Search

Remote data backup technology avoids the risk of data loss and tampering, and has higher security compared to local data backup solutions. However, the data transmission channel for remote data backup is not secure, and the backup server cannot be fully trusted, so users usually encrypt the data before uploading it to the remote server. As a result, how to protect this encryption key is crucial. We design a User-Centric Design (UCD) data backup scheme based on multi-factor authentication to protect this encryption key. Our scheme utilizes a secret sharing scheme to divide the encryption key into three parts, which are stored in the laptop, the smart card, and the server. The encryption key can be easily reconstructed from any two parts with user's private information password, identity and biometrics. As long as the biometrics has enough entropy, our scheme can resist replay attacks, impersonation user attacks, impersonation server attacks, malicious servers and offline password guessing attacks. [ABSTRACT FROM AUTHOR]

Nowadays, smart card and password-based user authentication and key agreement schemes have become an integral mechanism to ensure only legitimate users get access to the data of wireless sensor networks (WSNs). In the recent past, lots of password-based multi-factor user authentication schemes have been developed by the researchers. However, most of them are not secure against various known attacks. Recently, two user authentication and key agreement schemes for WSNs are suggested by Chen and Chen (J Supercomput 77(12):13653–13675, 2021) and Qi and Chen (J Supercomput 77(12):13897–13910, 2021). They claim that their schemes are secure against all known attacks. We analyze the security of these schemes and demonstrate that these schemes are not secure against some common attacks (such as smart card lost attack) and do not provide common security features such as user untraceability and forward secrecy. By keeping all the merits of these schemes, we suggest a new provably secure user authentication and key agreement scheme using physically unclonable functions and elliptic curve cryptography. To verify the security and authentication properties of the suggested scheme, we use the well-known Proverif tool for formal security verification. We further prove its security informally. Finally, performance comparison with some recent schemes in terms of security features and computational cost is performed. Performance comparison results show the superiority of the suggested scheme over the existing schemes. [ABSTRACT FROM AUTHOR]

The emerging cloud infrastructure has escalated number of servers offering flexible and diverse remote services through public channels. However, user authentication in conventional single-server architecture necessitates multiple smart cards maintenance and passwords memorization to access different cloud servers. To address this limitation, researchers devised authentication protocols for multi-server architecture that offers scalable platform wherein users can access multiple servers with single registration. The multi-factor authentication protocols leverage biometric keys to bind users' physical characteristics with their identity, offering higher security than two-factor authentication protocols. However, the existing protocols for multi-server architecture are prone to replay, user impersonation, denial of service, server spoofing attacks and lack security functionalities such as user anonymity and untraceability, backward and forward secrecy, and session key security. Moreover, the incorporation of registration center (RC) to authenticate each pair of user-server in multi-server architecture can lead to computational bottleneck and single-point failure issues on RC. To overcome these security loopholes, we design a novel provably secure multi-factor elliptic curve cryptography (ECC) based authentication protocol for multi-server architecture with offline RC for cloud environment. The formal security analysis under widely accepted real-or-random (ROR) model and informal security analysis of proposed protocol demonstrate provision of security functionalities and resilience against potential security attacks. Furthermore, we adopt Scyther security verification tool to verify our protocol's correctness and security properties. The performance evaluation demonstrates that our protocol offers robust security functionalities with reasonable communication and computation overheads than state-of-the-art protocols. [ABSTRACT FROM AUTHOR]

With the rapid development of Internet of Things (IoT), designing a secure two-factor authentication scheme for IoT is becoming increasingly demanding. Two-factor protocols are deployed to achieve a higher security level than single-factor protocols. Given the resource constraints of IoT devices, other factors such as biometrics are ruled out as additional authentication factors due to their large overhead. Smart cards are also prone to side-channel attacks. Therefore, historical big data have gained interest recently as a novel authentication factor in IoT. In this paper, we show that existing big data-based schemes fail to achieve their claimed security properties such as perfect forward secrecy (PFS), key compromise impersonation (KCI) resilience, and server compromise impersonation (SCI) resilience. Assuming a real strong attacker rather than a weak one, we show that previous schemes not only fail to provide KCI and SCI but also do not provide real two-factor security and revocability and suffer inside attack. Then, we propose our novel scheme which can indeed provide real two-factor security, PFS, KCI, and inside attack resilience and revocability of the client. Furthermore, our performance analysis shows that our scheme has reduced modular exponentiation operation and multiplication for both the client and the server compared to Liu et al.'s scheme which reduces the execution time by one third for security levels of λ = 128. Moreover, in order to cope with the potential threat of quantum computers, we suggest using lightweight XMSS signature schemes which provide the desired security properties with λ = 128 bit postquantum security. Finally, we prove the security of our proposed scheme formally using both the real-or-random model and the ProVerif analysis tool. [ABSTRACT FROM AUTHOR]

Telecare medical information system (TMIS) is used to connect patients and doctors who are at a different location from each other. The authentication of the user and system is very crucial as the medical data of the user is stored on the server. Many systems have been developed in order to achieve this goal. We show some vulnerabilities of existing systems in this paper. We then propose a secure authentication mechanism to achieve the same goal. Machine learning and the nonce-based system is used for authentication of the entity and to prove the freshness of transmitted messages. Smart card blocking mechanisms have been included in each phase of the proposed system to prevent unauthorized access of data. The proposed system has been evaluated formally with the AVISPA tool. Then the proposed model has also been checked against different attacks and evaluated for different functionalities. We provide relative analysis with some recently proposed models and show our proposed system is relatively more efficient and secure. [ABSTRACT FROM AUTHOR]

The healthcare ecosystem is migrating from legacy systems to the Internet of Things (IoT), resulting in a digital environment. This transformation has increased importance on demanding both secure and usable user authentication methods. Recently, a post-quantum fuzzy commitment scheme (PQFC) has been constructed as a reliable and efficient method of biometric template protection. This paper presents a new two-factor-based user authentication protocol for the IoT-enabled healthcare ecosystem in post-quantum computing environments using the PQFC scheme. The proposed protocol is proved to be secure using random oracle model. Furthermore, the functionality and security of the proposed protocol are analyzed, showing that memoryless-effortless, user anonymity, mutual authentication, and resistance to biometric templates tampering and stolen attacks, stolen smart card attack, privileged interior attack are fulfilled. The costs of storage requirement, computation, communication and storage are estimated. The results demonstrate that the proposed protocol is more efficient than Mukherjee et al., Chaudhary et al., and Gupta et al. protocols. [ABSTRACT FROM AUTHOR]

Multi-factor authentication is a promising way to enhance the security of password-based authenticated key exchange (PAKE) schemes. It is widely deployed in various daily applications for mobile devices (e.g., e-Bank, smart home, and cloud services) to provide the first line of defense for system security. However, despite intensive research, how to design a secure and efficient multi-factor authentication scheme is still a challenging problem. Hundreds of new schemes have been successfully proposed, and many are even equipped with a formal security proof. However, most of them have been shortly found to be insecure and cannot achieve the claimed security goals. Now a paradox arises: How can a multi-factor scheme that was “formally proven secure” later be found insecure? To answer this seemingly contradicting question, this paper takes a substantial first step towards systematically exploring the security proof failures in multi-factor authentication schemes for mobile devices. We first investigate the root causes of the “provable security” failure in vulnerable multi-factor authentication schemes under the random oracle model, and classify them into eight different types in terms of the five steps of conducting a formal security proof. Then, we elaborate on each type of these eight proof failures by examining three typical vulnerable protocols, and suggest corresponding countermeasures. Finally, we conduct a large-scale comparative measurement of 70 representative multi-factor authentication schemes under our extended evaluation criteria. The schemes we select range from 2009 to 2022, and the comparison results suggest that understanding failures in formal security proofs is helpful to design more secure multi-factor authentication protocols for mobile devices. [ABSTRACT FROM AUTHOR]

Today, many users' extensive use of the Internet of Things (IoT) has made authentication an inevitable issue in the IoT. The currently existing authentication methods are subjected to many challenges by various factors such as the limited resources, the lack of authorization, and the need for a light-weighted authentication process. Therefore, it is essential to provide a security framework and protect the users' privacy at the lowest cost. This paper proposes a three-factor-based authentication scheme, called defense-in-depth, for the IoT environments on the blockchain platform. The proposed protocol applies mutual authentication with user authorization using smart card registration on a private blockchain without the need for a trustable server. The use of Elliptic-Curve Cryptography (ECC) and the analysis of the security of the proposed protocol using AVISPA tool, formal/informal security analysis altogether indicate that the proposed scheme is more secure and efficient in terms of computational and communications costs. • We have proposed a three-factor authentication protocol in IoT. • We have used a private blockchain to improve the security and transparency. • The proposed protocol is characterized by some security requirements. • The proposed protocol has been compared with other relevant protocols. [ABSTRACT FROM AUTHOR]

In order to equip the technical fraternity with smart technologies, the past few years have witnessed increasing usage of Cyber-Physical Systems (CPS) in different critical infrastructures. The abrupt surge in the advancement of CPS has brought in several cybersecurity issues. To address the issue of cybersecurity and to protect the CPS from attackers, authentication schemes have been designed and implemented. One such authentication scheme is two-factor authentication (2FA) which is considered to be a straightforward and coherent authentication mechanism that ensures secure communication in an unprotected network environment. Over the past few decades, several 2FA schemes using smart card have been proposed by Wang et al., Wang et al., WenLis et al., Chou et al., Ans et al., and Chang et al. with each scheme trying to overcome the shortcomings of the previous schemes. Subsequently, S.Kumari et al. pointed out the various loopholes of the previous schemes and proposed a new scheme on 2FA that was asserted to be both secure and efficient. In this article, we have explained how the different 2FA schemes as proposed in the previous papers are susceptible to various security attacks. Later on, an effective and user-friendly 2FA scheme is proposed in this article which can be implemented on CPS. The proposed scheme works on the principles of bilinear pairing and can overcome the loopholes of the previously proposed schemes. As a proof of our claim, the security analysis of the proposed scheme against all the common attacks has also been done in detail. The comparison of the security analysis and performance of the proposed scheme with the previous schemes has also been carried out in this paper. [ABSTRACT FROM AUTHOR]

Due to the infrastructure provided by the GLOobal MObility NETwork, mobile users are able to access many network services anytime and anywhere, even in a roaming environment. Although, a strong authentication scheme with sufficient security requirements is necessary while accessing such services. Recently, Gope et al. discussed a symmetric key based authentication protocol in this regard. However, we find that their protocol exhibits various shortfalls like privileged insider attack, offline password guessing attack, stolen smart card attack, session key compromised attack, unverified login phase, imperfect forward secrecy, improper mutual authentication, excessive database maintenance cost, synchronization problem and no password changing phase. In this article, we put forward a certificate-less anonymous two-factor authentication protocol based on Elliptic Curve Cryptography (ECC). We use BAN logic for formal verification of the protocol. Moreover, the robustness of the protocol under several security attacks is ensured using AVISPA tool-based automated security validation. The proposed protocol can provide increased security and design properties than many other recently existing schemes. [ABSTRACT FROM AUTHOR]

Because sensor nodes are deployed in public areas, these sensors are easy to capture by adversaries. Once a sensor is stolen, the sensitive information stored in it is likely to be exposed. Accordingly, designing a secure authentication protocol should consider this issue. Sadri et al. recently proposed a two-factor authentication protocol with anonymity for wireless sensor networks. Unfortunately, we found that their protocol had a design flaw in the user and sensor authentication phase. Besides, their protocol can not resist stolen smart card attacks, sensor capture attacks, and user impersonation attacks. In addition, their protocol does not provide perfect forward security. This paper proposes a provably secure authentication to overcome these weaknesses and flaws. By comparing the security and performance of the proposed protocol with other related protocols, we find that our work has reasonable computation overhead and better security. [ABSTRACT FROM AUTHOR]

With the expansion of the Industrial Internet of Things (IIoT), real-time data collected by smart sensors deployed in factories are shared over open channels , which may cause unauthorized access of transmitted messages by adversaries, thus causing the problem of privacy leakage. User authentication is the first line of defense for security protection in the IIoT environment. In this paper, we propose a cloud—assisted authentication scheme based on Chebyshev polynomial encryption, in which only authorized users can access the sensing devices in the Internet of Things (IoT) to obtain real-time data. The scheme uses fuzzy extraction technology to verify biometric characteristics. There are three factors to verify the user's login request: the smart card, password and the user's personal biometrics. The commonly adopted formal security analysis, the ROR model, is applied to prove the semantic security of session key, and a detailed informal security analysis is performed to show that the proposed scheme can withstand multiple known attacks. Compared with other related user authentication schemes, the proposed scheme provides several extra functionality features, including offline sensor node registration, updating user passwords and biometrics, adding new sensor node deployment, user anonymity and untraceability. In addition, the cost of computation, communication and security is compared with similar schemes, and results show that our scheme has more security performance while the cost is acceptable. [ABSTRACT FROM AUTHOR]

In a multi-sever scenario, a two-party remote user authentication scheme is faced with various kinds of security threats. The introduction of biometric technology can effectively improve the security on the user side and the resistance to password guessing attack. Therefore, many biometrics-based user authentication schemes have emerged in the last few years. However, in some recent authentication schemes, a server can easily impersonate a legal user by using the shared secret key and a randomly selected identity. In this study, we first analyze a study of these schemes and indicate the security weakness and vulnerability that might allow attacks. Then, we present an improved biometrics-based three-factor authentication scheme for multi-server environments that inherits most of the advantages of the original scheme and introduces digital signature to address the common security problem. Furthermore, the proposed scheme also has a simplified the authentication procedure and improves execution efficiency. Analysis results, including security analysis and performance comparison, indicate that the new scheme has good efficiency and is robust against various known attacks. [ABSTRACT FROM AUTHOR]

A Two-Factor Authentication (2FA) scheme can authenticate a client if the client is able to provide the possession factor (like biometric feature, smart card) and the knowledge factor (like password, secret key) simultaneously. With only one factor, it is hard for an adversary to impersonate the client to pass the authentication, and thus 2FA provides better security than single-factor authentication schemes. However, as far as we know, all existing 2FA schemes do not consider the leakage of server's database, and their authenticity may fail when the database is also compromised (in addition to one factor). Considering numerous reports of database leakage in the real world, it seems imminent to study and design 2FA schemes resilient to database leakage. In this paper, we formalize security models for 2FA schemes by taking database leakage into account. Our security models consider malicious adversaries who can obtain both the client's one authentication factor and the server's database, and have two requirements, authenticity and zero-knowledge. Authenticity ensures that such malicious adversaries cannot impersonate the client to pass the authentication, while zero-knowledge guarantees that such malicious adversaries obtain no information about the client's the other factor. Zero-knowledge is especially important for biometric features (like faces, fingerprints), which are inherent to human beings and can hardly be changed. Then we propose a biometric-based 2FA scheme with biometric feature and secret key serving as the two authentication factors. Our 2FA scheme has three rounds, and we prove its authenticity and zero-knowledge under database leakage in the random oracle model. Notably, our construction makes a novel use of a recent technical advance called robust property-preserving hashing (Boyle et al., ITCS 2019) together with fully homomorphic encryption, to recognize or discern clients by their biometric samplings in a homomorphic and secure way. [ABSTRACT FROM AUTHOR]

Various IoT-based applications such as smart home, intelligent medical, and VANETs have been put into practical utilization. The smart home is one of the most concerned environments, allowing users to access and control smart devices via the public network remotely. The smart home can provide many intelligent services for users through these smart devices. To securely access devices and obtain collected data over the public network, multifactor authentication protocols for smart home have gained wide attention. However, most of these protocols cannot withstand impersonation attack, smart device lost attack, privileged-insider attack, smart card lost attack, and so on. Besides, high communication and computational costs weaken the system performance, which leads to most authentication protocols are not suitable for resource-constrained smart devices. To mitigate the aforementioned drawbacks, we proposed a PUF-assisted lightweight group authentication and key agreement protocol to implement secure access to multiple devices in the smart home simultaneously using the Chinese Remainder Theorem and secret sharing technique. Our protocol also utilizes physical unclonable function (PUF) and fuzzy extractor technique to extract the digital fingerprint of the smart devices, which can uniquely validate smart devices and protect the secrets stored in their memory. Our protocol can support various security features and withstand the many well-known attacks in the smart home. The performance analysis indicates that the proposed protocol can efficiently reduce communication/computational costs when the user simultaneously accesses multiple devices. [ABSTRACT FROM AUTHOR]

With the recent tremendous growth in technology, the Internet of Things (IoT) Telecare Medicine Information System (TMIS) is the most widely used medical information system with prominent achievements. Authentication schemes, which use Smart cards, offer the best solution for TMIS applications that in turn provide efficiency and security. Furthermore, authentication schemes that combine passwords and smart cards are considered to be an effective solution for the two-factor authentication scheme. Such schemes contribute to high security along with the public-key cryptosystem. In this research work, a two-factor authentication technique that is both efficient and secure, which makes use of Elliptic Curve Cryptography (ECC) with smart cards, has been proposed. Here, we have used the fundamental assumptions of strong and collision free cryptographic Hash function and Elliptic Curve arithmetic. The proposed authentication technique protects user privacy by allowing registered users to change their passwords without revealing their identity to the server. The proposed authentication scheme has been subjected to formal and informal security investigations. In terms of efficiency and performance, the proposed two-factor authentication technique was compared with the existing relevant two-factor authentication schemes based on ECC. This scheme satisfies the two-factor authentication scheme's basic security standards. [ABSTRACT FROM AUTHOR]

The password-based authentication mechanism is considered as the oldest and the most used method. It is easy to implement, and it does not require any particular configuration or devices. Yet, this solution does not ensure a high level of security when it is used in a large and remote environment such as cloud computing. In such an environment, the cloud user and the authentication remote server use an insecure communication channel to authenticate each other. Consequently, various attacks such as insider attack, password-guessing attack, user impersonation attack, and others can be launched. Smart cards are an alternative to improve this single authentication model by strengthening security and improving the communication process. In our work, we study the Huang et al. proposal. The authors have proposed a smart card-based authentication and key agreement scheme. They have used the elliptic curve to improve security. However, same related work shows that this solution does not resist to impersonation attacks and does not ensure perfect anonymity. Consequently, it does not protect users' privacy. Thus, we propose an extension of the Huang et al. scheme in order to enforce security requirements. We implement an anonymous, mutual, and secure two-factor authentication and key agreement scheme applied to the cloud computing environment. We use elliptic curve cryptography and a fuzzy verifier to strengthen security. The solution is lightweight and optimizes performance. To prove the safety of the proposed protocol, formal security analysis with random oracle model and Scyther tool is provided. To evaluate its efficiency, a performance evaluation is prepared. [ABSTRACT FROM AUTHOR]

With Wireless Sensor Networks(WSNs) rapid development, it is a hot topic that designing a secure and effective authentication protocol to guarantee the safety of WSNs. Many two-factor multi-gateway authentication protocols have been proposed for WSNs. However, almost all the known protocols were found insecure. Especially, all the existing two-factor multi-gateway authentication protocols cannot resist the password and identity(ID) guessing together with the smart card loss attack. We present a novel two-factor multi-gateway authentication protocol based on password and smart card in multi-gateway wireless sensor networks in this paper. Thanks to "fuzzy-verifier" and "honeywords" technique, the new protocol can effectively resist the joint password and identity guessing with the smart card loss attack. In addition, key negotiation is based on discrete elliptic curve encryption, which ensures forward security of the protocol and resists sensor capture attack. Subsequently, we use BAN-logic to ensure the authentication is implemented, and the session key is negotiated. Moreover, a formal security proof of the new protocol based on the game sequence is conducted in Random Oracle model (RO model). Finally, we compare our work with other schemes in the same field in terms of security, communication efficiency and computational efficiency. [ABSTRACT FROM AUTHOR]

With the rapid development of network communication technology, identity authentication based on smart cards is one of the most common two-factor authentication schemes. In some real-world applications, timeliness is another challenge besides security and privacy because of the frequent logon and logoff or data updating. Presently, two-factor authentication schemes based on elliptic curve cryptography (ECC) are efficient. They are based on asymmetric encryption algorithms. But the time efficiency can be improved by hash-based methods, such as Negative databases (NDB) inspired by the artificial immune system. A one-time password authentication scheme based on NDB s is efficient, but it does not achieve the functions of mutual authentication and password changing, nor resists stolen-verifier attacks. In this paper, we propose an efficient two-factor authentication scheme based on NDB s. With this scheme, the password changing function is achieved, and the properties of uncertain form of negative databases can reduce the frequency of data updating. As the proposed scheme is a hash function based one, it has fewer calculation steps and higher time efficiency, compared with the authentication schemes based on asymmetric encryption algorithms such as ECC. This scheme also resists the majority of attacking behaviours, such as password-guessing attacks and man-in-the-middle attacks. Experimental results verify the time efficiency of this proposed scheme, and its security is analysed as well. [ABSTRACT FROM AUTHOR]

Currently, password-based remote authentication mechanism has become an essential procedure to ensure users access the resources of the cloud server securely. Dozens of password-based multi-factor authentication schemes have been successively proposed recently. Unfortunately, most of them are vulnerable to various known attacks. The key to designing a secure and privacy-preserving authentication scheme is drawing some lessons from the security failures of existing schemes. In this work, we investigate three anonymous multi-factor authentication schemes based on passwords for cloud environments (i.e., Karuppiah et al.'s scheme at MONET'19, Lin's scheme at IEEE Syst J'19, Rajamanickam et al.'s scheme at IEEE Syst J'20), and demonstrate that these three schemes all suffer from off-line guessing attacks and are short of an important property (i.e., forward secrecy). We also propose several effective countermeasures to remedy these weaknesses. Our analysis shows that none of these three protocols can achieve their security goals. Furthermore, we make a summary of the causes of the flaws, and reveal that the vulnerabilities of these schemes are caused by violating the basic design principles for a secure protocol (e.g., Ma et al.'s principles at IJCS'14). In addition, we investigate whether dozens of recently proposed schemes follow the design principles of Ma et al.. [ABSTRACT FROM AUTHOR]