Abstract:Providing secure, efficient, and privacy-preserving user authentication in mobile networks is a challenging problem due to the inherent mobility of users, variety of attack vectors, and resource-constrained nature of user devices. Recent studies show that identity-based cryptosystems can eliminate the certificate overhead and thus address the issues associated with public-key infrastructure technology-which is a rare bit of good news in today's computer security world. In this paper, we employ three representative identity-based remote user authentication schemes (i.e., Truong et al.'s scheme, Li et al.'s scheme, and Zhang et al.'s scheme) as case studies to reveal the challenges and subtleties in designing a practical authentication scheme for mobile devices. First, we demonstrate that Truong et al.'s scheme, which was presented at the IEEE AINA 2012, cannot achieve a few important security goals under our new attacking scenarios: 1) it fails to resist against known session-specific temporary information attack; 2) it cannot withstand key compromise impersonation attack; and 3) it is of poor usability. Second, we show that Li et al.'s privacy-preserving scheme, which was proposed at GLOBECOM 2012, is subject to some subtle (yet severe) efficiency problems that make it virtually impossible for any practical use. Third, we scrutinize a "provably secure" scheme for roaming services in mobile networks designed by Zhang et al. at SCN 2015 and find it prone to collusion attack and replay attack. Further, we investigate into the underlying causes for these identified failures, and figure out an improvement over Truong et al.'s scheme to overcome the revealed challenges while maintaining reasonable efficiency.

A Defence Scheme Against Identity Theft Attack Based on Multiple Social Networks

A Novel User Authentication Scheme Using Smart Cards.

Building Artificial Identities in Social Network Using Semantic Information

A Privacy?Preserving and Trusted Social Relationship Similarity Detection Protocol in Mobile Social Networks

A Privacy-Preserving Scheme for Interactive Messaging over Online Social Networks.

Hidden the True Identity and Dating Characteristics Based on Quick Private Matching in Mobile Social Networks

Protect You More Than Blank：Anti-Learning Sensitive User Information in the Social Networks

Need for Symmetry: Addressing Privacy Risks in Online Social Networks

A Lightweight Fingerprint Recognition Mechanism of User Identification in Real-Name Social Networks.

A Secure Dynamic Identity Based Remote User Authentication Scheme Using Secret Sharing

An Identity Authentication Protocol in Online Social Networks

Private Social Network Data Sharing

FBI - Friendship Learning-Based User Identification in Multiple Social Networks.

I Know Your Social Network Accounts: A Novel Attack Architecture for Device-Identity Association

Deep Learning Based Attack on Social Authentication System

Privacy-Preserving Subgraph Matching Scheme With Authentication in Social Networks

Lightweight Mutual Authentication Scheme for Protecting Identity in Insecure Environment

A Secure Cross-Domain Access Control Scheme in Social Networks.

A New Access Control Scheme for Facebook-style Social Networks

A Privacy-Preserving Scheme for Online Social Networks with Efficient Revocation

On the Challenges in Designing Identity-Based Privacy-Preserving Authentication Schemes for Mobile Devices