Abstract:Providing secure, efficient, and privacy-preserving user authentication in mobile networks is a challenging problem due to the inherent mobility of users, variety of attack vectors, and resource-constrained nature of user devices. Recent studies show that identity-based cryptosystems can eliminate the certificate overhead and thus address the issues associated with public-key infrastructure technology-which is a rare bit of good news in today's computer security world. In this paper, we employ three representative identity-based remote user authentication schemes (i.e., Truong et al.'s scheme, Li et al.'s scheme, and Zhang et al.'s scheme) as case studies to reveal the challenges and subtleties in designing a practical authentication scheme for mobile devices. First, we demonstrate that Truong et al.'s scheme, which was presented at the IEEE AINA 2012, cannot achieve a few important security goals under our new attacking scenarios: 1) it fails to resist against known session-specific temporary information attack; 2) it cannot withstand key compromise impersonation attack; and 3) it is of poor usability. Second, we show that Li et al.'s privacy-preserving scheme, which was proposed at GLOBECOM 2012, is subject to some subtle (yet severe) efficiency problems that make it virtually impossible for any practical use. Third, we scrutinize a "provably secure" scheme for roaming services in mobile networks designed by Zhang et al. at SCN 2015 and find it prone to collusion attack and replay attack. Further, we investigate into the underlying causes for these identified failures, and figure out an improvement over Truong et al.'s scheme to overcome the revealed challenges while maintaining reasonable efficiency.

A PRIVACY-PRESERVING AUTHENTICATION SCHEME USING BIOMETRICS FOR PERVASIVE COMPUTING ENVIRONMENTS

Authentication scheme based on biometric encryption for pervasive computing environments

Inter-domain authentication scheme for Pervasive Computing Environments

An Inter-Domain Authentication Scheme For Pervasive Computing Environment

Authentication Scheme Based on Biometric Encryption

Provably secure authentication protocol based on convertible proxy signcryption in cloud computing

Dynamic Authentication with Sensory Information for the Access Control Systems.

��计算中基于可转换代理签密的可证安全的认证协议

Privacy Enhanced Access Control in Pervasive Computing Environments

Privacy-enhanced, Attack-resilient Access Control in Pervasive Computing Environments with Optional Context Authentication Capability

A novel privacy-preserving biometric authentication scheme

An efficient authentication scheme syncretizing physical unclonable function and revocable biometrics in Industrial Internet of Things

Cryptanalysis and Improvement of a Biometrics-Based Authentication and Key Agreement Scheme for Multi-Server Environments

Authentication Scheme of Remote Users by Using Multimodal Biometric and Smart Cards

A Generic Privacy-Preserving Protocol For Keystroke Dynamics-Based Continuous Authentication

Privacy-Preserving Universal Authentication Protocol for Wireless Communications

CloudBI: Practical Privacy-Preserving Outsourcing of Biometric Identification in the Cloud

Improved privacy-preserving authentication scheme for roaming service in mobile networks

On the Challenges in Designing Identity-Based Privacy-Preserving Authentication Schemes for Mobile Devices

Achieving Efficient and Privacy-preserving Biometric Identification in Cloud Computing

An Improved Biometrics Based Authentication Scheme Using Extended Chaotic Maps for Multimedia Medicine Information Systems