AN IMPROVED REMOTE PASSWORD AUTHENTICATION SCHEME WITH SMART CARD

This paper analyzes the security performance of a latest proposed remote two-factor user authentication scheme and proposes an improved scheme based on the dynamic ID to avoid the attacks it suffers. Besides this, in our proposed scheme the password is no longer involved in the calculation of verification phase which makes our scheme more secure and costs less than the old one. At last we analyze the performance of our proposed scheme to prove it provides mutual authentication between the user and the server. Moreover, it also resists password guessing attack, server and user masquerade attack and replay attack effectively.

A New Secure Password Authentication Scheme Using Smart Cards

Thirteen security requirements for an ideal password authentication scheme using smart cards are listed and a new smart card based password authentication scheme with identity anonymity is proposed. The new scheme can satisfy all the listed ideal security requirements and has the following merits： （1） it can resist all the attacks listed in introduction; （2） less storage memory requirement due to no verification table stored in server; （3） low computational cost due to hash functions based operations; （4） even if the smart card is lost, the new system is still secure; （5） As user identity is anonymous, this scheme is more practical. The new proposed scheme can be applied in source constraint networks.

Web Application Authentication Using Visual Cryptography and Cued Clicked Point Recall-based Graphical Password

Alphanumerical usernames and passwords are the most used computer authentication technique.This approach has been found to have a number of disadvantages.Users,for example,frequently choose passwords that are simple to guess.On the other side,if a password is difficult to guess,it is also difficult to remember.Graphical passwords have been proposed in the literature as a potential alternative to alphanumerical passwords,based on the fact that people remember pictures better than text.Existing graphical passwords,on the other hand,are vulnerable to a shoulder surfing assault.To address this shoulder surfing vulnerability,this study proposes an authentication system for web-applications based on visual cryptography and cued click point recall-based graphical password.The efficiency of the proposed system was validated using unit,system and usability testing measures.The results of the system and unit testing showed that the proposed system accomplished its objectives and requirements.The results of the usability test showed that the proposed system is easy to use,friendly and highly secured.

Design and Implementation of USB Key System Based on Dual-Factor Identity Authentication Protocol

With the increasing demand for information security,traditional single-factor authentication technology can no longer meet security requirements.To this end,this paper proposes a Universal Serial Bus(USB)Key hardware and software system based on a two-factor authentication protocol,aiming to improve the security and reliability of authentication.This paper first analyzes the current status and technical principles of USB Key-related research domestically and internationally and designs a two-factor authentication protocol that combines impact/response authentication and static password authentication.The system consists of a host computer and a USB Key device.The host computer interacts with the USB Key through a graphical user interface.The Secure Hash Algorithm 1(SHA-1)and MySQL database are used to implement the authentication function.Experimental results show that the designed two-factor authentication protocol can effectively prevent replay attacks and information tampering,and improve the security of authentication.If the corresponding USB Key is not inserted,the system will prompt that the device is not found.Once the USB Key is inserted,user identity is confirmed through two-factor verification,which includes impact/response authentication and static password authentication.

NEW REMOTE USER AUTHENTICATION SCHEME USING SMART CARD

Because the modified remote user authentication scheme proposed by Shen, Lin and Hwang is insecure, the Shen-Lin-Hwang＇ s scheme is improved and a new secure remote user authentication scheme based on the bi- linear parings is proposed. Moreover, the effectiveness of the new scheme is analyzed, and it is proved that the new scheme can prevent from all kinds of known attack. The one-way hash function is effective in the new scheme. The new scheme is proved that it has high effectiveness and fast convergence speed. Moreover, the ap- plication of the new scheme is easy and operational.

Research and Implementation of Time Synchronous Dynamic Password Based on SM3 Hash Algorithm

With the rapid development of information technology, demand of network & information security has increased. People enjoy many benefits by virtue of information technology. At the same time network security has become the important challenge, but network information security has become a top priority. In the field of authentication, dynamic password technology has gained users’ trust and favor because of its safety and ease of operation. Dynamic password, SHA (Secure Hash Algorithm) is widely used globally and acts as information security mechanism against potential threat. The cryptographic algorithm is an open research area, and development of these state-owned technology products helps secure encryption product and provides safeguard against threats. Dynamic password authentication technology is based on time synchronization, using the state-owned password algorithm. SM3 hash algorithm can meet the security needs of a variety of cryptographic applications for commercial cryptographic applications and verification of digital signatures, generation and verification of message authentication code. Dynamic password basically generates an unpredictable random numbers based on a combination of specialized algorithms. Each password can only be used once, and help provide high safety. Therefore, the dynamic password technology for network information security issues is of great significance. In our proposed algorithm, dynamic password is generated by SM3 Hash Algorithm using current time and the identity ID and it varies with time and changes randomly. Coupled with the SM3 hash algorithm security, dynamic password security properties can be further improved, thus it effectively improves network authentication security.

An improved and secure multiserver authentication scheme based on biometrics and smartcard

With the advancement in internet technologies, the number of servers has increased remarkably to provide more services to the end users. These services are provided over the public channels, which are insecure and susceptible to interception, modification, and deletion. To provide security, registered entities are authenticated and then a session key is established between them to communicate securely. The conventional schemes anow a user to access services only after their independent registration with each desired server in a multiserver system. Therefore, a user must possess multiple smartcards and memorize various identities and passwords for obtaining services from multiple servers. This has led to the adoption of multiserver authentication in which a user accesses services of multiple servers after registering himself at only one central authority. Recently, Kumar and Om discussed a scheme for multiserver environment by using smartcard. Since the user-memorized passwords are of low entropy, it is possible for an attacker to guess them. This paper uses biometric information of user to enhance the security of the scheme by Kumar and Ore. Moreover, we conducted rigorous security analyses （informal and formal） in this study to prove the security of the proposed scheme against all known attacks. We also simulated our scheme by using the automated tool, ProVerif, to prove its secrecy and authentication properties. A comparative study of the proposed scheme with the existing related schemes shows its effectiveness.

Cryptanalysis of Two Pseudo-attacks from the Same Mathematic Mistake

Yang and Shieh proposed a timestamp-hased password authentication scheme. Fan and Shen gave differ- ent improvements on it. Wang claimed that Fan＇s improvement is insecure and gave his attack. Yang did the simi- lar things on Shen＇s scheme. This paper gave further cryptanalysis on Wang＇s and Yang＇s attacks and pointed out that both of their attacks are infeasible. Wang and Yang made the same mathematic mistake and their attacks are pseudo.

Event-Oriented Dynamic Security Service for Demand Response in Smart Grid Employing Mobile Networks

Equipped with millions of sensors and smart meters in smart gird,a reliable and resilient wireless communication technology is badly needed.Mobile networks are among the major energy communication networks which contribute to global energy consumption increase rapidly.As one of core technologies of smart grid employing mobile networks,Demand Response(DR) helps improving efficiency,reliability and security for electric power grid infrastructure.Security of DR events is one of the most important issues in DR.However,the security requirements of different DR events are dynamic for variousactual demands.To address this,an event-oriented dynamic security service mechanism is proposed for DR.Three kinds of security services including security access service,security communication service and security analysis service for DR event are composited dynamically by the fine-grained sub services.An experiment prototype of the network of State Grid Corporation of China(SGCC) is established.Experiment and evaluations shows the feasibility and effectiveness of the proposed scheme in smart grid employing mobile network.

Simple and Efficient Password-Based Authenticated Key Exchange Protocol

Password-based authenticated key exchange(PAKE) protocols are cryptographic primitives which enable two entities,who only share a memorable password,to identify each other and to communicate over a public unreliable network with a secure session key.In this paper,we propose a simple,efficient and provably secure PAKE protocol based on Diffie-Hellman key exchange and cryptographic hash function.Our protocol is secure against dictionary attacks.Its security is proved based on the hardness of the computational Diffie-Hellman problem in the random oracle model.

A Generic Framework for Anonymous Authentication in Mobile Networks

Designing an anonymous user authentication scheme in global mobility networks is a non-trivial task because wireless networks are susceptible to attacks and mobile devices powered by batteries have limited communication, processing and storage capabilities. In this paper, we present ~ generic construction that converts any existing secure password authen- tication scheme based on a smart card into an anonymous authentication scheme for roaming services. The security proof of our construction can be derived from the underlying password authentication scheme employing the same assumptions. Compared with the original password authentication scheme, the transformed scheme does not sacrifice the authentication efficiency, and additionally, an agreed session key can be securely established between an anonymous mobile user and the foreign agent in charge of the network being visited. Furthermore, we present an instantiation of the proposed generic construction. The performance analysis shows that compared with other related anonymous authentication schemes, our instantiation is more efficient.

Simple Three-Party Password Authenticated Key Exchange Protocol

Three-party password authenticated key exchange (3PAKE) protocol plays a significant role in the history of secure communication area in which two clients agree a robust session key in an authentic manner based on passwords. In recent years, researchers focused on developing simple 3PAKE (S-3PAKE) protocol to gain system e?ciency while preserving security robustness for the system. In this study, we first demonstrate how an undetectable on-line dictionary attack can be successfully applied over three existing S-3PAKE schemes. An error correction code (ECC) based S-3PAKE protocol is then introduced to eliminate the identified authentication weakness.