Book review: Applied cryptography: Protocols, algorithms, and source code in C

A more efficient and secure ID-based remote mutual authentication with key agreement scheme for mobile devices on elliptic curve cryptosystem

With the popularity of computer network, smart card based remote user authentication is receiving more and more attention than ever. Recently, Liaw et al. proposed an efficient and complete remote user authentication scheme using smart cards. Its security depends on the one-way hash function and is nonce-based. They claim that it achieves more functionality and satisfies all criteria and can withstand the replay attack. Nevertheless, there still exist several security flaws in their scheme. In this paper, we give a cryptanalysis of the scheme and present that the scheme is vulnerable and insecure against at least four kinds of attack, including the offline password guessing attack, two impersonation attacks, the intruder-in-the-middle attack and the denial-of-service attack.

Cryptanalysis of a Remote User Authentication Scheme Using Smart Cards

It is provided that a security analysis on Liaw-Lin-Wu’s remote user authentication scheme. Our analysis shows the scheme is vulnerable to Man-inthe-middle attack. What’s more, there are obvious security vulnerabilities in it. An improved remote user authentication scheme based on Diffie-Hellman key exchange protocol is proposed. Analysis shows the scheme is secure not only to achieve mutual authentication, but also to generate a session key in the same time. It has overcome security deficiencies of Liaw-Lin-Wu’s scheme. It is efficient and practical.

Information Computing and Applications

With rapid growth of mobile wireless networks, handheld devices are popularly used by people and many mobile applications have been rapidly developed. Considering the limited computing capability of smart cards or mobile devices, the security scheme design suitable for these mobile devices is a nontrivial challenge. A user authentication scheme is a mechanism to authenticate a remote user over an open network. In 2006, Das et al. proposed an identity (ID)-based remote user authentication scheme with smart cards using bilinear pairings. Unfortunately, their scheme is insecure against forgery attack. Recently, Giri and Srivastava proposed an improved scheme to overcome the forgery attack. The computational cost required by the Giri-Srivastava scheme is expensive, especially for smart cards with limited computing capability. In addition, the Giri-Srivastava scheme is unable to be used for a multi-server environment. This paper presents an efficient and secure ID-based remote user authentication scheme using bilinear pairings. Based on the computational Diffie-Hellman assumption, we show that the proposed scheme is secure against existential forgery on adaptively chosen-message and ID attack in the random oracle model. As compared with the recently proposed pairing-based authentication schemes, our scheme has better performance in term of the computational cost and it is suitable for a multi-server environment in distributed networks. Performance analysis and experimental data of related pairing operations on smartcards are given to demonstrate that our scheme is well suited for mobile devices with limited computing capability.

/pdf/a-pairing-based-user-authentication-scheme-for-wireless-57ilhmwika.pdf

A Pairing-Based User Authentication Scheme for Wireless Clients with Smart Cards

An efficient and complete remote user authentication scheme using smart cards

A new electronic traveler's check scheme based on one-way hash function

The security threats related to personally identifiable information are increasing dramatically. In addition to government agencies, large international companies are potential victims. To comply with regulations such as the European Union General Data Protection Regulation, organizations are required to carry out a privacy impact assessment. However, the conventional information security risk assessment model does not provide a clear methodology for conducting privacy impact assessments. In this paper, we propose a privacy-considered information security risk assessment (pISRA) model, which can take both a privacy impact analysis and risk assessment into consideration. Our proposed model can help risk assessors achieve a comparable and reproducible approach for the entire risk assessment process. Additionally, pISRA can assist organizations to select high-risk items for further action.

pISRA: privacy considered information security risk assessment model

Through the rapid evolution of information technology, there are many innovative services and products bring a lot of convenience for people especially "Cloud Computing". The cloud computing provides users more than personal computer's storage resources and calculate ability. Nowadays the most consume hard drive space or calculate resources are belong to multimedia applications, such like HD videos, HD computer games and so on. Because of the reason of the requirement, the cloud computing technology also develop multimedia cloud. The multimedia cloud is evolved from media cloud and multimedia-aware cloud, combine with the highly calculate ability, high quality of service and virtually unlimited storage space. Users can put all the multimedia content or games into the multimedia cloud. But there is still a harassment, the "Information Security". Before users can use multimedia cloud, they must go through an insecure network environment between cloud services and user's equipment. Malicious attackers usually attack this insecure section to capture user's information. Besides the privacy of the user's data in the multimedia cloud is also a fatal reason that why users don't use this convenience and powerful service. In this article, we provide a smart card based secure authentication mechanism and a protect user's data authorization framework. We expect the framework can protect users' privacy and their data.

Wei-Chen Wu

Papers

An efficient and complete remote user authentication scheme using smart cards

A new electronic traveler's check scheme based on one-way hash function

pISRA: privacy considered information security risk assessment model

A secure smart card authentication and authorization framework using in multimedia cloud

Performance evaluation of the recommendation mechanism of information security risk identification