Search

Motivated by the great potential of implicit and seamless user authentication, we attempt to build an implicit authentication (IA) system with adaptive sampling that automatically selects dynamic sets of activities for user behavior extraction. Various activities, such as user location, application usage, user motion, and battery usage have been popular choices to generate behaviors, the soft biometrics, for implicit authentication. Unlike password-based or hard biometric-based authentication, implicit authentication does not require explicit user action or expensive hardware. However, user behaviors can change unpredictably which renders it more challenging to develop systems that depend on them. In addition to dynamic behavior extraction, the proposed implicit authentication system differs from the existing systems in terms of energy efficiency for battery-powered mobile devices. Since implicit authentication systems including the proposed one rely on machine learning, the expensive training process needs be outsourced to the remote server. However, mobile devices may not always have reliable network connections to send real-time data to the server for training. We overcome this limitation by proposing a W-layer, an overlay that provides a practical and energy-efficient solution for implicit authentication on mobile devices. We implemented partially labeled Dirichlet allocation (PLDA) on the server side for more accurate feature extraction, and achieved 93.3 percent precision and 98.6 percent accuracy in the synthetic dataset. Furthermore, we tested the power consumption of the smartphones used for our experiments and found that our method consumed 14.5 percent of the devices’ total battery usage.

With the globalization of semiconductor production, out-sourcing IC fabrication has become a trend in various aspects. This, however, introduces serious threats from the entire untrusted supply chain. To combat these threats, Defense Advanced Research Projects Agency (DARPA) proposed in 2014 the Supply Chain Hardware Integrity for Electronics Defense (SHIELD) program to design a secure hardware root-of-trust, called dielet, to be inserted into the host package of legitimately produced ICs. Dielets are RF powered and communicate with the outside world through their RF antennas. They have sensors which allow them to passively (without the need for power) record malicious events which can later be read out during an authentication protocol between the dielet and server with a smartphone as intermediary. This paper introduces a general framework for the initialization and authentication protocols in SHIELD with different adversarial models based on formally-defined security games. We introduce a “try-and-check” attack against DARPA's example authentication protocol in their call for SHIELD proposals which nullifies the effectiveness of SHIELD's main goal of being able to detect and trace adversarial activities with significant probability. We introduce the first concrete initialization protocol and, compared to DARPA's example authentication protocol, introduce an improved authentication protocol which resists the try-and-check attack. The area overhead of our authentication and initialization protocols together is only 64-bit NVM, one 8-bit counter and a TRNG based on a single SRAM-cell together with corresponding control logic. Our findings and rigorous analysis are of utmost importance for the teams which received DARPA's funding for implementing SHIELD.

The emergence and ubiquity of mobile computing has placed powerful capabilities in one's hand providing a wide range of applications such as email, calendar, photos, browsers, social network, communication, shopping, health and fitness, games etc., which were once restricted to traditional platforms. Such applications on a single mobile device raise critical security issues related to managing identity, re-authenticating users that stay active for long periods of time, protecting sensitive PII and PHI against access and misuse, insuring secure transactions, and protecting the physical device. This chapter explores user authentication requirements for mobile computing by: evaluating alternative user authentication requirements in order to make recommendations on their usage in authentication; identifying authentication methods used in mobile healthcare applications; and proposing a set of requirements for user authentication to handle the situation when a user seeks to be securely authenticated across a set of applications that are placed into context within a framework.

We propose a new authentication factor based on network round trip time ( $\rm {NRTT}$ ). We show how $\rm {NRTT}$ can be used to uniquely and securely identify login locations and hence can support location-based web authentication mechanisms. The first research challenge is how to securely measure and verify $\rm {NRTT}$ to hamper potential forgery attempts. We address the first challenge by introducing a novel forwarding device in the path between the server and the client, dubbed delay mask (DM), which prevents any entity, but the server, from being able to measure the $\rm {NRTT}$ for any client. The second research challenge is how to reliably measure $\rm {NRTT}$ in the face of variable Internet latencies and connectivity conditions. The second challenge is addressed by: first, computing the average of a number of $\rm {NRTT}$ measurements after outlier removal; and second, applying multiple profiles per user through the deployment of multiple DMs in diverse geographical locations. We design a two-factor authentication scheme (dubbed AMAN) that uses legacy passwords as a first factor and $\rm {NRTT}$ as a second authentication factor. We conduct extensive experiments to evaluate security-usability-deployability properties of AMAN and compare it with the state-of-the-art authentication mechanisms. The results show that AMAN achieves the best combination of these properties.

Multi-server environment is the most common scenario for a large number of enterprise class applications. In this environment, user registration at each server is not recommended. Using multi-server authentication architecture, user can manage authentication to various servers using single identity and password. We introduce a new authentication scheme for multi-server environments using Chebyshev chaotic map. In our scheme, we use the Chebyshev chaotic map and biometric verification along with password verification for authorization and access to various application servers. The proposed scheme is light-weight compared to other related schemes. We only use the Chebyshev chaotic map, cryptographic hash function and symmetric key encryption-decryption in the proposed scheme. Our scheme provides strong authentication, and also supports biometrics & password change phase by a legitimate user at any time locally, and dynamic server addition phase. We perform the formal security verification using the broadly-accepted Automated Validation of Internet Security Protocols and Applications (AVISPA) tool to show that the presented scheme is secure. In addition, we use the formal security analysis using the Burrows-Abadi-Needham (BAN) logic along with random oracle models and prove that our scheme is secure against different known attacks. High security and significantly low computation and communication costs make our scheme is very suitable for multi-server environments as compared to other existing related schemes.

Due to the ease of use, face authentication could be a promising way to replace hard-to-remember passwords to access web services. However, to make face authentication suitable for web services, there are still several critical security and privacy challenges unaddressed. First, the existing authentication servers typically collect the plaintext of users' facial images in order to conduct authentication. If the servers are compromised, the attackers would obtain the users' facial images and can easily impersonate the users in any other applications that use face authentication. Second, it is also hard to prevent attackers from using facial images published in social network sites to impersonate the true user. In this paper, we conquered these two issues by proposing a novel secure face authentication system, called UFace. UFace uses special close-up facial images (which cannot be found online) for authentication. To further ensure the confidentiality of these close-up images, UFace guarantees that these images are only stored at user side and the servers have not any plaintext of these images. The face authentication is conducted securely with two collaborative authentication servers. UFace was implemented through both an Android application and multiple server side programs which were then evaluated in a real setting. The experimental results demonstrate that the UFace system can accurately authenticate users within a few seconds.

Vehicle-to-Grid (V2G) systems promoted by the federated Internet of Things (IoT) technology will be ubiquitous in the future; therefore, it is crucial to provide trusted, flexible and efficient operations for V2G services using high-quality measures for security and privacy. These can be achieved by access and authority authentication. This paper presents a lightweight protocol for capacity-based security access authentication named A c c e s s A u t h . Considering the overload probability and system capacity constraints of the V2G network domain, as well as the mobility of electric vehicles, the ideal number of admissible access requests is first calculated adaptively for each V2G network domain to actively achieve capacity-based access admission control. Subsequently, to provide mutual authentication and maintain the data privacy of admitted sessions, by considering whether there is prior knowledge of the trust relationship between the relevant V2G network domains, a high-level authentication model with specific authentication procedures is presented to enforce strict access authentication such that the sessions are conducted only by authorized requesters. Additionally, efficient session revocation with forward security and session recovery with no extra authentication delay are also discussed. Finally, analytical and evaluation results are presented to demonstrate the performance of A c c e s s A u t h .

The distributed environment insists the protection of servers, while information sharing is achieved. The conventional biometrics-based password authentication mechanisms use single server, which can be compromised easily. The dual stage authentication mechanism has been already proved for its security over the single stage authentication mechanism in our previous work. In this paper, the protocol is improved to establish communication between the authentication server and the master server through a secure link. Since the hashed messages are prone to collision attacks, the proposed scheme uses elliptic curve cryptography-based ciphers for establishing connection at the initial stage. The security analysis of the proposed authentication scheme with secure server – server communication link reveals the robustness and the security features, which are offered over our previous as well as the conventional authentication mechanisms. Keywords: Authentication, Security, Server, Biometric, Protocol

Recently, Tsai and Lo proposed a privacy aware authentication scheme for distributed mobile cloud computing services. It is claimed that the scheme achieves mutual authentication and withstands all major security threats. However, we first identify that their scheme fails to achieve mutual authentication, because it is vulnerable to the service provider impersonation attack. Beside this major defect, it also suffers from some minor design flaws, including the problem of biometrics misuse, wrong password, and fingerprint login, no user revocation facility when the smart card is lost/stolen. Some suggestions are provided to avoid these design flaws in the future design of authentication schemes.

Context There are many techniques for performing authentication, such as text passwords and biometrics. Combining two factors into one technique is known as multi-factor authentication. The lack of a proper method for comparing and selecting these techniques for their implementation in software development processes is observed. Objective The article presents a recommendation Framework proposal for comparing and selecting authentication techniques in a software development process. Method Knowledge from academy is obtained through a systematic literature review and experience from industry is gathered using a survey and interviews. The results of these two techniques are used to generate a Framework proposal, which is validated afterwards, through an expert panel and the case study method. Results A recommendation Framework is generated, which recommends the most appropriate authentication schemes and methods for software applications based on criteria identified in literature and industry, categorized by usability, security and costs, plus the context for which the application is intended. The Framework's validity is ascertained by confirming that its recommendations are on line with those on industry, based in the results from the developed case studies. A tool prototype was created in order to help using the Framework in software development processes. Conclusion The proposed Framework helps to cover the observed gap in literature, helping software developers to compare and select the most appropriate authentication techniques for their applications.

Vehicular ad-hoc networks (VANETs) have been researched with regard to enhance driver’s safety and comfort. In VANETs, all vehicles share their status and road conditions with neighboring nodes by periodically generating safety messages. To provide reliable VANET services, message authentication is an important feature. In particular, anonymous message authentication has attracted considerable interest, because periodic broadcast messages from a vehicle can be used to track its location. Unfortunately, previously proposed anonymous message authentication protocols had serious practical shortcomings, including high communication, authentication, and revocation costs, as well as reliability issues. Thus, in this paper, we propose an anonymous authentication protocol based on a cooperative authentication method. The proposed method does not require mode synchronization between cooperative and non-cooperative authentication. In addition, we design a two-layer pseudo-identity generation method and construct a key update tree for efficient revocation. Simulations show that our protocol does not result in packet losses caused by authentication overheads, even when the vehicle density is 200/km2.

The mobile networks are experiencing a growing success. This success is mainly due to the fact that these networks providing the mobility of users, the transmission of data through open air and the requirement of low power. But, it is threatened by weak security, especially at the level of authentication. Hwang and Su have proposed an efficient authentication protocol for mobile networks. This protocol, called Hwang-Su here, is based on the use of one-way hash function, symmetric key cryptosystem and nonce. Hwang-Su protocol consists of two sub-protocols, named intra-domain authentication and inter-domain authentication. If the user and the service provider registered in the same domain, we would use intra-domain authentication protocol. Otherwise, we would initiate inter-domain authentication protocol. In this article, we show that both sub-protocols are not secured. Indeed, any legitimate user can abuse of these rights to attack them. We also propose improvements to increase its security.Keywords: Authentication, Mobile communication, Cryptography, Security

Nowadays, the technology of Internet of Things (IoT) is getting more and more important which brings a lot of convenience to people’s life and city’s development. As a key application of IoT, wireless body area networks (WBANs) provides people high quality of life and high level of medical service. However, due to the sensitiveness of medical system, security and privacy issues in WBANs are very important. In previous research, there are no comprehensive authentication protocols designed for WBANs according to its characteristics of network structure. In this paper, we propose an efficient multilayer authentication protocol and a secure session key generation method for WBANs. Firstly, we design a one-to-many group authentication protocol and a group key establishment algorithm between personal digital assistance (PDA) and each of sensor nodes with energy efficiency and low computational cost. Then, we present a new certificateless authentication protocol with no pairings based on certificateless cryptography between PDA and application provider (AP), using ECC algorithm that provides low computational cost with high security. In addition, the validation of the proposed protocol can be proved. Finally, the security and performance analysis shows that our protocol is secure and efficient.

Along with the development of user-centric wireless communications, wearable devices appear to be popular for real-time collecting a users private data to provide intelligent service support. Compared with traditional short-range communications, the wearable devices confront more severe system vulnerabilities and security threats during interactions. Considering the limitations of computational capabilities and communication resources, it brings more challenges to design privacy-preserving authentication schemes for the resource-constrained wearable devices. In this work, local authentication and remote authentication are respectively designed for cloud assisted wearable devices. In the local authentication mode, hash based selective disclosure mechanism and Chebyshev chaotic map are jointly applied to achieve mutual authentication between a wearable device and a smart phone. In the remote authentication mode, Merkle hash tree based selective disclosure mechanism is designed to improve the structure of data fields in the certificate, and a yoking-proof is established to realize interactions between two wearable devices and a smart phone, and is further transmitted to the cloud server for simultaneous verification. Meanwhile, security formal analysis is performed based on the BAN logic for proving that the proposed remote authentication protocol has theoretical design correctness. It indicates that the proposed authentication scheme is available and flexible for ubiquitous wearable devices. Both local and remote authentication modes are considered for cloud assisted wearable devices.Selective disclosure mechanism and Chebyshev chaotic map are applied to achieve authentication.Yoking-proofs are established for simultaneous verification in a remote authentication mode.

In recent years, the internet of things has been widely utilized in various fields, such as in smart factories or connected cars. As its domain of application has expanded, it has begun to be employed using multi-server architectures for a more efficient use of resources. However, because users wishing to receive IoT(Internet of Things) services connect to multi-servers over wireless networks, this can expose systems to various attacks and result in serious security risks. To protect systems (and users) from potential security vulnerabilities, a secure authentication technology is necessary. In this paper, we propose a smart card-based authentication protocol, which performs the authentication for each entity by allowing users to go through the authentication process using a smart card transmitted from an authentication server, and to login to a server connected to the IoT. Furthermore, the security of our proposed authentication protocol is verified by simulating a formal verification scenario using AVISPA(Automated Validation of Internet Security Protocols and Applications), a security protocol-verification tool.

Wireless sensor networks (WSNs) have been widely used, most notably in real-time traffic monitoring and military sensing and tracking. However, WSN applications could suffer from threats and endanger the applications if the suitable security issues are not taken into consideration. As a result, user authentication is an important concern to protect data access from unauthorized users. This paper presents a lightweight mutual authentication protocol for WSN applications. Instead of traditionally using a hash function for data protection, one of the interesting aspects of this protocol is that, for the purpose of data protection but with a low computational cost, the proposed key encryption function only requires simple exclusive- or ( xor ) arithmetic operations. Moreover, the corresponding hardware architecture was implemented by using an Altera DE2 board, including an Altera Cyclone II field-programmable gate array (FPGA). Finally, the output waveforms from the FPGA were displayed on the 16702A logic analysis system for real-time verification.

In current times, multimedia application includes integrated sensors, mobile networks and Internet-of-Things (IoT) services. In IoT services, if more devices are connected without much constrains, the problem of security, trust and privacy remain a challenge. For multimedia communications through Wireless Sensor Network (WSN), sensor nodes transmit confidential data to the gateway nodes via public channels. In such an environment, the security remains a serious issue from past many years. Only few works are available to support secure multimedia communications performed in IoT-enabled WSNs. Among the few works, Kumari and Om recently proposed an authentication protocol for multimedia communications in IoT-enabled WSNs, which is applicable in coal mine for safety monitoring. The authors claimed in their work that their contributory protocol strongly withstands several security threats such as, user impersonation attack, sensor node impersonation attack, sensor node anonymity issue and others technical design issues. However, this article proved that Kumari and Om’s protocol has some design flaws and is susceptible to various security attacks including, user and sensor node impersonation attacks. As a remedy, a robust authentication protocol using smartcard is constructed to solve the security issues found in Kumari and Om’s protocol. The proof of correctness of mutual authentication is performed using the BAN logic model. In addition, our further security investigation claimed strong protection against known security attacks. Our protocol is analyzed comprehensively and compared against the similar protocols and the results showed that it is efficient and robust than earlier protocols.

Advances in lattice-based cryptography are enabling the use of public key algorithms (PKAs) in power-constrained ad hoc and sensor network devices. Unfortunately, while many wireless networks are dominated by group communications, PKAs are inherently unicast—i.e., public/private key pairs are generated by data destinations. To fully realize public key cryptography in these networks, lightweight PKAs should be augmented with energy efficient mechanisms for group key agreement. Recently, many key management schemes for the WSNs have been proposed, but the computation and communication costs of these protocols are too high to suitable for WSNs. This paper proposes a key establish protocol for the WSNs based on combined key. The protocol adopts seed key mapping technology to achieve two-party and multi-party key establish in the WSNs, it can generate a large number of combination keys with little resources. So it effectively solve the contradiction between the sensor nodes need large storage space to store shared key with their neighbors and their limited storage space. It can also achieve mutual authentication between nodes when they establish shared key. Analysis shows that the proposed protocol has the advantages in storage efficiency, computation consumption and Communication consumption and suitable for wireless networks.

In wireless networks, seamless roaming allows a mobile user (MU) to utilize its services through a foreign server (FS) when outside his home server (HS). However, security and efficiency of the aut...

Mobile cloud computing (MCC) is an increasingly popular research topic, partly due to the widespread adoption of mobile devices and cloud services among individual and organizational users. Security and privacy of data-at-rest and data-in-transit are two of several key issues that need to be addressed. Traditional authentication models employ third-party security monitoring mechanisms, which generally require complicated and resource-intensive mechanisms for ensuring security measures. These mechanisms are not adaptive for MCC deployment; thus, it requires lightweight authentication methods. This paper reviews existing port-knocking authentication methods by analyzing the mechanism and classifying the methods into a thematic taxonomy. Current port-knocking authentication methods are compared based on static or dynamic knocked sequences, which tend to solve the Network Address Translation (NAT) knock and Denial of Service (DoS) knock attacks. Finally, we discuss the issues and challenges in implementing port-knocking for MCC.

Roaming of mobile nodes among multiple access points should be secure and efficient. Hand-over occurs when a mobile node migrates from one access point to another and establishes a new connection by terminating the previous one. However, designing an appropriate hand-over authentication protocol is a complex task because the processing efficiency and power of mobile node is restricted to a certain extent. The lesser security level and higher computation complexity are the main issues of the existing hand-off authentication protocols. To overcome these problems, Elliptic Curve RSA is proposed with modification in the initialization and authentication phases of the hand-off authentication protocol. The result of the proposed work shows the improvement in higher security level along with lesser computational cost. Further, the proposed algorithm is performing well against the various possible attacks.

Wireless sensor networks described as an emerging new technology with a very promising future. Advances made in wireless sensor networks (WSNs) are the merging of advanced electronic and wireless technologies. Due to the popularity gained by the wireless environment, Security is the main concern. Node authentication without compromising lifespan of the networks is practically a daunting task. This research work introduces a new model, IBE-ECC that administers the energy of sensor nodes with faster authentication process. Signature verification model is deployed to achieve faster authentication process. Nevertheless, the public key-based strategies eliminate the security process but their verification process takes larger time. Therefore, authentication speed is a major constraint of our research endeavor. The proposed scheme is design to achieve high security and fast authentication with energy efficiency. It uses identity-based encryption on elliptic curve cryptography and a user authentication with an energy efficient key management. Further, to improve the speed of the authentication, it reduces the signature size so that it would accelerate signature verification faster. Hence, the proposed scheme will provide a secure key management, energy efficiency, fast authentication and additionally, computation overhead and communication costs are minimized. Finally, the experimental result demonstrates that the proposed strategy obtains 4797 ms higher execution efficiency and 45. 53% lower computation costs than existing schemes.

Wearable health monitoring systems (WHMSs) will play an increasingly important role in future e-healthcare and enable smart and ubiquitous healthcare services. Given its sensitivity, the health data should be protected against unauthorized access. As a result, it is critical to design an end-to-end mutual authentication protocol that enables secure communication between the wearable sensor and medical professionals. Recently, Amin et al. proposed an anonymity preserving mutual authentication protocol for WHMSs. However, we identify that their protocol suffers from stolen mobile device attack, desynchronization attack, and sensor key exposure. Then we put forward an improved end-to-end authentication protocol based on quadratic residues. Comprehensive security analysis is conducted to show that the proposed protocol fixes these flaws of Amin et al.’s protocol and satisfies all desired requirements. The comparison with these existing protocols demonstrates that our protocol provides a practical end-to-end security solution for WHMSs.

The essential security mechanism in wireless sensor networks (WSNs) is authentication, where nodes can authenticate each other before transmitting a valid data to a sink. There are a number of public key authentication procedures available for WSN in recent years. Due to constraints in WSN environment there is a need for light-weight authentication procedure that consumes less power during computation. This proposed work aims at developing a light-weight authentication protocol using MBLAKE2b with elliptic curve digital signature algorithm (ECDSA). The proposed protocol is also tested using the protocol verification tool Scyther and found to be secure in all claims and roles. This proposed algorithm increases the network life time and reduces the computation time, which is essential for the constrained environment like WSNs.

Multi-receiver authentication plays an important role in network security. Many researchers have studied the constructions and the properties of the multi-receiver authentication scheme. However, most of these schemes treat the capability of all the receivers equally. In practice, receivers may have different other than equal powers in many cases. The authors consider the new scenario in the multi-receiver authentication. The authors propose a multi-receiver authentication scheme with hierarchical structure among the receivers. The authors construct an unconditionally secure multi-receiver authentication code by using the Birkhoff interpolation. The authentication scheme is also able to send multiple messages.

— Lightweight authentication is a branch of the modern authentication techniques, which intended to be used in constraints network such IoT and WSN which has devices with low or extremely low resources. There are several ways for designing a lightweight authentication protocol, researchers are competing to find the best ways that fit with the features of the Internet of Things. In this paper, we propose generalized approaches to design lightweight authentication protocols. Also, we highlight some principals and security requirements for the implementation of lightweight authentication. Finally, we provide a comparative study of using symmetric and asymmetric cryptography techniques for designing lightweight authentication protocols for IoT.

Cloud computing is a contemporary prototype to deliver services over the Internet. Cloud security is the most crucial issue in a cloud atmosphere either it is public cloud or community cloud. There is a vast scope to scrutinize data security enhancement in cloud storage. Authentication is anessential technology for information security, which is a mechanism to confirm proof of identities to obtain access of information in the system.Conventionally used authentication methods are rather securing data, but not smart enough and completely secured.In this paper, we have implemented a novel verification technique that associate with static username and password as a way in authentication followed by OTP based on the token generator method along with a digital signature and image captcha is an innovative factor to verify an each user. The solution aims at gaining confidentiality and integrity by making use of CP-ABHE (Ciphertext Policy-Attribute based Homomorphic Encryption algorithm) and user verification with Multi-Factor Authentication.Finally the efficiency of the system is examined with the help of the experimental results and discussions.

In this work, a specific case-study of the development of a biometric authentication system for mobile clients (iPads) has been reported. The case-study addresses specific questions involving the technologies used, and provides a comparison of various products offered or developed by different vendors to implement such a system. We believe this work will help both researchers and developers who want to develop and experiment with similar biometric authentication systems—a form of multi-factor authentication gradually gaining usage.

The Session Initiation Protocol (SIP) is a communication protocol that controls multimedia communication sessions. As the Internet users widely use SIP services, mutual authentication between the user and SIP server becomes an important issue. Several authentication protocols for SIP have been proposed for enhancing security and better complexities. Very recently, Lu et al. proposes an authenticated key agreement protocol for SIP and claims that it withstands various attacks and efficient. This paper points out that their protocol does not provide one of the most important features user anonymity. In addition, the same protocol is not able to resist user impersonation attack, server impersonation attack and fails to provide mutual authentication. The paper also presents an improved mutual authentication and key establishment protocol that conquers the security weaknesses in Lu et al.’s protocol. Informal security analysis is also carried out for several security properties. The formal proof for the correctness of mutual authentication and session key agreement is provided using BAN logic. It is shown that the proposed protocol is provably secure against identity and password guessing attacks in the random oracle model. The performance of the proposed scheme is compared with that of the existing related Elliptic Curve Cryptography (ECC) based schemes for SIP and shown that our scheme outperforms the others.

In wireless communication system, a good protocol should satisfy many requirements: user identity authentication, privacy protection, computational efficiency and resist some known attacks. Thus design a highly secure anonymous authentication protocols for wireless networks is a challenging task. Over recent years, many researchers have proposed their own solutions to address this issue. In 2014, Niu et al. analyzed Yoon et al.’s authentication scheme, then put forward a smart card based authentication scheme with anonymity for wireless networks. They claimed their scheme achieves many security requirements and resists some known threats. Nevertheless, after detailed analysis, we prove that the scheme of Niu et al. is prone to some malicious attacks such as replay attacks and DoS attacks. Moreover, the scheme does not work when large amount of mobile users access a foreign agent simultaneously. To overcome these drawbacks, we present a new secure authentication scheme with user anonymity by improving Niu et al.’s scheme. The proposed protocol not only satisfies many security properties, such as strong anonymity, mutual authentication and periodically update session key, but also resists well-known threats. Furthermore, the security and performance analyses indicates that the new scheme is well suitable for wireless communications when it is compared with previous protocols.

Storage services are among the primary cloud computing offerings, providing advantages of scale, cost and availability to its customers. However, studies and past experiences show that large-scale storage service can be unreliable, and vulnerable to various internal and external threats that cause loss and/or corruption of customer data. In this work, we present a query authentication scheme for cloud-based storage system where the data is populated by multiple sources and retrieved by the clients. The system allows clients to verify the authenticity and integrity of the retrieved data in a scalable and efficient way, without requiring implicit trust on the storage service provider. The proposed mechanism is based on our recently proposed multi-trapdoor hash functions, using its properties to achieve near constant communication and computation overhead for authenticating query responses, regardless of the data size, or the number of sources. We develop a discrete log-based instantiation of the scheme and evaluate its security and performance. Our security analysis shows that forging the individual or aggregate authentication tags is infeasible under the discrete log assumption. Our performance evaluation demonstrates that the proposed scheme achieves superior efficiency and scalability compared to existing query authentication schemes offering support for multiple sources.

Most physical-layer authentication techniques use hypothesis tests to compare the radio channel information with the channel record of Alice to detect spoofer Eve in wireless networks. However, the test threshold in the hypothesis test is not always available, especially in dynamic networks. In this letter, we propose a physical-layer authentication scheme based on extreme learning machine that exploit multi-dimensional characters of radio channels and use the training data generated from the spoofing model to improve the spoofing detection accuracy. Simulation results show that our proposed technique can significantly improve the authentication accuracy compared with the state-of-the-art method.

Sensor nodes once deployed onto the field are mostly provided with little or no attention making them prone to physical attacks by adversaries. Various security frameworks have been proposed to mitigate tampering; others also ensure authentication of sensor nodes. Energy is a limited resource and as such, the need to develop energy efficient frameworks that ensure authentication and thwart tampering of deployed sensor nodes. In this study, a framework comprising an authentication algorithm with a hardware-based tamper detection and recovery procedure is proposed. An interrupt-driven tamper detection and recovery mechanism is employed to aid the isolation of compromised nodes. MD-5, SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512 hash functions were reviewed and simulation done to select the most energy-efficient option (SHA-224) for use with the authentication algorithm. The proposed framework was compared with other existing authentication frameworks in the area of energy efficiency. The result show that the proposed framework is the most energy-efficient. The proposed framework, TinySec, SenSec and MiniSec were analysed against node subversion and false node attacks; the proposed framework can detect compromised nodes in all two attacks but the rest were only potent against false nodes and not against node subversion.

A data structure to enhance PKI (Public Key Infrastructure) authentication is proposed.With the data structure, the PKI authentication server can distinguish the execution environment of PKI authentication.The proposal covers all of the use cases of private key, activated with passphrase or biometrics, generated with biometrics. In this paper, a data structure to enhance PKI (Public Key Infrastructure) authentication is proposed generalizing the concept of ISO/IEC 24761. Current technologies do not provide sufficient information on products which are used in the authentication process at the Claimant to the Verifier. As a result, the Verifier cannot sufficiently distinguish the authentication result executed with a trusted product from that without a trusted product. The difference is made clear if evidence data of the execution of authentication process at the Claimant are generated by the trusted product and used for verification by the Verifier. Data structure for such data is proposed in this paper as client Authentication Context (cAC) instance. Relation to other works and extension of the proposal where biometrics is used are also described for further improvement of PKI authentication. For this proposal to realize, standardization activities are to be considered as the next steps.

Knowledge-based authentication methods have become increasingly popular, where they started as simple passwords, before evolving into static questions for fallback authentication and graphical password-based systems. Question-based authentication methods are typically based on static or slowly changing data sources, thereby making them vulnerable to eavesdropping, wiretapping, and other types of attacks. Thus, an alternative approach is needed to create an authentication challenge that could compete with other authentication factors: hardware tokens and biometrics. In this study, we propose a new authentication approach that exploits the user behavior patterns captured in non-public data sources to create unique, one-time challenges. We propose: (i) a model that is capable of representing user behavior patterns in a wide range of user activities captured from various data sources and (ii) a method for creating unique one-time challenges based on the model. We tested the model and the method based on multiple non-public data sources such as bank transactions, phone logs, computer usage data, and e-mail correspondence. We also demonstrated its efficacy with a live user pool. Security analysis indicated the full resilience of the proposed method against eavesdropping as well as its adaptability in response to guessing attacks by dynamically increasing the complexity of the challenge.

Radio-frequency identification (RFID) technologies are making their way into retail products, library books, debit cards, passports, driver licenses, car plates, medical devices, and so on. The widespread use of tags in traditional ways of deployment raises a privacy concern: they make their carriers trackable. To protect the privacy of the tag carriers, we need to invent new mechanisms that keep the usefulness of tags while doing so anonymously. Many tag applications, such as toll payment, require authentication. This paper studies the problem of anonymous authentication. Since low-cost tags have extremely limited hardware resource, we propose an asymmetric design principle that pushes most complexity to more powerful RFID readers. With this principle, we develop a lightweight technique that generates dynamic tokens for anonymous authentication. Instead of implementing complicated and hardware-intensive cryptographic hash functions, our authentication protocol only requires tags to perform several simple and hardware-efficient operations such as bitwise XOR, one-bit left circular shift, and bit flip. The theoretical analysis and randomness tests demonstrate that our protocol can ensure the privacy of the tags. Moreover, our protocol reduces the communication overhead and online computation overhead to $O(1)$ per authentication for both tags and readers, which compares favorably with the prior art.

Wireless sensor networks (WSNs) comprise of distributed sensors. The collected information available at the sensor is provided to the users who are permitted to get access. The information is transmitted in internet of things (IOT) environment, which can be eavesdrop. Thus, it is essential to ensure that only authorized shareholders can access the transmitted information. Authentication and key agreement protocols are developed to ensure confidentiality and security in IOT. We design a biometric based authentication and key agreement protocol for WSNs. To analyze the security of the proposed protocol, we use formal security proof, which shows that an attacker has a negligible probability of breaking the protocol security. We also use the BAN logic technique to show the correctness of mutual authentication. Additionally, we adopt an informal analysis to discuss the resistance of proposed scheme against various possible attacks on authentication protocols. Additionally, through the comparison of computational efficiency and security attributes with recent results, proposed protocol seems to be more appropriate for WSNs.

This paper focuses on continuous user authentication based on its interaction with the device. Behavioral authentication provides the ability to partially abandon passwords. Furthermore, the use of human behavior, for example, how he holds the device in hand, interacts with a screen, as a means of authentication is sufficiently protected from compromise, since an attacker cannot make an exact copy your gait or motion. Use of auxiliary factors such as the proximity of the trusted peripheral device, Wi-Fi network, location, helps simplify authentication.

The deployment of sensor networks for security and safety related environments requires securing communication primitives such as broadcast, multicast, and point to point communication. Security services are vital for ensuring the integrity, authenticity, and confidentiality of the critical information. Therefore, the authentication mechanisms are required to support these security services and to be resilient to distinct attacks. Recent research shows that two-way authentication provides better security and high energy saving for wireless sensor networks (WSN). In this work, we investigate a shared authentication protocol for WSNs using bilinear mapping function. Many one-way broadcast authentication protocol proposed such as Timed Efficient Stream Loss-Tolerant Authentication (TESLA), Bin and Balls Authentication (BiBA), etc., which cannot provide energy efficient authentication. Here, we propose a two-way authentication based on bilinear map function and used in secure group formation algorithm. The performance metrics such as message cost, computation and communication overhead are calculated.