Cryptanalysis of Sun and Cao's Remote Authentication Scheme with User Anonymity

Dynamic ID-based remote user authentication schemes ensure efficient and anonymous mutual authentication between entities. In 2013, Khan et al. proposed an improved dynamic ID-based authentication scheme to overcome the security flaws of Wang et al.'s authentication scheme. Recently, Sun and Cao showed that Khan et al. does not satisfies the claim of the user's privacy and proposed an efficient authentication scheme with user anonymity. The Sun and Cao's scheme achieve improvement over Khan et al.'s scheme in both privacy and performance point of view. Unfortunately, we identify that Sun and Cao's scheme does not resist password guessing attack. Additionally, Sun and Cao's scheme does not achieve forward secrecy

Image based ECC Mutual Authentication Scheme for Cloud Assisted TMIS

In this modern era, cloud-based services like e-commerce, e-gate, and so on provide immense services to humans.    Healthcare centers are gradually moving to cloud-based services. In which, both the hospital and patients are connected remotely online and patient gets treatment quickly. Increasing the demand in Telecare Medical Information System (TMIS) needs to ensure the security and privacy of the healthcare centers and patients’ information. In this paper, we have proposed an e?cient and provably secure Elliptic Curve cryptography image based mutual authentication scheme for cloud assisted TMIS. The proposed authentication schemes ensure the secured treatment provided to patients from healthcare center through online. The patient can upload their health condition data to cloud via mobile device for the treatment.  The proposed authentication scheme required minimum computational cost with minimum communication overhead. The proposed authentication scheme preserves patient anonymity and withstands the known and chosen plaintext attack. The security analysis for the proposed scheme shows that the proposed authentication scheme is more secure. It shows that the proposed authentication scheme is performing well compare to the related authentication schemes

Robust two-factor smart card authentication

Being very resilient devices, smart cards have been commonly used for two-factor authentication schemes. However, the possibility of side-channel attacks renders private data stored in the cards vulnerable to compromise. With this in mind, we propose an authentication protocol that incorporates a second factor, which is as a password, in addition to the smart card. The scheme is aimed to withstand most common security breaches as well as compromised smart card scenarios and offline dictionary attacks on the passwords. Details of a reference implementation are also given along with performance evaluation of the proposed protocol comparing to the literature. Performance analyses show that the proposed protocol outperforms existing solutions in the literature. Moreover, the computational cost of the proposed protocol is less than 2 seconds on our reference implementation that uses commercially available smart cards

Efficient Two-Pass Anonymous Identity Authentication Using Smart Card

Recently, Khan et al. proposed an enhancement on a remote authentication scheme designed by Wang et al. which emphasizes on using dynamic identity. They claim that their improvement can avoid insider attack. However, we found the scheme lacks the anonymity property. Moreover, R. Madhusudhan et al. indicate their scheme also suffers the insider attack. Due to these observations, in this paper we propose a novel one which not only anonymously authenticates the remote user by using only two passes but also satisfies the ten requirements of an authentication scheme using smart card mentioned by Liao et al.

A Test Environment for Wireless Hacking in Domestic IoT Scenarios

Security is gaining importance in the daily life of every citizen. The advent of Internet of Things devices in our lives is changing our conception of being connected through a single device to a multiple connection in which the centre of connection is becoming the devices themselves. This conveys the attack vector for a potential attacker is exponentially increased. This paper presents how the concatenation of several attacks on communication protocols (WiFi, Bluetooth LE, GPS, 433 Mhz and NFC) can lead to undesired situations in a domestic environment. A comprehensive analysis of the protocols with the identification of their weaknesses is provided. Some relevant aspects of the whole attacking procedure have been presented to provide some relevant tips and countermeasures.This work has been partially supported by the Spanish Ministry of Science and Innovation through the SecureEDGE project (PID2019-110565RB-I00), and by the by the Andalusian FEDER 2014-2020 Program through the SAVE project (PY18-3724). // Open Access funding provided thanks to the CRUE-CSIC agreement with Springer Nature. // Funding for open access charge: Universidad de Málaga / CBU