JOURNAL OF HIGH-FREQUENCY COMMUNICATION TECHNOLOGIES
Web-based User Authentication and Access Control: An Enhanced Multi-Factor Biometric Cryptographic Scheme Based on Client File and S13 Quantum Key Distribution Protocol
Bello Alhaji Buhari, Afolayan A. Obiniyi, Sahalu Balarabe Junaidu, Armand F. Donfack Kana
Several remote user authentication schemes have been proposed using external memory and smart cards. Smart card-based schemes have user mobility and deployment problems, and those based on external memory have a tamper resistance problem. Although Cherbal and Benchetioui’s scheme solved remote authentication problems using Elliptical Curve Cryptography and 2-Factor authentication, they still have not addressed key distribution, perfect forward secrecy, and session hijacking issues. This research proposes an enhanced multi-factor authentication and access control scheme based on the S13 quantum key distribution protocol, using a client file in an external memory. The proposed scheme combines the powers of an enhanced quantum key distribution, a lightweight tamper-resistance client file, and biometrics to overcome these limitations. The security of the proposed scheme was verified, validated, and evaluated against the reviewed scheme using various tools. The AVISPA simulation results showed that the proposed scheme is validated, secure against session hijacking, has a secure key distribution policy, and ensures perfect forward secrecy. The security functionalities analysis shows that the proposed scheme has the highest security index of 13 and is the only scheme that used the tamper-resistance client file in an external memory for the first time. The performance evaluation results showed that the proposed scheme is more efficient than the reviewed scheme with a computation cost of 0.83125s and 0.25902s and a percentage improvement of 48.48% and 73.98% for the respective user and server and a more efficient communication costs of 2112 bits than the reviewed scheme with a percentage improvement of 16.46%.
Several remote user authentication schemes have been proposed using external memory and smart cards. Smart card-based schemes have user mobility and deployment problems, and those based on external memory have a tamper resistance problem. Although Cherbal and Benchetioui’s scheme solved remote authentication problems using Elliptical Curve Cryptography and 2-Factor authentication, they still have not addressed key distribution, perfect forward secrecy, and session hijacking issues. This research proposes an enhanced multi-factor authentication and access control scheme based on the S13 quantum key distribution protocol, using a client file in an external memory. The proposed scheme combines the powers of an enhanced quantum key distribution, a lightweight tamper-resistance client file, and biometrics to overcome these limitations. The security of the proposed scheme was verified, validated, and evaluated against the reviewed scheme using various tools. The AVISPA simulation results showed that the proposed scheme is validated, secure against session hijacking, has a secure key distribution policy, and ensures perfect forward secrecy. The security functionalities analysis shows that the proposed scheme has the highest security index of 13 and is the only scheme that used the tamper-resistance client file in an external memory for the first time. The performance evaluation results showed that the proposed scheme is more efficient than the reviewed scheme with a computation cost of 0.83125s and 0.25902s and a percentage improvement of 48.48% and 73.98% for the respective user and server and a more efficient communication costs of 2112 bits than the reviewed scheme with a percentage improvement of 16.46%.
In this article, the authors have proposed a secure two-factor remote user authentication and session key agreement protocol. As they have shown in the presented scheme, is precise and secure according to both formal and informal security analysis. For formal security analysis, they have applied BAN (Burrows-Abadi-Needham) logic which certifies that the presented scheme provides the amenity of mutual authentication and session key agreement safely. The informal security verification has shown that the proposed scheme is more vigorous against various sort of cruel threats. Moreover, the authors have simulated the presented scheme using broadly accepted AVISPA tool, whose simulation results make sure that the protocol is not dangerous from active and passive attacks together with replay and man-in-the-middle attacks. In addition, the performance evaluation and the security comparison have revealed that the presented scheme gives strong security as well as better complexity in the context of smart card memory requirement, communication cost and computation cost.
Abstract:In order to efficiently eliminate the security shortcomings of the dynamic ID based remote user authentication scheme using smart cards (short for XJWM scheme) proposed by Xu et al.,a new multi server and multi factor anonymous remote authenticated key agreement protocol was presented,based on Diffie Hellman key agreement algorithm and biometrical authentication technology.The new protocol can not only overcome the security flaws of XJWM scheme,but also add smart card’s password and bio information authentication for the cardholder to avoid the smart card stolen attack.The security of the new protocol was proved by the improved BAN logic and the result showed that the new scheme can ensure the correctness of key agreement,key confidentiality,key freshness and mutual authentication.The security and performance analysis demonstrated that the proposed protocol provides better security without increasing too much computation overhead.
Remote user authentication is an essential part in electronic commerce to identify legitimate users over the Internet. However, how to protect user privacy in the authentication has become an important issue recently. Therefore, many secure authentication schemes with smart cards have been proposed. In this paper, we will analyze the security weaknesses of two recently proposed authentication schemes for preserving user privacy. First, Chang et al. (2011) proposed a robust and efficient remote user authentication scheme to provide user anonymity. However, this scheme fails to protect user privacy in terms of anonymity and traceability. In addition, it is vulnerable to the server counterfeit attack and it does not provide perfect forward secrecy for session keys. Furthermore, if the smart card is lost, it will suffer from the offline password guessing attack as well as the user impersonation attack. Second, Wen and Li (2012) recently presented an improved dynamic ID-based authentication scheme with key agreement. However, this scheme is vulnerable to traceability. In addition, it does not support perfect forward secrecy for session keys. Furthermore, the insecure offline password change phase and online secret renewal phase will result in the denial of service attack.
A significant problem facing cybersecurity is that most client/server identity authentication schemes depend on computational complexity which is recently challenged by the super exponential computational abilities of quantum computers. Quantum cryptography with its quantum mechanics principles solves this problem and provides mathematically un-hackable secure communication for the quantum computers epoch. Biometric authentication has a big challenge related to its protection as it has to be submitted and stored in encrypted form. Unfortunately, most existing biometric cryptosystems rely on classical cryptography, so they are insecure in quantum era. This problem is solved in this paper by introducing a novel three-factor biometric quantum identity authentication scheme combining something you know (password), something you produce (client’s voice), and something you are (client’s face image) is proposed. The scheme consists of two phases: client enrollment and client login/authentication. The methodology is to use in the enrollment phase, two layers of quantum encryption for the client’s voice signal. Each layer consists of two simple quantum circuits of SWAP and C-NOT quantum gates respectively using a different pseudorandom key obtained from a cellular automata (CA) pseudorandom generator. The proposed scheme has many merits. Firstly, it introduces a new design of muti-factors quantum biometric authentication scheme as the biometric voice data is processed, transmitted, and stored at the server database in an encrypted unconditionally secure quantum form which provides parallel processing, real-time communications, inherent level of security against attacks, tamper-proof security and exponential powerful storage capability due to the quantum properties. Secondly, the proposed scheme achieves double-layers security by combing quantum voice encryption and quantum secure direct communication in one process such that the quantum channel eavesdropper cannot obtain any valuable information in case of information leakage. Thirdly, the distribution and management of encryption key problem is solved as there is no need for key exchange prior to communication. Fourthly, it achieves high communication efficiency as although it is a three-factor biometric identity authentication, only one biometric data is sent in quantum encrypted form to the server. Fifthly, the numerical simulations showed that the proposed scheme has large key space, high key sensitivity and more robust performance against different types of attacks compared to other existing classical and quantum voice encryption schemes. Finally, as an identity authentication method, the proposed scheme achieves identification accuracy of 100% with zero False Rejection Rate (FRR) and zero False acceptance rate (FAR) which is perfect.
Remote user authentication has become an essential part in e-commerce and mobile-commerce to provide security over the Internet. Recently, Chung et al. proposed a very robust and complicated authentication scheme for resource-limited devices using non-tamper-resistant smart cards with many merits. However, in this paper, we will show that Chung et al.’s scheme is vulnerable to the generic man-in-the-middle attack, and thus it fails to achieve mutual authentication. We will then present an improved simple and elegant scheme to get rid of its weaknesses while retaining all of its merits. One of the promising features of our scheme is that it simply applies the Diffie-Hellman key agreement mechanism to achieve mutual authentication, session key exchange, and perfect forward secrecy.