Earticle

This paper examines security vulnerabilities in current authentication methods for remote patient monitoring in Wireless Medical Sensor Networks (WMSNs), including offline password guessing and man-in-the-middle attacks. We propose a novel three-factor authentication protocol using fuzzy extractors and lightweight cryptography. Formal analysis via the Real-or-Random (ROR) model and Tamarin Prover confirms its robustness, perfect forward/backward secrecy, mutual authentication, anonymity, and untraceability. Performance comparisons demonstrate reduced overhead and enhanced security, offering a promising framework for IoMT development.

사물지능통신(Machine to Machine) 은 사람의 도움없이 언제, 어디서나 독립적으로 기기간 통신을 가능하게 한다. M2M통신은 보통 무선구간의 통신을 포함하므로 도청, 가로채기, 변조, 프라버시 침해 등의 보안문제가 많이 발생할 수 있다. 따라서 무엇보다 기기들간의 안전한 통신을 이루는 것이 가장 중요한 문제 중 하나이다. 본 논문에 서는 M2M 아키텍쳐에서 M2M 도메인과 네트워크 도메인간에 인증을 통해 데이터 노출을 피하고 안전한 통신을 제 공하기위해 동적 ID기반의 원격 인증 기법을 제안한다. 제안된 기법은 로직기반의 정형검증을 통해서 우수한 보안성 과 안전성이 증명되었다.

Machine-to-machine (M2M) communication occurs when devices exchange information independent of human intervention. Prominent among the technical challenges to M2M communication are security issues, such as eavesdropping, spoofing, modification, and privacy violation. Hence, it is very important to establish secure communication. In this paper, we propose a remote authentication scheme, based on dynamic ID, which provides secure communication while avoiding exposure of data through authentication between the M2M domain and the network domain in the M2M architecture. We then prove the correctness and security of the proposed scheme using a logic-based formal method.

논문에서는 Shin 등의 사용자 익명성 제공 인증기법의 취약점을 분석하고, 이 인증기법이 그들의 설계 기준의 안전 성 항목을 보장하지 못함을 보인다. 본 논문에서 Shin 등의 인증기법을 분석한 결과, 전송 메시지들의 XOR 연산에 의해 사용자의 동적 ID 값과 난수들을 쉽게 계산할 수 있다. 또한 스마트카드 분실시, 서버의 비밀키와 사용자의 패 스워드를 획득할 수 있다. 게다가 Shin 등의 패스워드 변경 단계의 제안에도 불구하고, 여전히 패스워드 오입력시 의 취약점이 존재한다. 또한 Shin 등의 인증기법은 해쉬함수를 반복적으로 수행하는 인증기법의 특성 때문에, 심플 하고 효율적인 인증기법이라고 할 수 없다.

In this paper we analyze on vulnerability of Shin et al’s authentication scheme with user anonymity and we show that this authentication scheme does not provide the security items of their design criterion. As the result of analysis of Shin et al’s authentication scheme in this paper, the user’s dynamic ID and the random numbers can be easily calculated by XOR operation of the transmission messages. Also when the smart card is lost, the attacker can acquire secret key of the server and the user’s password. Besides, vulnerability of wrong password input by mistake still exists in spite of the proposal of the password change phase. Shin et al’s authentication scheme can not be simple and efficient authentication scheme because of the features that it executes repeatedly hash function.

무선 통신 기술이 급속하게 발전함에 따라 일상 생활에는 많은 변화가 일어나고 있다. IT 기술 및 인터넷 기술의 발전으로 무선 네트워크가 성장하면서 우리 생활에 많은 편의를 가져다 주었지만, IoT 기술이 다양한 온라인 위협과 공격으로부터 안전하지 않다는 것은 부정할 수 없는 상황이다. 다 양한 연구자들이 안전한 인증 및 통신을 위한 다양한 프로토콜을 제안하여 보안 문제를 개선하고 있 으며, 그 중 ECC(Elliptic Curve Cryptography)라는 상대적으로 계산량이 적으면서도 안전한 암호 방식이 사용되고 있다. 최근 Shafiq 등은 다양한 보안 취약점을 개선한 ECC 기반 원격 사용자 인증 프로토콜을 제안하면서, 제안된 프로토콜이 기존 프로토콜보다 다양한 공격에 더 효율적이고 안전하 다고 주장하였다. 본 논문에서는 Shafiq 등이 제안한 프로토콜에 대한 취약점 분석을 통하여, 이 프 로토콜이 smartcard stolen attack, lack of perfect forward secrecy, replay attack, waste of computational costs에 취약하다는 것을 밝혔다.

As wireless communication technology grows rapidly, many changes are taking place in daily life. Among them, while IoT technology has brought many conveniences to our lives as it grows wireless networks with technological advances, it cannot be denied that IoT technology is not safe from various online threats and attacks. Thus, various researchers have proposed many protocols for secure authentication and communication, improving security issues, among which a lightweight and secure cryptographic approach called Elliptic Curve Cryptography (ECC) has also been used. Recently, Shafiq et al. proposed an ECC-based remote user authentication protocol that improved various security vulnerabilities. They argued that their proposed protocol was more efficient and safe for a variety of attacks than conventional protocols. In this paper, we analyze the protocols proposed by Shafiq et al. and show that it has security problems such as smartcard stolen attack, lack of perfect forward secrecy, replay attack, and waste of computational costs.

많은 기업과 단체들은 원격 접근을 위해 스마트카드 기반 사용자 인증을 사용한다. 그 동안 다양한 연구를 통하여 사용자 와 서버 간의 연결을 보호하기 위해 분산된 다중 서버 환경에 대한 동적 ID 기반 원격 사용자 인증 프로토콜들이 제안되었다. 그 중, Qiu 등은 상호 인증 및 키 동의, 사용자 익명성, 다양한 종류의 공격에 대한 저항을 제공하는 효율적인 스마트카드 기 반 원격 사용자 인증 프로토콜을 제안하였다. 이후, Andola 등은 Qiu 등이 제안된 인증 프로토콜에 대한 다양한 취약점을 찾 아내었고, 그들의 인증 프로토콜에 대한 결점을 극복하고 사용자가 서버에 로그인하기를 원할 때마다 로그인하기 전에 사용자 ID가 동적으로 변경되는 향상된 인증 프로토콜을 제안하였다. 본 논문에서는 Andola 등이 제안한 프로토콜의 동작 과정 및 취약점을 분석하여, Andola 등이 제안한 프로토콜이 offline smart card attack, dos attack, lack of perfect forward secrecy, session key attack에 취약하다는 것을 밝혔다.

Many businesses and organizations use smartcard-based user authentication for remote access. In the meantime, through various studies, dynamic ID-based remote user authentication protocols for distributed multi-server environments have been proposed to protect the connection between users and servers. Among them, Qiu et al. proposed an efficient smart card-based remote user authentication system that provides mutual authentication and key agreement, user anonymity, and resistance to various types of attacks. Later, Andola et al. found various vulnerabilities in the authentication scheme proposed by Qiu et al., and overcame the flaws in their authentication scheme, and whenever the user wants to log in to the server, the user ID is dynamically changed before logging in. An improved authentication protocol is proposed. In this paper, by analyzing the operation process and vulnerabilities of the protocol proposed by Andola et al., it was revealed that the protocol proposed by Andola et al. was vulnerable to offline smart card attack, dos attack, lack of perfect forward secrecy, and session key attack.

최근 스마트 홈 가전 및 사물인터넷(IoT) 기기들의 사용량이 증가되고 있으나 모바일 서비스들을 통해 이를 이용하 는 과정에서의 해킹, 신분도용, 정보유출, 개인 프라이버시의 심각한 침해 및 비정상 접속, 사용자의 오조작이 증가되고 있으며, 그 사실 여부를 확인하거나 입증할 방법이 매우 미흡한 상황이다. 특히, 스마트 홈에서 사용하는 IoT기기에서는 사양과 환경 등 많은 제약이 따르기 때문에 컴퓨터에서의 인터넷 보안 수준을 똑같이 제공하기 어렵다. 이러한 스마트 홈 IoT기기에서도 해킹 및 사용자 권한 탈취, 이상 조작으로 인한 사고예방, 기기조작에 대한 감사기 록을 강화할 수 있도록 모바일 단말과 IoT기기 간에 보안인증의 관리기능을 가지는 클라우드 보안인증 플랫폼의 구축 방안을 제시하고자 한다.

The use of smart home appliances and Internet of Things (IoT) devices is growing, enabling new interactions an d automation in the home. This technology relies heavily on mobile services which leaves it vulnerable to the increa sing threat of hacking, identity theft, information leakage, serious infringement of personal privacy, abnormal access, and erroneous operation. Confirming or proving such security breaches have occurred is also currently insufficient. F urthermore, due to the restricted nature of IoT devices, such as their specifications and operating environments, it is difficult to provide the same level of internet security as personal computers. Therefore, to increase the security on s mart home IoT devices, attention is needed on (1) preventing hacking and user authority theft; (2) disabling abnorm al manipulation; and (3) strengthening audit records for device operation. In response to this, we present a plan to b uild a cloud security authentication platform which features security authentication management functionality betwee n mobile terminals and IoT devices.

In 2009, Hsiang et al.’s proposed a secure, improved remote user authentication scheme using smart card against the parallel session attack, masquerading attack, and password guess attack. Hsiang et al.’s scheme, however, is still vulnerable to off-line password guess attack if the attacker steals or temporarily accesses the smart card to extract the information stored in it, and does not satisfy the security requirement against the adversary that have to be considered in remote user authentication scheme using password-based smart cards. In this paper, I proposed an efficient mutual authentication scheme that based on the hash function and random number. Accordingly, an improved remote user authentication scheme is proposed that is secure against password guess attack.

Voiceprint Recognition System also known as a Speaker Recognition System (SRS) is the best-known commercialized forms of voice Biometrics. Automated speaker recognition is the computing task of validating a user's claimed identity using characteristics extracted from their voices. In contrast to other biometric technologies which are mostly image based and require expensive proprietary hardware such as vendor’s fingerprint sensor or iris-scanning equipment, the speaker recognition systems are designed for use with virtually any standard telephone or on public telephone networks. The ability to work with standard telephone equipment makes it possible to support broad-based deployments of voice biometrics applications in a variety of settings. In automated speaker recognition the speech signal is processed to extract speaker-specific information. These speaker specific informations are used to generate voiceprint which cannot be replicated by any source except the original speaker. This makes speaker recognition a secure method for authenticating an individual since unlike passwords or tokens; it cannot be stolen, duplicated or forgotten. This literature survey paper gives brief introduction on SRS, and then discusses general architecture of SRS, biometric standards relevant to voice/speech, typical applications of SRS, and current research in Speaker Recognition Systems. We have also surveyed various approaches for SRS

Two user authentication schemes were recently proposed using smart cards. They do not need to maintain a verification table in registration server, which is one of the good and necessary aspect in the password based schemes. In this paper, we show that they are not secure against some attacks. Then we propose a robust remote user authentication scheme to withstand the flaws in them but preserve the same merits of them. Our scheme could be efficiently used in wireless communication applications.

Remote user authentication schemes provide a system to verify the legitimacy of remote users’ login request over insecure communication channel. Since last few years many authentication schemes have been proposed including several new features and ideas. But, due to the advancement of computational process they are suffering from various possible attacks. This is the reason because of which attaining the security becomes a prime issue and major challenge among the researchers. In this paper, we have proposed a new user friendly authentication scheme that can provide the higher security at lower computational cost. This scheme provides extra level of security by adopting the user-defined image for password generation. Finally, the security analysis and performance evaluation are made to proof the efficiency of our scheme.

상호작용하는 뉴럴 네트워크는 분석적으로 계산되어진다. 각 학습 스텝마다 두 개의 네트워크는 공통적인 임의의 입력 벡터를 받게 되고, 상호 출력 비트들을 배우게 된다. 2005년에 Chen-Cai는 상호작용 뉴럴 네트워크 학습 기반의 새로운 원격 사용자 인증 스킴을 제안했다. 그러나 본 논문에서는 Chen-Cai의 스킴이 재생 공격과 내부 공격자에 취약함을 보여주고, 그러한 문제를 해결하기 위한 향상된 스킴을 제안한다.

Interacting neural networks have been calculated analytically. At each training step two networks receive a common random input vector and learn their mutual output bits. In 2005, Chen-Cai proposed a novel remote user authentication scheme based on interacting neural network learning. The current paper, however, demonstrates that Chen-Cai’s scheme is vulnerable to a replay attack and an insider attack, and then an improved scheme was presented in order to resolve such problems.

To keep the pace with the development of internet technology, remote user authentication techniques become more and more important to protect user’s privacy. Recently, Kumari, et al., presented an improved remote user authentication scheme with key agreement based on dynamic-identity using smart card. This scheme allows legal users to change the password at his will without the need to connect the server. They claimed that their scheme could resist smart card stolen or loss attack, user impersonation and server masquerading attack, and provide user anonymity and untraceability and so on. However, our research indicates that their scheme is completely unsafe. Furthermore, the scheme can’t provide the proper mutual authentication. In this manuscript, we will propose a new scheme, which can withstand those attacks mentioned above and provide the perfect user anonymity and forward secrecy. Security analysis makes it clear that the improved scheme apparently is more secure and practical.

In recent 2012, Wen and Li.'s has presented a dynamic ID-based remote user authentication with key agreement scheme. They claimed that their scheme can resisted insider attack and provide anonymity for the users. However, Juan Qu and Li-min Zou., described that Wen and Li.'s scheme could not withstand insider attack, does not provide anonymity for the users, and inefficiency for error password login. A different approach to symmetric cryptology is taken in this study to resolve the fore was made Compared to Juan Qu and Li-min Zou scheme, a different approach was made with symmetric cryptology in this study to supplement the forementioned weak points. We propose an enhanced authentication scheme, which covers all the identified weakness of Wen and Li.'s scheme and an efficient user authentication scheme that preserve perfect anonymity to both the outsider and remote server.

Secure and efficient authentication scheme has been a very important issue with the development of networking technologies. Li and Hwang proposed an efficient biometrics-based remote user authentication scheme using smart cards. However, recently, Li et al. pointed out that their scheme is vulnerable to the man-in-the-middle attack, and does not provide proper authentications, and Li et al. proposed an improved biometrics-based authentication scheme. These schemes are vulnerable to various attacks even if the schemes are based on tamper-resistant technologies. Tamper-resistant technologies have been developed with the various applications of smart cards. Therefore, we will assume that the user could use the tamper-resistant smart card in this paper. First of all, this paper shows that Li et al.’s scheme is vulnerable to the replay attack and has a weakness to the password changing scheme even if it is assumed that the scheme could use the tamper-resistant smart cards. Furthermore, we propose an enhanced authentication scheme to solve the security flaws in the two schemes.

Recently, many biometrics-based user authentication schemes for telecare medicine information systems (TMIS) have been proposed to improve the security problems in user authentication system. In 2014, Mishra et al. proposed an improvement of Awasthi-Srivastava’s biometric based authentication for TMIS which is secure against the various attacks and provide mutual authentication, efficient password change. In this paper, we discuss the security of Mishra et al.’s authentication scheme, and we have shown that Mishra et al.’s authentication scheme is still insecure against the various attacks. Also, we proposed the improved scheme to remove these security problems of Mishra et al.’s authentication scheme, even if the secret information stored in the smart card is revealed. As a result, we can see that the improved biometric based authentication scheme is secure against the insider attack, the password guessing attack, the user impersonation attack, the server masquerading attack and provides mutual authentication between the user and the telecare system.

Remote user authentication scheme is a kind of way to authenticate the communication parties who transmit messages through an insecure channel. Researchers in this area have proposed some approaches during the last couple of decades. Unfortunately, most of them are proved to be insecure against various attacks. In 2009, Kim and Chung improved Yoon and Yoo’s scheme, and claimed that their scheme can prevent masquerading attack as well as resist to other malicious attacks. However, we found that Kim and Chung’s scheme is still not secure enough, especially in preventing off-line password guessing attack. In this study, we proposed a more secure and practical remote user authentication scheme to resolve all of the aforementioned security vulnerabilities while preserving the merits of Kim-Chung’s scheme.

Recently, user authentication scheme in e-commerce and m-commerce has been becoming one of important security issues. In 2008, Bindu et al. proposed an improved remote user authentication scheme preserving user anonymity. In this paper, we analyze the security of Bindu et al.’s authentication scheme, and we demonstrate that their scheme is still insecure against the man-in-the-middle attack, the password guessing attack, and does not provide the user anonymity. Also, we propose an enhanced scheme to withstand the security weaknesses of Bindu et al.’s scheme, even if the secret information stored in the smart card is revealed. As a result of security analysis, we prove that the enhanced scheme is secure for the various attacks known by literatures, and provides the user anonymity, the session key agreement, and the mutual authentication between the user and the server.

Multi-server environments are that the user registers the single registration server and since the user uses the service to authenticate on multi-server. For this, many user authentication schemes have been proposed for multi-server environments. In 2013, Li, et al., proposed dynamic ID based remote user authentication scheme for multi-server environments. Unfortunately, their scheme is vulnerable to forgery attacks and replay attacks. In this paper, we analyze the security vulnerabilities of Li et al.’s scheme, and propose dynamic ID based remote user authentication scheme for multi-server environments. The proposed scheme ensures the safety to various attacks such as forgery attacks and replay attacks. Just like the existing schemes, our scheme is efficient at using the hash function and exclusive-OR operation.

Password authentication has been adopted as one of the most commonly used solutions in network environments to protect resources from unauthorized access. Recently, Khan et al. proposed an efficient fingerprint-based remote user authentication scheme with smart cards [15], in which a password/verification table is not required on the remote server, and users are allowed to choose and update their passwords freely. In this paper, we show that their scheme is vulnerable to the parallel session attack. Furthermore, their scheme is susceptible to the impersonation attack provided that the information stored in the smart card is disclosed by an adversary. We also propose an improved scheme which is immune to the presented attacks.

A dynamic ID-based user authentication scheme is designed to protect leakage of a user’s partial information from intruders while enabling authenticated users to be granted access to the network service. In 2012, Wen and Li proposed a dynamic ID-based remote user authentication scheme with key agreement and claimed that their scheme resisted impersonation attacks and avoided leakage of partial information. However, Kim, et al., described that Wen and Li’s scheme could leak some key information to an adversary and is vulnerable to a man-in-the-middle attack launched by any adversary. In this paper, we show how to solve the vulnerabilities in Wen and Li’s scheme.