Search

With the rapid development of mobile intelligent technologies and services, users can freely experience ubiquitous services in global mobility networks. It is necessary to provide authentications and protection to the privacy of mobile users. Until now, many authentication and privacy schemes were proposed. However, most of the schemes have been exposed to some security problems. Recently, Madhusudhan and Shashidhara (M&S) proposed a lightweight authentication scheme, denoted as the M&S scheme, for roaming services in global mobility networks. This paper shows that the M&S scheme has security flaws including two masquerading attacks and a mobile user trace attack. After that, we propose a privacypreserving authentication scheme for global mobility networks. The proposed scheme not only focused on the required security but also added privacy concerns focused on anonymity based on a dynamic pseudonym, which is based on exclusive-or operation, hash operation and symmetric key cryptography. Formal security analysis is performed based on Burrow-Abadi-Needdham (BAN) logic and the ProVerif tool, which concludes that the proposed scheme is secure. The analysis shows that the proposed authentication scheme is secure and provides privacy with a reasonable performance.

A secure data collection in wireless multimedia sensor networks (WMSNs) has given attention to one of security issues. WMSNs pose unique security challenges due to their inherent limitations in communication and computing, which makes vulnerable to various attacks. For the energy efficiency, WMSNs adopt mobile sinks to collect data from sensor nodes. Thus, how to gather data securely and efficiently is an important issue WMSNs. In this paper, we propose a secure energy efficient data collection scheme over WMSNs, which are based on Bilinear pairing and symmetric key cryptosystem. First of all, we devise a security model based on a hierarchical key structure for the security mechanisms, authentication, key agreement, confidentiality, and integrity. Based on the model, we propose a secure energy efficient data collection scheme, which could establish secure session in one round. The proposed scheme could efficiently remedy security and efficiency problems in the previous data collection schemes over WMSNs. It has only about 18% of overhead for the security but also has energy efficiency compared with the other related schemes.

To provide secure authentication for wireless body area networks (WBANs), recently Mtonga proposed a scheme based on identity-based cryptography, bilinear pairing and non-interactive identity-based key agreement scheme. He argued that his scheme provides authenticated key agreement, privacy preservation and authenticity, integrity and freshness of transmitted health messages. Unfortunately, this paper provides security remarks on Mtonga’s scheme focused on lack of integrity provision, lack of untraceability and masquerading attack feasibility. They are very important aspects in a system’s required security and privacy features. Furthermore, this paper provides simple directions of the counterpart’s solutions on them.

Recently, because the interest and needs in privacy protection are growing, smartcard-based remote user authentication schemes have been actively studied to provide the user anonymity. In 2008, Kim et al. first proposed an authentication scheme in order to ensure the user anonymity against both external attackers and the remote server and track malicious users with the help of a trusted trace sever. However, in 2010, Lee et al. showed that Kim et al.`s scheme cannot provide the user anonymity against remote server, which is because the server can trace users without any help of the trace server, and then proposed a improved scheme. On the other hand, in 2010, Horng et al. proposed an authentication scheme with non-tamper resistant smart cards, in which the non-tamper resistant smart card means that an attacker may find out secret information stored in the smart card through special data analysis techniques such as monitoring power consumption, to be secure against a variety of attacks and to provide the user anonymity against external attackers. In this paper, we will propose a remote user authentication scheme with non-tamper resistant smart cards not only to ensure the user anonymity against both external attackers and the remote server but also to track malicious users with only the help of a trusted trace sever.

In a paper recently published in the International Journal of Parallel, Emergent and Distributed Systems, Biswas et al. proposed a VANET message authentication scheme which uses an identity-based proxy signature mechanism as an underlying primitive. The authors claimed that their scheme supports various security features including the security of proxy-key, the security against message forgery and the security against replay attack, with non-repudiation and resistance to proxy-key compromise. Here, we show how an active attacker, who has no knowledge of an original message sender`s private key, can compute the proxy-signature key of the corresponding message sender, meaning that the scheme is completely insecure. We also suggest an enhanced version of the protocol capable of solving such serious security holes.

This paper proposes an efficient remote user authentication scheme using smart cards, which does not require password verification tables. To withstand message replay attacks, the proposed scheme uses random nonces in place of timestamps. So, it does not require synchronized clocks. In our scheme, users are able to freely choose and change their passwords. Moreover, the proposed protocol is very efficient in computation cost because the security only relies on one-way hash functions and provides mutual authentication between two entities.

So far, there have been several key agreement protocols for three-parties, in which two clients establish a common session key through a authentication server. Most of those protocols require to use server's public key to prevent password guessing attacks. However, because clients need to verify and safely keep the server's public key, the protocols may not be practical for some environments. This paper proposes a new efficient verifier-based key agreement protocol for three parties which does not require server's public key. The proposed protocol is resistant against various attacks and provides the perfect forward secrecy.

Recently, Lee and Lee showed that Hsu et al.'s authenticated key agreement scheme is vulnerable to the modification attack and then proposed an improved scheme. In this paper, we argue that the Lee and Lee's scheme cannot withstand the password guessing attack. Hence, we propose an improved scheme to solve this problem.

Recently, Hsu et al. showed that Ku and Wang's authenticated key agreement protocol is vulnerable to the modification attack and then proposed an improved protocol, called HWWM protocol. In this paper, we argue that the HWWM protocol is still vulnerable to the modification attack and cannot also withstand the password guessing attack. Then, we propose an improved protocol to solve these problems.

Recently, Lee et al. proposed an improved scheme, called LLH scheme, to solve a security problem of guessing attack in the Peyravian-Zunic password scheme. The scheme comprises a password authentication protocol and a password change protocol. However, we discuss that the LLH scheme has several security problems: the scheme is still vulnerable to the guessing attack; the scheme cannot also prevent the stolen-verifier attack; the password change protocol in scheme is vulnerable to a denial of service attack.

This paper proposes two ID-based password authentication schemes, which does not require a dictionary of passwords or verification tables, with smart card and fingerprint. In these schemes, users can change their passwords freely. For a network without synchronization clocks, the proposed nonce-based authentication scheme can withstand message replay attacks. The proposed two schemes require a system to authenticate each user by each user's knowledge, possession, and biometrics, and this feature makes our schemes more reliable.

How to provide both security and privacy in communication networks has been an important issue for ubiquitous computing. Especially, user authentication in the current IT services has become one of important security issues. However, the security weaknesses in the user authentication have been exposed seriously due to the careless secret related information management and the sophisticated attack techniques. Recently, an enhanced biometric-based user authentication protocol is proposed by An, which uses three factors, password, smart card and biometrics. However, this paper shows that An's protocol has weaknesses in the password guessing attack and the lack of privacy support if an attacker could get user's smart card, could read on it and could intercept session messages between user and server. Furthermore, this paper proposes a privacy preserving biometric-based user authentication protocol using smart card, which could solve the overall problems in An's protocol and even put privacy considerations on it. The overall security analyses show that the proposed protocol achieves the desired security goals

In 2000, Sun proposed an efficient remote user authentication scheme using smart cards. Later, Chien et al. pointed out that Sun's scheme does not provide the mutual authentication between the user and the server and allow users to freely choose password themselves. Chien et al. further proposed a new efficient and practical solution to solve the problems. However, Hsu showed that Chien et al.'s scheme is vulnerable to the parallel session attack. This paper proposes an improved scheme to overcome the weakness while maintaining the advantages of Chien et al.'s scheme.

Wireless sensor networks (WSNs) have a vast field of applications, including environment monitoring, battlefield surveillance and target tracking systems. As WSNs are usually deployed in remote or hostile environments and nodes are prone to compromise attacks, the adoption of key management is extremely important. Most queries in WSN applications are issued at the point of the base station or gateway node of the network. However, there is a great need to access the real-time data inside the network from the nodes because the real-time data may no longer be accessed through the base station only but also by the legal user with authority. To support the requirement, recently Das et al. proposed a dynamic password-based user authentication scheme for hierarchical WSNs. The purposes of this paper are to show Das et al.'s scheme has a security problem of password guessing attack with lost smart card and to provide a remedy for the scheme. For this, we will give a security analysis of Das et al.'s scheme focused on the offline password guessing attack with the assumption that the attacker could steal user's smart card and read the memory on it. Then, we will propose a user authentication scheme for hierarchical WSNs to solve the security problem in Das et al.'s scheme. Our scheme inherits the advantages from Das et al.'s scheme but solves the problems in it.

Home healthcare based on ubiquitous technology is emerging as a solution to increasing chronic disease patients with the advent of aging of society. While u-healthcare has the advantage that improves accessibility to medical services, it also increases the probability of the infringement of privacy of personal medical information, the leakage of which can do greater damage than any other information. Recently, Huang et al. proposed the identity authentication and context privacy preservation in wireless health monitoring system, which is based on identity-based cryptography and identity-based signature. The purpose of this paper is to review Huang et al.'s security scheme, analyze it focused on the security and privacy concerns, and provide directions to improve the scheme.

In 2000, since Hwang and Li proposed a remote user authentication scheme without password table using smart cards based on ID-based cryptosystems, the related works have been done. In 2002, Chien et al. proposed an efficient and practical remote user authentication scheme providing the many merits. However, Hsu showed that Chien et al.'s scheme is vulnerable to the parallel session attack. This paper proposes an improved scheme to overcome the weakness while maintaining the advantages of Chien et al.'s scheme.

Since the September 11 terrorist attacks in the United States, the necessity of utilizing smart container is becoming a significant to strengthen the container security and increase the efficiency of container transport for international cargo. Lauf and Sauff proposed MASC-ST protocol for securely transmitting sensitive information gathered from sensors equipped in the container to a trusted third party that controls access to this information. However, we show that the protocol has some weaknesses, which are able to cause serious problems for container transport if this protocol is directly adopted in real fields, and also present an improvement to overcome the weaknesses while preserving the merits of their scheme.

With the integration of wireless communication and pay-TV, mobile broadcast TV technologies have advanced noticeably in recent years. In 2011, Chen et al. proposed an efficient anonymous authentication protocol for mobile pay-TV and claimed that their protocol is secure and efficient. However, Kim showed that their protocol has weaknesses in password guessing attack and impersonation attack with the assumption that attacker could get user’s smart card. Thereby, this paper proposes an anonymous authentication protocol to solve the flaws in Chen et al.’s protocol.

Since 9.11 terror attack in the United States, the smart container has attracted the attention because of the efficiency and safety of container freight shipping. In 2007, Lauf and Sauff proposed MASC-ST protocol for securely transmitting sensitive information gathered from sensors equipped in the transport container to a trusted third party that controls access to this information. Recently, Lee showed that the protocol has some weaknesses and also presented an improvement to overcome the weaknesses while preserving the merits of their scheme. However, these protocols did not consider the anonymity of container. So, the transport route of containers can simply be tracked by malicious attackers. In this paper, we propose a secure transport container monitoring protocol that is resistant against various attacks and is able to guarantee the anonymity of the container.

In this paper, we present a new password-based authenticated key agreement protocol called PAKA, which provides mutual authentication and key agreement over an insecure channel between two parties knowing only a small password having low entropy. We then extend PAKA to a protocol called PAKA-X, in which the client uses a plaintext version of the password, while the server stores a verifier for the password, and which does not allow an adversary who compromises the server to impersonate a client without actually running a dictionary attack on the password file. The proposed protocols are secure against passive and active attacks and provide perfect forward secrecy.

In 2000, Hwang and Li proposed a new remote user authentication scheme using smart cards. However. Chan and Cheng showed that the scheme is vulnerable to the impersonation attack. Later, Shen et al. showed a different type of impersonation attack on the scheme and presented a modified scheme to withstand these attacks. Recently, Awasthi and LaI presented a remote user authentication scheme using smart cards with forward secrecy. In this paper, we show that the Awasthi and LaI's scheme is incorrect.