocols are foundation for the security of distributed applications. In 2010, Yeh et al. proposed two authenticated key agreement protocols. The second protocol in Yeh et al. features useri¦s anonymity. However, we found that the second scheme is vulnerable to replay attack, masquerade attack, and off-line password attack. In this paper, we first analyze Yeh et al.i¦s security flaws, then, we propose a protocol that overcomes all the weaknesses of the aforementioned protocol.

A Robust and Efficient Smart Card Oriented Remote User Authentication Protocol

Authentication and key agreement protocols are the essential guardians of the distributed applications. They help the servers and users establish mutual trust and create secure communication channels. In this paper, we propose an authentication and key agreement scheme that is secure and has low communication and computation costs. Besides its efficiency, the most significant feature of the scheme is to provide initiator untraceability which completely conceals the users' identities from all eavesdropping adversaries. The scheme is suitable to be used in mobile services and e-commerce applications due to its low costs on communication and computation as well as its untraceability feature.

Ching-Hsiang Chang

Papers

Novel Untraceable Authenticated Key Agreement Protocol Suitable for Mobile Communication

A Robust and Efficient Smart Card Oriented Remote User Authentication Protocol

Mobile Friendly and Highly Efficient Remote User Authenticated Key Agreement Protocol Featuring Untraceability