Abstract:As the most prevailing two-factor authentication mechanism, smart-card-based password authentication has been a subject of intensive research in the past two decades, and hundreds of this type of schemes have wave upon wave been proposed. In most of these studies, there is no comprehensive and systematical metric available for schemes to be assessed objectively, and the authors present new schemes with assertions of the superior aspects over previous ones, while overlooking dimensions on which their schemes fare poorly. Unsurprisingly, most of them are far from satisfactory—either are found short of important security goals or lack of critical properties, especially being stuck with the security-usability tension. To overcome this issue, in this work we first explicitly define a security model that can accurately capture the practical capabilities of an adversary and then suggest a broad set of twelve properties framed as a systematic methodology for comparative evaluation, allowing schemes to be rated across a common spectrum. As our main contribution, a new scheme is advanced to resolve the various issues arising from user corruption and server compromise, and it is formally proved secure under the harshest adversary model so far. In particular, by integrating “honeywords”, traditionally the purview of system security, with a “fuzzy-verifier”, our scheme hits “two birds”: it not only eliminates the long-standing security-usability conflict that is considered intractable in the literature, but also achieves security guarantees beyond the conventional optimal security bound.

Understanding security failures of two-factor authentication schemes for real-time applications in hierarchical wireless sensor networks.

A secure and efficient user authentication protocol for two-tiered wireless sensor networks

An Efficient and DoS-resistant User Authentication Scheme for Two-Tiered Wireless Sensor Networks

On the anonymity of two-factor authentication schemes for wireless sensor networks: Attacks, principle and solutions

On the anonymity of two-factor authentication schemes for wireless sensor networks

An Efficient Two-Factor User Authentication Framework for Wireless Sensor Networks

Cryptanalysis and Security Enhancement of Three Authentication Schemes in Wireless Sensor Networks.

An Enhanced Two-factor User Authentication Scheme in Wireless Sensor Networks.

Security Solution For Real-Time Data Access In Wireless Sensor Networks

Understanding Security Failures of Multi-Factor Authentication Schemes for Multi-Server Environments

Efficient Multi-Factor User Authentication Protocol with Forward Secrecy for Real-Time Data Access in WSNs

Measuring Two-Factor Authentication Schemes for Real-Time Data Access in Industrial Wireless Sensor Networks.

On the Usability of Two-Factor Authentication.

Lightweight Three Factor Scheme for Real-Time Data Access in Wireless Sensor Networks

An Improved and Provably Secure Three-Factor User Authentication Scheme for Wireless Sensor Networks

Revisiting Anonymous Two-Factor Authentication Schemes for IoT-Enabled Devices in Cloud Computing Environments.

An efficient and lightweight user authentication scheme for wireless sensor networks

A Provably Secure and Lightweight Two-Factor Authentication Protocol for Wireless Sensor Network

A Lightweight Secure User Authentication and Key Agreement Protocol for Wireless Sensor Networks.

Two Birds with One Stone: Two-Factor Authentication with Security Beyond Conventional Bound.

Robust Multi-Factor Authentication for WSNs With Dynamic Password Recovery