Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

International Journal of Network Security & Its Applications

Efficient and Secure Dynamic ID-Based Remote User Authentication Scheme with Session Key Agreement for Multi-Server Environment

Rafael Martínez-Peláez, Francisco Rico-Novella, Cristina Satizábal, Jacek Pomykała

Published Oct 22, 2010• 9 citations
Publisher

Abstract

In 2007, Liao-Wang proposed a dynamic ID-based remote user authentication scheme for multi-server environment using smart cards.However, Hsiang-Shih demonstrated that Liao-Wang's scheme has security flaws.Moreover, Hsiang-Shih proposed an improvement scheme which resolves the security flaws of Liao-Wang scheme.In this paper, we propose an enhanced remote user authentication scheme which maintains the merits of Hsiang-Shih's scheme.Performance evaluation demonstrated the efficiency of the proposed scheme over related works.Security analysis proved that the proposed scheme is secure against known attacks.

DOI
10.5121/ijnsa.2010.2409

Related papers

Weaknesses of a Secure Dynamic ID Based Remote User Authentication Scheme

Bae‐Ling Chen, Wen‐Chung Kuo, YuShuan Chu -

In 2009, Liao and Wang proposed a secure dynamic ID based remote user authentication scheme for multi-server environments. They achieved user anonymity by using secure dynamic IDs instead of static IDs. Recently, Hsiang and Shih proposed an improved scheme to fix the security flaws found in Liao-Wang’s scheme. Hsiang and Shih claimed that their scheme maintains the benefits and increases the security of Liao-Wang’s scheme, while providing mutual authentication that Liao-Wang’s scheme lacks. In this paper, however, it is shown that Hsiang-Shih’s scheme cannot withstand user and server impersonation attacks. Their scheme is thus vulnerable to malicious users and insecure for practical applications.

Journal of Convergence Information Technology•Jun 30, 2010•2 citations

Cryptanalysis and Security Enhancement of an Efficient and Secure Dynamic ID Based Remote User Authentication Scheme for Multi-Server Environments

Subhasish Banerjee, Manash Pratim Dutta, Chandan Tilak Bhunia

Password based authentication schemes have been widely used to verify the legitimacy of a user over an insecure communication channel. A common feature among most of the published schemes is that user's identity (ID) is static in all the transaction sessions, which may leak some information about the user and can create risk of identity theft during message transaction. Therefore, to provide user anonymity, many dynamic ID based remote users authentication schemes have been proposed. Recently, Khan et al. proposed an efficient and secure dynamic ID based remote user authentication scheme and claimed that their scheme can provide strong security against various attacks. In this paper, we have demonstrated that Khan et al.'s scheme is vulnerable to server spoofing attack and insider attack, and has some flaws in login and authentication phase as well and also proposed an enhanced scheme to overcome the identified weaknesses.

International Conference on Advanced Research in Computer Science Engineering & Technology (ICARCSET)•Mar 6, 2015•4 citations

Multi-serverAnonymousRemoteAuthenticatedKeyAgreementProtocolBasedonSmartCard

李艳平, 刘小雪, 屈娟 +1 more

Abstract:In order to efficiently eliminate the security shortcomings of the dynamic ID based remote user authentication scheme using smart cards (short for XJWM scheme) proposed by Xu et al.,a new multi server and multi factor anonymous remote authenticated key agreement protocol was presented,based on Diffie Hellman key agreement algorithm and biometrical authentication technology.The new protocol can not only overcome the security flaws of XJWM scheme,but also add smart card’s password and bio information authentication for the cardholder to avoid the smart card stolen attack.The security of the new protocol was proved by the improved BAN logic and the result showed that the new scheme can ensure the correctness of key agreement,key confidentiality,key freshness and mutual authentication.The security and performance analysis demonstrated that the proposed protocol provides better security without increasing too much computation overhead.

•Jan 1, 2016•0 citations

Cryptanalysis Of Dynamic ID Based Remote User Authentication Scheme With Key Agreement.

Sonam Devgan Kaul, Amit K. Awasthi

Summary. In 2012, Wen and Li proposed a secure and robust dynamic identity based remote user au-thentication scheme with key agreement using smart cards. They claimed that their scheme is efficient and secure. But in this paper, we demonstrate that their scheme is completely insecure and vulnerable to various known attacks like offline and online password guessing attack, impersonation attack, server mas-querading attack, denial of service attack and an insider attack. Also we point out that there are loopholes in password change phase and online secret renew phase which leads to the desynchronization between user and the server and even the legitimate user is rejected by the server. In addition, an adversary can easily generate the common session key of further transmission between user and the server. Thus the entire system collapses and authors claims are proven to be wrong and their scheme will not be secure and efficient for practical purpose.

•Jan 1, 2015•0 citations

Cryptanalysis of Two Dynamic ID-Based Remote User Authentication Schemes for Preserving User Privacy

Jian-Wen Peng, Wen-Bing Horng, Ying-Ching Chiu +1 more

Remote user authentication is an essential part in electronic commerce to identify legitimate users over the Internet. However, how to protect user privacy in the authentication has become an important issue recently. Therefore, many secure authentication schemes with smart cards have been proposed. In this paper, we will analyze the security weaknesses of two recently proposed authentication schemes for preserving user privacy. First, Chang et al. (2011) proposed a robust and efficient remote user authentication scheme to provide user anonymity. However, this scheme fails to protect user privacy in terms of anonymity and traceability. In addition, it is vulnerable to the server counterfeit attack and it does not provide perfect forward secrecy for session keys. Furthermore, if the smart card is lost, it will suffer from the offline password guessing attack as well as the user impersonation attack. Second, Wen and Li (2012) recently presented an improved dynamic ID-based authentication scheme with key agreement. However, this scheme is vulnerable to traceability. In addition, it does not support perfect forward secrecy for session keys. Furthermore, the insecure offline password change phase and online secret renewal phase will result in the denial of service attack.

Journal of Applied Science and Engineering•Jan 1, 2013•0 citations

A robust remote user authentication scheme resistant to known session specific temporary information attack

Mrudula Sarvabhatla, M. Chandra Mouli Reddy, Chandra Sekhar Vorugunti

Rapid growth of mobile and networking technologies, resulted in new paradigms of networking like Internet of Things (IoT) etc, which allows user to connect to insecure public communication channel through various devices and can access the services and data provided by remote server. Thus, remote user authentication and key agreement for wireless, wired, IoT communications becoming more challenging task. In this context many researchers have proposed authentication schemes. In 2013, An et al. proposed a dynamic ID-based remote user authentication scheme which is secure, even if the secret values stored in the smart card is revealed. In 2014, Troung et al claimed that An et al scheme is vulnerable to server forgery attack and proposed an improved scheme. In this manuscript, we validate that Troung et al's scheme is vulnerable to known session specific temporary information attack, replay and impersonation attack. Furthermore, we also propose the improved scheme to overcome these limitations without increase in the cost front.

Applications and Innovations in Mobile Computing (AIMoC)•Feb 1, 2015•6 citations
In 2007, Liao-Wang proposed a dynamic ID-based remote user authentication scheme for multi-server environment using smart cards.However, Hsiang-Shih demonstrated that Liao-Wang's scheme has security flaws.Moreover, Hsiang-Shih proposed an improvement scheme which resolves the security flaws of Liao-Wang scheme.In this paper, we propose an enhanced remote user authentication scheme which maintains the merits of Hsiang-Shih's scheme.Performance evaluation demonstrated the efficiency of the proposed scheme over related works.Security analysis proved that the proposed scheme is secure against known attacks.
In 2009, Liao and Wang proposed a secure dynamic ID based remote user authentication scheme for multi-server environments. They achieved user anonymity by using secure dynamic IDs instead of static IDs. Recently, Hsiang and Shih proposed an improved scheme to fix the security flaws found in Liao-Wang’s scheme. Hsiang and Shih claimed that their scheme maintains the benefits and increases the security of Liao-Wang’s scheme, while providing mutual authentication that Liao-Wang’s scheme lacks. In this paper, however, it is shown that Hsiang-Shih’s scheme cannot withstand user and server impersonation attacks. Their scheme is thus vulnerable to malicious users and insecure for practical applications.
Password based authentication schemes have been widely used to verify the legitimacy of a user over an insecure communication channel. A common feature among most of the published schemes is that user's identity (ID) is static in all the transaction sessions, which may leak some information about the user and can create risk of identity theft during message transaction. Therefore, to provide user anonymity, many dynamic ID based remote users authentication schemes have been proposed. Recently, Khan et al. proposed an efficient and secure dynamic ID based remote user authentication scheme and claimed that their scheme can provide strong security against various attacks. In this paper, we have demonstrated that Khan et al.'s scheme is vulnerable to server spoofing attack and insider attack, and has some flaws in login and authentication phase as well and also proposed an enhanced scheme to overcome the identified weaknesses.
Abstract:In order to efficiently eliminate the security shortcomings of the dynamic ID based remote user authentication scheme using smart cards (short for XJWM scheme) proposed by Xu et al.,a new multi server and multi factor anonymous remote authenticated key agreement protocol was presented,based on Diffie Hellman key agreement algorithm and biometrical authentication technology.The new protocol can not only overcome the security flaws of XJWM scheme,but also add smart card’s password and bio information authentication for the cardholder to avoid the smart card stolen attack.The security of the new protocol was proved by the improved BAN logic and the result showed that the new scheme can ensure the correctness of key agreement,key confidentiality,key freshness and mutual authentication.The security and performance analysis demonstrated that the proposed protocol provides better security without increasing too much computation overhead.
Summary. In 2012, Wen and Li proposed a secure and robust dynamic identity based remote user au-thentication scheme with key agreement using smart cards. They claimed that their scheme is efficient and secure. But in this paper, we demonstrate that their scheme is completely insecure and vulnerable to various known attacks like offline and online password guessing attack, impersonation attack, server mas-querading attack, denial of service attack and an insider attack. Also we point out that there are loopholes in password change phase and online secret renew phase which leads to the desynchronization between user and the server and even the legitimate user is rejected by the server. In addition, an adversary can easily generate the common session key of further transmission between user and the server. Thus the entire system collapses and authors claims are proven to be wrong and their scheme will not be secure and efficient for practical purpose.
Remote user authentication is an essential part in electronic commerce to identify legitimate users over the Internet. However, how to protect user privacy in the authentication has become an important issue recently. Therefore, many secure authentication schemes with smart cards have been proposed. In this paper, we will analyze the security weaknesses of two recently proposed authentication schemes for preserving user privacy. First, Chang et al. (2011) proposed a robust and efficient remote user authentication scheme to provide user anonymity. However, this scheme fails to protect user privacy in terms of anonymity and traceability. In addition, it is vulnerable to the server counterfeit attack and it does not provide perfect forward secrecy for session keys. Furthermore, if the smart card is lost, it will suffer from the offline password guessing attack as well as the user impersonation attack. Second, Wen and Li (2012) recently presented an improved dynamic ID-based authentication scheme with key agreement. However, this scheme is vulnerable to traceability. In addition, it does not support perfect forward secrecy for session keys. Furthermore, the insecure offline password change phase and online secret renewal phase will result in the denial of service attack.
Rapid growth of mobile and networking technologies, resulted in new paradigms of networking like Internet of Things (IoT) etc, which allows user to connect to insecure public communication channel through various devices and can access the services and data provided by remote server. Thus, remote user authentication and key agreement for wireless, wired, IoT communications becoming more challenging task. In this context many researchers have proposed authentication schemes. In 2013, An et al. proposed a dynamic ID-based remote user authentication scheme which is secure, even if the secret values stored in the smart card is revealed. In 2014, Troung et al claimed that An et al scheme is vulnerable to server forgery attack and proposed an improved scheme. In this manuscript, we validate that Troung et al's scheme is vulnerable to known session specific temporary information attack, replay and impersonation attack. Furthermore, we also propose the improved scheme to overcome these limitations without increase in the cost front.