Search

Remote data backup technology avoids the risk of data loss and tampering, and has higher security compared to local data backup solutions. However, the data transmission channel for remote data backup is not secure, and the backup server cannot be fully trusted, so users usually encrypt the data before uploading it to the remote server. As a result, how to protect this encryption key is crucial. We design a User-Centric Design (UCD) data backup scheme based on multi-factor authentication to protect this encryption key. Our scheme utilizes a secret sharing scheme to divide the encryption key into three parts, which are stored in the laptop, the smart card, and the server. The encryption key can be easily reconstructed from any two parts with user's private information password, identity and biometrics. As long as the biometrics has enough entropy, our scheme can resist replay attacks, impersonation user attacks, impersonation server attacks, malicious servers and offline password guessing attacks. [ABSTRACT FROM AUTHOR]

Nowadays, smart card and password-based user authentication and key agreement schemes have become an integral mechanism to ensure only legitimate users get access to the data of wireless sensor networks (WSNs). In the recent past, lots of password-based multi-factor user authentication schemes have been developed by the researchers. However, most of them are not secure against various known attacks. Recently, two user authentication and key agreement schemes for WSNs are suggested by Chen and Chen (J Supercomput 77(12):13653–13675, 2021) and Qi and Chen (J Supercomput 77(12):13897–13910, 2021). They claim that their schemes are secure against all known attacks. We analyze the security of these schemes and demonstrate that these schemes are not secure against some common attacks (such as smart card lost attack) and do not provide common security features such as user untraceability and forward secrecy. By keeping all the merits of these schemes, we suggest a new provably secure user authentication and key agreement scheme using physically unclonable functions and elliptic curve cryptography. To verify the security and authentication properties of the suggested scheme, we use the well-known Proverif tool for formal security verification. We further prove its security informally. Finally, performance comparison with some recent schemes in terms of security features and computational cost is performed. Performance comparison results show the superiority of the suggested scheme over the existing schemes. [ABSTRACT FROM AUTHOR]

The emerging cloud infrastructure has escalated number of servers offering flexible and diverse remote services through public channels. However, user authentication in conventional single-server architecture necessitates multiple smart cards maintenance and passwords memorization to access different cloud servers. To address this limitation, researchers devised authentication protocols for multi-server architecture that offers scalable platform wherein users can access multiple servers with single registration. The multi-factor authentication protocols leverage biometric keys to bind users' physical characteristics with their identity, offering higher security than two-factor authentication protocols. However, the existing protocols for multi-server architecture are prone to replay, user impersonation, denial of service, server spoofing attacks and lack security functionalities such as user anonymity and untraceability, backward and forward secrecy, and session key security. Moreover, the incorporation of registration center (RC) to authenticate each pair of user-server in multi-server architecture can lead to computational bottleneck and single-point failure issues on RC. To overcome these security loopholes, we design a novel provably secure multi-factor elliptic curve cryptography (ECC) based authentication protocol for multi-server architecture with offline RC for cloud environment. The formal security analysis under widely accepted real-or-random (ROR) model and informal security analysis of proposed protocol demonstrate provision of security functionalities and resilience against potential security attacks. Furthermore, we adopt Scyther security verification tool to verify our protocol's correctness and security properties. The performance evaluation demonstrates that our protocol offers robust security functionalities with reasonable communication and computation overheads than state-of-the-art protocols. [ABSTRACT FROM AUTHOR]

A Two-Factor Authentication (2FA) scheme can authenticate a client if the client is able to provide the possession factor (like biometric feature, smart card) and the knowledge factor (like password, secret key) simultaneously. With only one factor, it is hard for an adversary to impersonate the client to pass the authentication, and thus 2FA provides better security than single-factor authentication schemes. However, as far as we know, all existing 2FA schemes do not consider the leakage of server's database, and their authenticity may fail when the database is also compromised (in addition to one factor). Considering numerous reports of database leakage in the real world, it seems imminent to study and design 2FA schemes resilient to database leakage. In this paper, we formalize security models for 2FA schemes by taking database leakage into account. Our security models consider malicious adversaries who can obtain both the client's one authentication factor and the server's database, and have two requirements, authenticity and zero-knowledge. Authenticity ensures that such malicious adversaries cannot impersonate the client to pass the authentication, while zero-knowledge guarantees that such malicious adversaries obtain no information about the client's the other factor. Zero-knowledge is especially important for biometric features (like faces, fingerprints), which are inherent to human beings and can hardly be changed. Then we propose a biometric-based 2FA scheme with biometric feature and secret key serving as the two authentication factors. Our 2FA scheme has three rounds, and we prove its authenticity and zero-knowledge under database leakage in the random oracle model. Notably, our construction makes a novel use of a recent technical advance called robust property-preserving hashing (Boyle et al., ITCS 2019) together with fully homomorphic encryption, to recognize or discern clients by their biometric samplings in a homomorphic and secure way. [ABSTRACT FROM AUTHOR]