PaperlayerView exact revision on arXiv

Source-linked AI summary

A secure and effective anonymous authentication scheme for roaming service in global mobility networks

Dawei Zhao, Haipeng Peng, Lixiang Li, Yixian Yang

arXiv:1306.4726v1cs.CR

TL;DR

Mun et al.’s roaming authentication scheme has security and usability weaknesses, including impersonation, password-guessing, and insider attacks. This paper proposes an ECC-based anonymous authentication scheme with registration, authentication and session-key establishment, and password and session-key update phases. The authors report that their scheme is suitable for low-power, resource-limited mobile devices and secure against various attacks.

  • Problem

    Mun et al.’s scheme is reported vulnerable to impersonation, off-line password guessing, and insider attacks, and deficient in user friendliness, anonymity, mutual authentication, and local verification.

    Source: §1 Introduction · p. 2, §4 Weaknesses of Mun et al.’s scheme · p. 6

  • Method

    The paper proposes an ECC-based anonymous roaming authentication scheme with registration, authentication and session-key establishment, password update, and session-key update phases.

    Source: §5 The proposed scheme · p. 9

  • Results

    The authors report that their scheme is more suitable for low-power, resource-limited mobile devices and secure against various attacks.

    Source: §8 Conclusion · p. 19

  • Takeaways & Limitations

    The proposed scheme is presented as a roaming-authentication option for low-power, resource-limited mobile devices.

    Source: §8 Conclusion · p. 19

    The security proof assumes attackers can extract stored smart-card elements, access a large likely-password dictionary, and intercept user-server communications.

    Source: §6 Security analysis of the proposed… · p. 16

Abstract

from arXiv · show

Recently, Mun et al. analyzed Wu et al.'s authentication scheme and proposed a enhanced anonymous authentication scheme for roaming service in global mobility networks. However, through careful analysis, we find that Mun et al.'s scheme is vulnerable to impersonation attacks, off-line password guessing attacks and insider attacks, and cannot provide user friendliness, user's anonymity, proper mutual authentication and local verification. To remedy these weaknesses, in this paper we propose a novel anonymous authentication scheme for roaming service in global mobility networks. Security and performance analyses show the proposed scheme is more suitable for the low-power and resource-limited mobile devices, and is secure against various attacks and has many excellent features.

§1 Introduction

Global mobility networks require authentication that protects roaming users while meeting privacy, efficiency, and usability requirements. The paper argues that Mun et al.’s scheme retains security and usability weaknesses and proposes a new scheme.

§1 Introduction

  • A strong roaming authentication scheme should provide user anonymity, low communication and computation costs, single registration, periodic session-key updates, and user friendliness.The listed requirements also include avoiding password/verifier tables, secure password updates, fraud and replay prevention, security, and authentication in the home network.Source: §1 Introduction · p. 1
  • Research on secure mutual authentication and privacy protection in global mobility networks has produced many proposed protocols.The paper situates its work in this sequence of authentication schemes.Source: §1 Introduction · p. 1
  • Earlier schemes faced reported weaknesses including failures of mutual authentication, anonymity, and perfect backward secrecy, as well as forgery, replay, impersonation, and key-agreement fairness problems.Li and Lee also reported shortcomings in user friendliness and anonymity for Li et al.’s scheme.Source: §1 Introduction · p. 2
  • Mun et al.’s scheme is vulnerable to impersonation, off-line password guessing, and insider attacks, and lacks user friendliness, anonymity, proper mutual authentication, and local verification.The paper proposes a new anonymous authentication scheme to address these weaknesses.Source: §1 Introduction · p. 2

§2 Preliminaries

The preliminaries introduce elliptic-curve cryptography and the mathematical assumptions used to support the proposed protocol’s security analysis.

§2 Preliminaries

  • Elliptic-curve cryptography offers smaller key sizes and faster computation than other public-key cryptography, motivating its use in wireless schemes.The paper describes ECC as widely used in wireless-network cryptographic schemes for security and computational efficiency.Source: §2 Preliminaries · p. 2

2.1 Elliptic curve cryptosystem

  • The elliptic-curve cryptosystem uses points satisfying a nonsingular curve equation over a prime field, with an additive group that includes the point at infinity.The group also supports scalar multiplication, and a point’s order is the smallest positive integer n for which n · P = O.Source: §2.1 · pp. 2–3

2.2 Related mathematical assumptions

  • The security discussion introduces three hard problems over the elliptic-curve group: computational discrete logarithm, computational Diffie–Hellman, and elliptic-curve factorization.The stated tasks are recovering a scalar from P and x · P, computing xyP from P, xP, and yP, and separating the two components of x · P + y · P.Source: §2.2 · p. 3

§3 Review of Mun et al.’s scheme

Mun et al.’s scheme involves a mobile user, a foreign agent, and a home agent across registration, roaming authentication with session-key establishment, and session-key update. The review describes the message exchanges in each phase.

§3 Review of Mun et al.’s scheme

  • Mun et al.’s scheme has three phases—registration, authentication and session-key establishment, and session-key update—and involves MU, FA, and HA.MU is the mobile user, FA the foreign-network agent, and HA the user’s home agent.Source: §3 Review of Mun et al.’s scheme · p. 3

3.1 Registration phase

  • During registration, MU sends its identity and a random number to HA, which returns password-derived values and identifiers over a secure channel.HA computes PWMU = h(NMU∥NHA) and rMU = h(IDMU∥PWMU) ⊕ IDHA before sending the registration information.Source: §3.1 · p. 4

3.2 Authentication and establishment of session key phase

  • For roaming authentication, MU submits registration values through FA to HA; HA validates MU and sends values FA uses to authenticate HA and establish session-key material.The exchange proceeds through the authentication and session-key establishment phase; MU and FA then derive and verify a session key.Source: §3.2 · p. 4

3.3 Update session key phase

  • When MU remains with the same FA, both parties use fresh random values and the previous session key material to establish an updated session key.FA sends aiP and SMFi; MU verifies the returned value before accepting KMFi.Source: §3.3 · p. 6

§4 Weaknesses of Mun et al.’s scheme

The authors identify several security and usability weaknesses in Mun et al.’s scheme and detail three impersonation paths that can enable unauthorized access or deceive users.

§4 Weaknesses of Mun et al.’s scheme

  • Mun et al.’s scheme is reported vulnerable to impersonation, offline password guessing, and insider attacks, as well as deficiencies in usability, anonymity, mutual authentication, and local verification.Source: §4 Weaknesses of Mun et al.’s scheme · p. 6

4.1.1 MU impersonation attacks

  • An attacker with an intercepted valid login request can replace its nonce and impersonate the user to the home and foreign agents, then access foreign-agent services.The request’s home-agent identity and user-specific rMU pass home-agent validation despite the replacement nonce.Source: §4.1.1 · p. 7

4.1.2 FA impersonation attacks

  • Because the home agent does not authenticate the foreign agent, an attacker can pose as that agent and establish a session key with a user.The attacker forwards the user’s correct rMU with a chosen foreign-agent nonce; the foreign agent then accepts the user and the attacker gains access to its services.Source: §4.1.2 · p. 7

4.1.3 HA impersonation attacks

  • An attacker posing as the home agent can help a user pass foreign-agent authentication and access its services.The attacker chooses P′ to construct SHA matching the value the foreign agent computes; the user proceeds without verifying SF A.Source: §4.1.3 · pp. 7–8

4.2 Off-line password guessing attacks

The analysis describes password guessing and insider risks in Mun et al.’s scheme, and says its registration process requires users to retain and enter substantial information.

4.2 Off-line password guessing attacks

  • An attacker with intercepted session messages can test password guesses offline by recomputing S′HA and treating a match with SHA as confirmation.The paper notes that passwords often have low entropy, making guessing a concern.Source: §4.2 · p. 8

4.3 Insider attacks

  • Because the home agent receives and retains the user’s secret information during registration, it can impersonate the user.Source: §4.3 · p. 8

4.4 Lack of user friendliness

  • Without a smart card, users must remember and enter multiple items sent by the home agent during authentication, which the authors call unrealistic.The information includes rMU, PWMU, NHA, IDHA, and h(·).Source: §4.4 · p. 8

4.5 Lack of user’s anonymity

The authors argue that unchanged login values enable user tracing, the home agent does not authenticate the foreign agent, and the user terminal performs no local input check.

4.5 Lack of user’s anonymity

  • Although the user’s real identity is omitted from login messages, unchanged NHA and rMU values let an attacker trace the user across logins.Source: §4.5 · pp. 8–9

4.6 Lack of proper mutual authentication

  • The home agent cannot identify the requesting user from the foreign agent’s message, and it does not authenticate that foreign agent.Even checking rMU would establish only the user’s legitimacy, not the foreign agent’s.Source: §4.6 · p. 9

4.7 Lack of local verification

  • The user’s terminal does not verify entered login information before authentication continues, so mistaken or forged messages incur extra communication and computation.Source: §4.7 · p. 9

§5 The proposed scheme

The proposed ECC-based roaming authentication scheme targets security and efficiency and includes registration, foreign- and home-network authentication with session-key establishment, session-key renewal, and password change.

§5 The proposed scheme

  • The scheme uses ECC to emphasize security and efficiency across registration, authentication, session-key establishment and renewal, password change, and home-network authentication.The paper also includes a notation table for the proposed scheme.Source: §5 The proposed scheme · p. 9

5.1 Registration phase

  • During registration, MU sends an identity and password-derived hash to HA over a secure channel, and HA returns a smart card that MU completes with xMU.HA computes Q and H and stores them with C and IDHA on the card; MU adds xMU.Source: §5.1 · pp. 9–10

5.2 Authentication and establishment of session key phase

  • MU and FA exchange fresh values while HA assists verification; the protocol authenticates MU and the agents before MU and FA establish a common session key.FA forwards an encrypted request and signature to HA; HA verifies FA, checks MU, and returns a signed response, after which MU checks the response and computes SK = h(aB).Source: §5.2 · p. 11

5.3 Update session key phase

  • For repeated sessions with the same FA, MU and FA use fresh a_i and b_i values to derive SK_i and check it against the previous session key.FA sends B_i and S_i; MU checks S_i against its own computation and aborts if they differ.Source: §5.3 · p. 11

5.4 Update password phase

  • MU can change the password without a secure channel or communication with HA, after the smart card validates the current credentials.The card then replaces Q, H, and xMU with their new values.Source: §5.4 · p. 13

5.5 Authentication and establishment of session key scheme when a mobile user is located in his/her home network

  • For a user in the home network, HA verifies MU, returns U and W1, and shares a session key that MU accepts after checking W1.HA computes SK = h(uA), while MU computes SK = h(aU).Source: §5.5 · pp. 13–15

§6 Security analysis of the proposed scheme

The proposed scheme is analyzed as resisting multiple attacks while providing anonymity, mutual authentication, and local password verification. Its security arguments rely on one-time session values and checks involving the mobile user, foreign agent, and home agent.

§6 Security analysis of the proposed scheme

  • The scheme protects user anonymity by concealing the real identity in login requests and changing request values across logins, preventing identity recovery and movement tracing.The argument relies on the difficulty of deriving the mobile user’s random number from A.Source: §6 Security analysis of the proposed… · p. 15
  • The protocol provides mutual authentication among the mobile user, foreign agent, and home agent, with checks intended to prevent impersonation of each entity.The authentication arguments include digital-signature checks for the foreign and home agents and a home-agent check of the mobile user’s login request.Source: §6 Security analysis of the proposed… · pp. 15–16
  • Replaying an old login request does not reveal the session key because the attacker cannot derive the secret a from A = aP under the CDL problem.The session key is SK = h(aB).Source: §6 Security analysis of the proposed… · p. 16
  • Perfect forward secrecy is argued to hold because each session uses one-time random values a and b that cannot be recovered from transmitted values under the stated CDL and CDH assumptions.The claim is maintained even if passwords, previous session keys, and transmitted messages are compromised.Source: §6 Security analysis of the proposed… · p. 16
  • With a stolen smart card and intercepted messages, an attacker cannot perform offline password guessing without the mobile user’s identity and secret random number a.The analysis assumes the attacker obtains stored card information and can intercept communications.Source: §6 Security analysis of the proposed… · pp. 16–17
  • The scheme argues resistance to insider attacks, maintains no verification table, and checks the user’s identity and password locally before login.The password-change phase does not require help from the home agent.Source: §6 Security analysis of the proposed… · p. 17

§7 Performance comparison and functionality analysis

The paper compares communication cost, computation cost, and functionality with related schemes. It reports relatively low communication and computational costs and concludes that the scheme suits low-power, resource-limited mobile devices.

§7 Performance comparison and functionality analysis

§8 Conclusion

The conclusion says Mun et al.’s scheme has security and functionality weaknesses. The authors propose a new roaming authentication scheme and report favorable security and performance analyses.

§8 Conclusion

  • Mun et al.’s scheme is reported vulnerable to several attacks and unable to provide user friendliness, anonymity, proper mutual authentication, and local verification.Source: §8 Conclusion · p. 19
  • The authors propose a novel anonymous authentication scheme for roaming service in global mobility networks to address those weaknesses.Source: §8 Conclusion · p. 19
  • The authors report that their scheme is secure against various attacks, has many features, and is more suitable for low-power, resource-limited mobile devices.Source: §8 Conclusion · p. 19

§9 Acknowledgment

The paper acknowledges support from Chinese research funding programs.

§9 Acknowledgment

  • Support came from the National Natural Science Foundation of China and the Asia Foresight Program under NSFC.The acknowledgment lists grant numbers 61070209, 61202362, 61121061, and 61161140320.Source: §9 Acknowledgment · p. 19
Loading 1306.4726v1…