331 research outputs found
Unreliable Network Re-Authentication Protocol Based On Hybrid Key Using CSP Approach.
Network security is becoming increasingly vital in today's fast growing mobile computing environment. Due to constraints in device size and portability, limited processing power, small disk capacity, intermittent network disconnections and frequent switching between network access points have been observed in mobile devices
An Authentication Protocol for Future Sensor Networks
Authentication is one of the essential security services in Wireless Sensor
Networks (WSNs) for ensuring secure data sessions. Sensor node authentication
ensures the confidentiality and validity of data collected by the sensor node,
whereas user authentication guarantees that only legitimate users can access
the sensor data. In a mobile WSN, sensor and user nodes move across the network
and exchange data with multiple nodes, thus experiencing the authentication
process multiple times. The integration of WSNs with Internet of Things (IoT)
brings forth a new kind of WSN architecture along with stricter security
requirements; for instance, a sensor node or a user node may need to establish
multiple concurrent secure data sessions. With concurrent data sessions, the
frequency of the re-authentication process increases in proportion to the
number of concurrent connections, which makes the security issue even more
challenging. The currently available authentication protocols were designed for
the autonomous WSN and do not account for the above requirements. In this
paper, we present a novel, lightweight and efficient key exchange and
authentication protocol suite called the Secure Mobile Sensor Network (SMSN)
Authentication Protocol. In the SMSN a mobile node goes through an initial
authentication procedure and receives a re-authentication ticket from the base
station. Later a mobile node can use this re-authentication ticket when
establishing multiple data exchange sessions and/or when moving across the
network. This scheme reduces the communication and computational complexity of
the authentication process. We proved the strength of our protocol with
rigorous security analysis and simulated the SMSN and previously proposed
schemes in an automated protocol verifier tool. Finally, we compared the
computational complexity and communication cost against well-known
authentication protocols.Comment: This article is accepted for the publication in "Sensors" journal. 29
pages, 15 figure
Accountable authentication with privacy protection: The Larch system for universal login
Credential compromise is hard to detect and hard to mitigate. To address this
problem, we present larch, an accountable authentication framework with strong
security and privacy properties. Larch protects user privacy while ensuring
that the larch log server correctly records every authentication. Specifically,
an attacker who compromises a user's device cannot authenticate without
creating evidence in the log, and the log cannot learn which web service
(relying party) the user is authenticating to. To enable fast adoption, larch
is backwards-compatible with relying parties that support FIDO2, TOTP, and
password-based login. Furthermore, larch does not degrade the security and
privacy a user already expects: the log server cannot authenticate on behalf of
a user, and larch does not allow relying parties to link a user across
accounts. We implement larch for FIDO2, TOTP, and password-based login. Given a
client with four cores and a log server with eight cores, an authentication
with larch takes 150ms for FIDO2, 91ms for TOTP, and 74ms for passwords
(excluding preprocessing, which takes 1.23s for TOTP).Comment: This is an extended version of a paper appearing at OSDI 202
Leakage-resilient biometric-based remote user authentication with fuzzy extractors
National Research Foundation (NRF) Singapor
A Lockdown Technique to Prevent Machine Learning on PUFs for Lightweight Authentication
We present a lightweight PUF-based authentication approach that is practical in settings where a server authenticates a device, and for use cases where the number of authentications is limited over a device's lifetime. Our scheme uses a server-managed challenge/response pair (CRP) lockdown protocol: unlike prior approaches, an adaptive chosen-challenge adversary with machine learning capabilities cannot obtain new CRPs without the server's implicit permission. The adversary is faced with the problem of deriving a PUF model with a limited amount of machine learning training data. Our system-level approach allows a so-called strong PUF to be used for lightweight authentication in a manner that is heuristically secure against today's best machine learning methods through a worst-case CRP exposure algorithmic validation. We also present a degenerate instantiation using a weak PUF that is secure against computationally unrestricted adversaries, which includes any learning adversary, for practical device lifetimes and read-out rates. We validate our approach using silicon PUF data, and demonstrate the feasibility of supporting 10, 1,000, and 1M authentications, including practical configurations that are not learnable with polynomial resources, e.g., the number of CRPs and the attack runtime, using recent results based on the probably-approximately-correct (PAC) complexity-theoretic framework
A Practical Attack on the MIFARE Classic
The MIFARE Classic is the most widely used contactless smart card in the
market. Its design and implementation details are kept secret by its
manufacturer. This paper studies the architecture of the card and the
communication protocol between card and reader. Then it gives a practical,
low-cost, attack that recovers secret information from the memory of the card.
Due to a weakness in the pseudo-random generator, we are able to recover the
keystream generated by the CRYPTO1 stream cipher. We exploit the malleability
of the stream cipher to read all memory blocks of the first sector of the card.
Moreover, we are able to read any sector of the memory of the card, provided
that we know one memory block within this sector. Finally, and perhaps more
damaging, the same holds for modifying memory blocks
- …