Security Analysis of a Biometric-Based User Authentication Scheme
1
조회
0
다운로드
4
인용
0
참고문헌
키워드
초록
Password-based authentication using smart card provides two factor authentications,namely a successful login requires the client to have a valid smart card and a correctpassword. While it provides stronger security guarantees than only password authentication,it could also fail if both authentication factors are compromised ((1) the user’s smart cardwas stolen and (2) the user’s password was exposed). In this case, there is no way toprevent the adversary from impersonating the user. Now, the new technology of biometricsis becoming a popular method for designing a more secure authentication scheme. In termsof physiological and behavior human characteristics, biometric information is used as a formof authentication factor. Biometric information, such as fingerprints, faces, voice, irises, handgeometry, and palmprints can be used to verify their identities. In this article, we review thebiometric-based authentication scheme by Cheng et al. and provide a security analysis on thescheme. Our analysis shows that Cheng et al.’s scheme does not guarantee any kind ofauthentication, either server-to-user authentication or user-to-server authentication. Thecontribution of the current work is to demonstrate these by mounting two attacks, a serverimpersonation attack and a user impersonation attack, on Cheng et al.’s scheme. In addition,we propose the enhanced authentication scheme that eliminates the security vulnerabilities ofCheng et al.’s scheme.
Abstract
Password-based authentication using smart card provides two factor authentications,namely a successful login requires the client to have a valid smart card and a correctpassword. While it provides stronger security guarantees than only password authentication,it could also fail if both authentication factors are compromised ((1) the user’s smart cardwas stolen and (2) the user’s password was exposed). In this case, there is no way toprevent the adversary from impersonating the user. Now, the new technology of biometricsis becoming a popular method for designing a more secure authentication scheme. In termsof physiological and behavior human characteristics, biometric information is used as a formof authentication factor. Biometric information, such as fingerprints, faces, voice, irises, handgeometry, and palmprints can be used to verify their identities. In this article, we review thebiometric-based authentication scheme by Cheng et al. and provide a security analysis on thescheme. Our analysis shows that Cheng et al.’s scheme does not guarantee any kind ofauthentication, either server-to-user authentication or user-to-server authentication. Thecontribution of the current work is to demonstrate these by mounting two attacks, a serverimpersonation attack and a user impersonation attack, on Cheng et al.’s scheme. In addition,we propose the enhanced authentication scheme that eliminates the security vulnerabilities ofCheng et al.’s scheme.
참고문헌 (14)
- R. Bird, "Systematic design of a family of attack-resistant authentication protocols", IEEE Journal on Selected Areas in Communications, 11(5), pp.679~693 (1993)
- Z. Cheng, "A novel biometric-based remote user authentication scheme using Quadratic Residues", International Journal of Information and Electronics Engineering, 3(4), pp.419~422 (2013)
- C. -C. Chang, "Remote password authentication with smart cards", IEE Proceedings E -Computers and Digital Techniques, 138(3), pp.165~168 (1991)
- H. -Y. Chien, "An efficient and practical solution to remote authentication: smart card", Computers & Security, 21(4), pp.372~375 (2002)
- C. -L. Hsu, "Security of Chien et al.’s remote user authentication scheme using smart cards", Computer Standards and Interfaces, 26(3), pp.167~169 (2004)
- M. -S. Hwang, "A new remote user authentication scheme using smart cards", IEEE Transaction on Consumer Electronics, 46(1), pp.28~30 (2000)
- C. -L. Hsu, "Security of Chien et al.’s remote user authentication scheme using smart cards", Computer Standards and Interfaces, 26(3), pp.167~169 (2004)
- P. Kocher, "Differential power analysis", Advances in Cryptology-CRYPTO99, pp.388~397 (1999)
- J. Yuan, "A biometric-based User Authentication for wireless Sensor Networks", Wuhan university journal of national sciences, 5(3), pp.272~276 (2010)
- T. S. Messergers, "Examining smart card security under the threat of power analysis attacks", IEEE Trans. Comput, 51(5), pp.541~552 (2002)
- Y. Lee, "Attacking and improving on Lee and Chiu’s authentication scheme using smart cards", LNCS, 6047, pp.377~385 (2000)
- E. -J. Yoon, "A new biometric-based user authentication scheme without using password for wireless sensor networks", Proceedings of 2011 IEEE International workshops of enabling technologies: Infrastructure for collaborative enterprises, pp.279~284 (2011)
- 김미진, "An Efficient and Secure Authentication Scheme Preserving User Anonymity", (사)디지털산업정보학회 논문지, 6(3), pp.69~77 (2010), (사)디지털산업정보학회
- 이영숙, "Security Improvement to a Remote User Authentication Scheme for Multi-Server Environment", (사)디지털산업정보학회 논문지, 7(4), pp.23~30 (2011), (사)디지털산업정보학회