Password-based authentication schemes are the most widely used techniques for remote user authentication. Many static ID-based remote user authentication schemes both with and without smart cards have been proposed. Most of the schemes do not allow the users to choose and change their passwords, and maintain a verifier table to verify the validity of the user login. In this paper we present a dynamic ID-based remote user authentication scheme using smart cards. Our scheme allows the users to choose and change their passwords freely, and do not maintain any verifier table. The scheme is secure against ID-theft, and can resist the reply attacks, forgery attacks, guessing attacks, insider attacks and stolen verifier attacks.

A dynamic ID-based remote user authentication scheme

A secure dynamic ID based remote user authentication scheme for multi-server environment

Improvement of the secure dynamic ID based remote user authentication scheme for multi-server environment

Recently, Chien et al. proposed an efficient remote authentication scheme using smart cards. However, we find that their scheme is vulnerable to a reflection attack and an insider attack. In addition, their scheme lacks reparability. Herein, we first show the weaknesses of Chien et al.'s scheme, and then propose an improved scheme with better security strength.

Weaknesses and improvements of an efficient password based remote user authentication scheme using smart cards

http://msn.iecs.fcu.edu.tw/report/data/ori_paper/2006-6-22/a password authentication scheme over insecure networks .pdf

A password authentication scheme over insecure networks

Hwang and Li (see IEEE Trans. Consumer Electron., vol.46, no.1, p.28-30, 2000) proposed a new remote authentication scheme using smart cards. Their scheme is based on the ElGamal's public key cryptosystem. However, Chan and Cheng (see IEEE Trans. Consumer Electron., vol.46, p.992-993, 2000) pointed out that the scheme is vulnerable to the masquerade attack. In this article, we show a different attack on Hwang-Li scheme which is easier and simpler. Furthermore, we present an enhanced scheme for repairing the above attacks.

A modified remote user authentication scheme using smart cards

Refereed papers: Security enhancement for the timestamp-based password authentication scheme using smart cards

Due to the advances made in Information and Communication Technologies (ICT), e-Government users can easily use the available services from places and at time that are convenient to them through WWW browsers. To easily and securely provide the required services through Information Technology (IT) has been an important issue in e-Government. In this article, the authors propose an explicit classification of e-Government applications and some challenges and ob- stacles in e-Government considered from four perspectives. Finally, a comprehensive view of some critical success factors in e-Government is proposed.

/pdf/challenges-in-e-government-and-security-of-information-1pg5ywb89p.pdf

Challenges in E-Government and Security of Information

In 2001, Lin et al. proposed an optimal strong-password authentication protocol called the OSAP protocol. However, Chen and Ku pointed out that it is vulnerable to the stolen-verifier attack. In this paper, we shall propose an improved version of the OSAP protocol to enhance the security.

Security enhancement for Optimal Strong-Password Authentication protocol

In this paper, we propose an extended chaotic maps-based keyword search scheme over encrypted data resist outside and inside keyword guessing attacks in cloud storage services, which achieves the essential requirements of a secure cloud storage service. A secure cloud storage service has to satisfy five security requirements: consistency, ciphertext indistinguishability, trapdoor indistinguishability and resist off-line keyword guessing attacks (including off-line outside keyword guessing attack and off-line inside keyword guessing attack). Moreover, due to the characteristics of extended chaotic maps and session key establishment, which allow two communication parties to agree a common session key and the agreed session key is only known by the data sender and the authorized data receiver. Therefore, in this paper, we integrated the concept of session key establishment and extended chaotic maps into our proposed scheme which aims to resist the off-line keyword guessing attacks not only from the outside cloud attackers but also from an inside malicious cloud server. To the best of our knowledge, none of the recently proposed secure keyword search schemes can resist inside keyword guessing attacks and this work is the first attempt to provide a secure keyword search scheme without inside keyword guessing attacks in cloud storage services.

Jau-Ji Shen

Papers

A modified remote user authentication scheme using smart cards

Refereed papers: Security enhancement for the timestamp-based password authentication scheme using smart cards

Challenges in E-Government and Security of Information

Security enhancement for Optimal Strong-Password Authentication protocol

An extended chaotic maps-based keyword search scheme over encrypted data resist outside and inside keyword guessing attacks in cloud storage services