An Efficient and Secure Authentication Scheme Preserving User Anonymity
1
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
Authentication and key establishment are fundamental procedures to establish secure communications over public insecure network. A password-based scheme is common method to provide authentication. In 2008, Khan proposed an efficient password-based authentication scheme using smart cards to solve the problems inherent in Wu-Chieu's authentication scheme. As for security, Khan claimed that his scheme is secure and provides mutual authentication between legal users and a remote server. In this paper, we demonstrate Khan's scheme to be vulnerable to various attacks, i. e., password guessing attack, insider attack, reflection attack and forgery attack. Our study shows that Khan's scheme does not provide mutual authentication and is insecure for practical applications. This paper proposes an improved scheme to overcome these problems and to preserve user anonymity that is an issue in e-commerce applications.
Abstract
Authentication and key establishment are fundamental procedures to establish secure communications over public insecure network. A password-based scheme is common method to provide authentication. In 2008, Khan proposed an efficient password-based authentication scheme using smart cards to solve the problems inherent in Wu-Chieu's authentication scheme. As for security, Khan claimed that his scheme is secure and provides mutual authentication between legal users and a remote server. In this paper, we demonstrate Khan's scheme to be vulnerable to various attacks, i. e., password guessing attack, insider attack, reflection attack and forgery attack. Our study shows that Khan's scheme does not provide mutual authentication and is insecure for practical applications. This paper proposes an improved scheme to overcome these problems and to preserve user anonymity that is an issue in e-commerce applications.
참고문헌 (13)
- Lamport, L, "Password Authentication with Insecure Communication", Communications of the ACM, 24(11), pp.770~772 (1981)
- Bellovin, S. M, "Encrypted key exchange: password-based protocols secure against dictionary attacks", IEEE Symposium on research in security and privacy, IEEE Computer Society, 72~84 (1992)
- Bellare, M, "Authenticated key exchange secure against dictionary attacks", Advances in Cryptology- EUROCRYPT00, Lecture Notes in Computer Science, 1807, pp.139~155 (2000)
- Botko, V, "Provable secure password-authenticated key exchange using Diffe-Hellman", 156~171 (2000)
- Yang, G, "Two-factor mutual authentication based on smart cards and passwords", Journal of computer and system sciences, 74(7), pp.1160~1172 (2008), Elsevier
- Wu, S. T, "A note on a user friendly remote user authentication scheme with smart cards", IEICE Transactions Fundamentals, 87-A(8), pp.2180~2181 (2004)
- Khan, M. K, "An efficient and secure remote mutual authentication scheme with smart cards", International Symposium on Biometrics and Security Technologies(ISBAST 2008), pp.1~6 (2008)
- Ku, W. C, "Cryptanalysis of a variant of Peyravian-Zunic's password authentication scheme", IEICE trans. on commun, E86-B(5), pp.1682~1684 (2003)
- Mitchell, C, "Limitations of challenge-response entity authentication", Electronics Letters, 25(17), pp.1195~1196 (1989)
- Yashinsac, A, "Dynamic analysis of security protocols", Proc. 2000 Workshop on New Security Paradigms, pp.77~87 (2001)
- Kocher, P, "Differential power analysis", Proc. Advances in Cryptology (CRYPTO'99), 388~397 (1999)
- rges, T. S, "Examming smart card security under the threat of power analysis attacks", IEEE Transactions on Computer, 51(5), pp.541~552 (2002)
- Menezes, A. J, "Handbook of applied cryptography" (1997), CRC Press