Nai-Wei Lo

Two robust remote user authentication protocols using smart cards

With the rapid growth of electronic commerce and enormous demand from variants of Internet based applications, strong privacy protection and robust system security have become essential requirements for an authentication scheme or universal access control mechanism. In order to reduce implementation complexity and achieve computation efficiency, design issues for efficient and secure password based remote user authentication scheme have been extensively investigated by research community in these two decades. Recently, two well-designed password based authentication schemes using smart cards are introduced by Hsiang and Shih (2009) and Wang et al. (2009), respectively. Hsiang et al. proposed a static ID based authentication protocol and Wang et al. presented a dynamic ID based authentication scheme. The authors of both schemes claimed that their protocol delivers important security features and system functionalities, such as mutual authentication, data security, no verification table implementation, freedom on password selection, resistance against ID-theft attack, replay attack and insider attack, as well as computation efficiency. However, these two schemes still have much space for security enhancement. In this paper, we first demonstrate a series of vulnerabilities on these two schemes. Then, two enhanced protocols with corresponding remedies are proposed to eliminate all identified security flaws in both schemes.

An efficient mutual authentication scheme for EPCglobal class-1 generation-2 RFID system

The nature of data security vulnerability and location privacy invasion of RFID systems have become a serious problem after hundreds of RFID application systems deployed all over the world. One of the promising solution directions is to provide an efficient authentication scheme with the compliance of international RFID standards such as EPCglobal, ISO18000-1 and ISO18000-6. In this study, we propose a novel authentication scheme for RFID systems with excellent data security properties, robust location privacy preservation and efficient data matching/retrieval mechanism. In addition, our scheme is compatible to EPCglobal Class-1 Generation-2 RFID standards because only simple cryptographic primitives such as pseudo-random number generator and cyclic redundancy check are required to be implemented in RFID tags.

A Privacy-Aware Authentication Scheme for Distributed Mobile Cloud Computing Services

In modern societies, the number of mobile users has dramatically risen in recent years. In this paper, an efficient authentication scheme for distributed mobile cloud computing services is proposed. The proposed scheme provides security and convenience for mobile users to access multiple mobile cloud computing services from multiple service providers using only a single private key. The security strength of the proposed scheme is based on bilinear pairing cryptosystem and dynamic nonce generation. In addition, the scheme supports mutual authentication, key exchange, user anonymity, and user untraceability. From system implementation point of view, verification tables are not required for the trusted smart card generator (SCG) service and cloud computing service providers when adopting the proposed scheme. In consequence, this scheme reduces the usage of memory spaces on these corresponding service providers. In one mobile user authentication session, only the targeted cloud service provider needs to interact with the service requestor (user). The trusted SCG serves as the secure key distributor for distributed cloud service providers and mobile clients. In the proposed scheme, the trusted SCG service is not involved in individual user authentication process. With this design, our scheme reduces authentication processing time required by communication and computation between cloud service providers and traditional trusted third party service. Formal security proof and performance analyses are conducted to show that the scheme is both secure and efficient.

Novel Anonymous Authentication Scheme Using Smart Cards

Smart card based authentication scheme has been widely utilized for various transaction-oriented services such as electronic currency exchange, social insurance payment and e-commerce payment charge in modern society. How to develop a smart card based authentication scheme to support initiator untraceability and defend against major security threats for a transaction service user has become a crucial topic for researchers. Recent efforts for developing anonymous authentication scheme with smart card have failed to provide initiator untraceability for user or been vulnerable to some security attacks. This paper first presents a security model for anonymous authentication and then proposes a new anonymous authentication scheme using smart card. Security robustness of the proposed scheme is constructed by one-way hash function and elliptic curve cryptosystem. Our security analysis shows that the proposed scheme achieves general security requirement and offers initiator untraceability for user without requiring database support. Performance analysis on communication overhead and computation cost shows that the proposed scheme has better or similar efficiency in comparison with other existing smart card based authentication schemes.

Anonymous Coexistence Proofs for RFID Tags

In a world with RFID carriers everywhere, the coexistence proof of multiple RFID-tagged objects shown at the same time and the same place can become a very useful mechanism and be adopted in many application areas such as computer forensics, evidences in law, valuables security, and warning or notification systems, etc. In order to support the correctness of derived proofs, it is necessary to design secure and robust coexistence proofs protocols based on RFID characteristics. In this paper we address the security and privacy requirements for a secure coexistence proofs protocol on RFID tags to defend against tag privacy divulgence, forward secrecy disclosure, denial-of-proof (DoP) attack, and authentication sequence disorder. Along with these design criterions, a recent published secure proofs protocol [11] is evaluated to identify the demand area for security enhancement. To overcome found security weaknesses, tag privacy divulgence and the new known DoP attack in previous proofs schemes, we introduce three anonymous coexistence proofs protocols. According to our security and performance analyses, the proposed protocols possess all required security properties with the same complexity order of the clumping-proofs protocol on computation cost.

Cryptanalysis of Hsiang-Shih's authentication scheme for multi-server architecture

From user point of view, password-based remote user authentication technique is one of the most convenient and easy-to-use mechanisms to provide necessary security on system access. As the number of computer crimes in modern cyberspace has increased dramatically, the robustness of password-based authentication schemes has been investigated by industries and organizations in recent years. In this paper, a well-designed password-based authentication protocol for multi-server communication environment, introduced by Hsiang and Shih, is evaluated. Our security analysis indicates that their scheme is insecure against session key disclosure, server spoofing attack, and replay attack and behavior denial. Copyright

Cryptanalysis of two three-party encrypted key exchange protocols

Due to the simplicity of maintaining human memorable passwords without any assistant storage device, password-based three-party encrypted key exchange (3PEKE) protocol has become one of the most promising research fields on user authentication and secure communication. In 2008, Chen et al. and Yoon and Yoo both pointed that Chang and Changs password-based 3PEKE scheme cannot resist against undetectable on-line password guessing attacks, and then respectively proposed an improved protocol to eliminate the security vulnerability. However, based on the security analyses conducted by us, we find that both of their protocols are still vulnerable against undetectable on-line password guessing attacks. Accordingly, we develop a novel 3PEKE protocol to remedy these authentication flaws. Moreover, our proposed protocol can achieve better performance efficiency by requiring only four message transmission rounds. In conclusion, we can claim that our proposed 3PEKE protocol is more secure and efficient in comparison with the protocols proposed by Chen et al. and Yoon and Yoo.

Weaknesses and improvements of an efficient certificateless signature scheme without using bilinear pairings

The certificateless signature CLS scheme is a special signature scheme that solves the key escrow problem in identity-based signature schemes. In CLS schemes, the private key is generated cooperatively by the key generator center KGC and signer, such that a malicious KGC cannot masquerade as the signer and sign a message. He et al. in 2011 proposed an efficient CLS scheme without using bilinear pairings. However, we discovered that the CLS scheme by He et al. cannot resist a strong type 2 adversary if this adversary replaces the master public key of the KGC. This work proposes an improved scheme that overcomes this weakness. Copyright

Secure Handover Authentication Protocol Based on Bilinear Pairings

Handover authentication protocol enables a mobile node to switch from one base station to another without loss or interruption of service when the node exits the transmission area of his or her current base station. This paper proposes a secure prime-order handover authentication protocol based on bilinear pairings. The proposed protocol adapts the concept of pseudonyms to provide user anonymity and user unlinkability. It withstands well-known security threats and achieves mutual authentication, user unlinkability. A batch signature verification mechanism to verify a mass of signatures is presented in our scheme. We also prove that our scheme is secure under random oracle.

A New Password-Based Multi-server Authentication Scheme Robust to Password Guessing Attacks

A multi-server authentication scheme is a useful authentication mechanism in which a remote user can access the services of multiple servers after registering with the registration center (RC). This study shows that the password-based multi-server authentication scheme proposed by Yeh and Lo is vulnerable to undetectable password-guessing attack and offline password-guessing attack. This study proposes a new password-based multi-server authentication scheme to overcome these vulnerabilities. The proposed protocol introduces a new mechanism for protecting user password. The RC sends an alternative key to help the server verify the legitimacy of user instead of the user’s password. The values of these keys are changed with a random large nonce in each session. Therefore, the password-guessing attack cannot work successfully on the proposed scheme.