Research and Improvement on EAP-AKA

ZHANG Shu-bin,SUN Hao,WU Yue

DOI: https://doi.org/10.3969/j.issn.1009-8054.2007.10.031

2007-01-01

Abstract:This paper describes EAP-AKA authentication method. By giving the safety assessment of the authentication method,some security loopholes are pointed out,the possible attacks analyzed,some improvement suggestions according to these problems proposed,and the feasibility of the modified agreement illustrated.

What problem does this paper attempt to address?

Improved EAP-AKA Protocol Based on Redirection Defense

Binbin Yu,Jianwu Zhang,Zhendong Wu

DOI: https://doi.org/10.1109/3pgcic.2014.106

2014-01-01

Abstract:With the substantial popularity of smartphones and the increasing development of wireless technology, users have higher and higher demands for seamless data connection, which involves the vertical handover and unified authentication between heterogeneous networks. 3G-WLAN network is the most widely studied and used scheme which uses EAP-AKA protocol as its authentication protocol. However, EAP-AKA protocol contains a number of security vulnerabilities of AKA. The most serious problem of them is the complete trust in APs. This paper analyzes the security flaws of EAP-AKA protocol, and presents a kind of redirection attack based on the complete trust in APs, and then simulates it. Finally we propose an improved EAP-AKA protocol to prevent redirection attack.
Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

XIE Qi,CHEN De-ren,YU Xiu-yuan

IF: 2.034

2010-01-01

Systems Engineering

Abstract:In 2009, Park, et al. proposed an efficient remote user authentication protocol. They claimed that their protocol was the first password and smart card based remote user authentication scheme which can resist the off-line password guessing attack, and had many advantages over existing solutions such as no password tables and timestamp, low communication and computational costs. However, this paper shows that their protocol cannot resist the forgery attack and off-line password guessing attack. To overcome the security weaknesses, two improved schemes based on either nonce or timestamp without affecting the merits of the Park, et al. scheme are proposed. Technical discussions are provided to show that the improved protocol is secure, efficient and practical.
Security analysis of the eCK model

NI Liang,CHEN Gong-liang,LI Jian-hua

DOI: https://doi.org/10.6040/j.issn.1671-9352.1.2013.089

2013-01-01

Abstract:Authenticated key agreement(AKA) protocol should capture desirable security properties as many as possible.As a formal method recently proposed to design and analyze tw o-party AKA protocols,the eCK model is currently receiving more and more attention,and the exact security guarantees that can be provided by this model are w orthy of in-depth research.Hence,the relationship betw een the eCK model and the basic desirable security properties for AKA protocols is analyzed in detail.The conclusions indicate that AKA protocols w ith provable security in the eCK model capture most basic desirable security properties.Thereafter,the advantages and disadvantages of the eCK model are also summarized.
Analysis and Application of Eap_aka for Ieee Standard 802.16E

Fan Yang

DOI: https://doi.org/10.1109/wicom.2011.6040538

2011-01-01

Abstract:Abstract- In IEEE Standard 802.16e, there are two privacy key management editions PKMv1 and PKMv2. PKMv2 as a supplement is used to improve the IEEE standard 802.16e security, in which EAP as an optional authentication protocol besides RSA is involved in several authentication modes. However how to use EAP methods in different authentication mode has not been detailed. In this paper, common EAP methods will be compared according to authentication requirement in IEEE standard 802.16e. Then the EAP_AKA as selected method for EAP-EAP authentication mode will be detailed. The security and authentication cost also will be compared with the existed improved methods.
Study of Network Authentication Based on RADIUS Protocol

YANG Jian-jun,JIA Chen-jun,RAN Li-xin

DOI: https://doi.org/10.3785/j.issn.1008-973x.2005.02.014

2005-01-01

Abstract:By analyzing the principle of remote authentication dial in user service (RADIUS) protocol and the applied security algorithm, an improved RADIUS protocol was proposed to enhance the security performance of networks.Based on the improved protocol,AAA (authentication,authority and account) architecture was set up for the Internet service providers.The AAA architecture for wireless gateway does not increase the complexity of the communication systems, and is simple and easy to implement.
Security Analysis on an Improvement of RSA-Based Password Authenticated Key Exchange.

SH Wang,F Bao,J Wang

DOI: https://doi.org/10.1093/ietcom/e88-b.4.1641

2005-01-01

IEICE Transactions on Communications

Abstract:In 2002, Zhu et al. proposed a password authenticated key exchange protocol based on RSA such that it is efficient enough to be implemented on most of the target low-power devices such as smart cards and low-power Personal Digital Assistants in imbalanced wireless networks. Recently, YEH et al. claimed that Zhu et al.'s protocol not only is insecure against undetectable on-line password guessing attack but also does not achieve explicit key authentication. Thus they presented an improved version. Unfortunately, we find that YEH et al.'s password guessing attack does not come into existence, and that their improved protocol is vulnerable to off-line dictionary attacks. In this paper we describe our observation in details, and also comment for the original protocol on how to achieve explicit key authentication as well as resist against other existent attacks.
Comparative Studies on Authentication and Key Exchange Methods for 802.11 Wireless LAN

Jun Lei,Xiaoming Fu,Dieter Hogrefe,Jianrong Tan

DOI: https://doi.org/10.1016/j.cose.2007.01.001

IF: 5.105

2007-01-01

Computers & Security

Abstract:IEEE 802.11 wireless LAN has become one of the hot topics on the design and development of network access technologies. In particular, its authentication and key exchange (AKE) aspects, which form a vital building block for modern security mechanisms, deserve further investigation. In this paper we first identify the general requirements used for WLAN authentication and key exchange (AKE) methods, and then classify them into three levels (mandatory, recommended, and additional operational requirements). We present a review of issues and proposed solutions for AKE in 802.11 WLANs. Three types of existing methods for addressing AKE issues are identified, namely, the legacy, layered and access control-based AKE methods. Then, we compare these methods against the identified requirements. Based on the analysis, a multi-layer AKE framework is proposed, together with a set of design guidelines, which aims at a flexible, extensible and efficient security as well as easy deployment.
Analysis and Improvement of a Password-Based Authenticated Key Exchange Protocol

舒剑,许春香

DOI: https://doi.org/10.3969/j.issn.1000-436x.2010.03.008

2010-01-01

Abstract:The security of a recently proposed password-based authenticated key exchange protocol was analyzed. Al- though it was provably secure in the standard model, it was vulnerable to reflection attacks. A modify scheme was pro- posed, which eliminated the defect of original scheme and improved the efficiency of the protocol. The security of the proposed scheme had been proven in the standard model under DDH assumption. The results show that it provides per- fect forward secrecy.
Strongly Secure Two Party Authenticated Key Agreement Scheme

LIU Wen-hao,XU Chun-xiang

DOI: https://doi.org/10.3969/j.issn.1001-3695.2011.03.096

2011-01-01

Abstract:This paper proposed a new strongly secure AKA scheme.The new scheme satisfied many known desirable security properties for AKA including resistance to key-compromise impersonation(KCI)attacks,resilience to the leakage of known session-specific temporary information and the leakage of hash values.The new scheme was secure in the eCK model as long as each party had at least one uncompromised secret,what's more,the new scheme enhanced the computational efficiency.
A Provably-Secure and Efficient Verifier-Based Anonymous Password-Authenticated Key Exchange Protocol

Xiaoyan Yang,Han Jiang,Qiuliang Xu,Mengbo Hou,Xiaochao Wei,Minghao Zhao,Kim-Kwang Raymond Choo

DOI: https://doi.org/10.1109/trustcom.2016.0124

2016-01-01

Abstract:Anonymous password-based authenticated key exchange (APAKE) protocols are a topic of ongoing research interest. However, the security of existing APAKE protocols is generally provided in the random oracle model, and in these protocols, passwords are stored in cleartext on the server. However, proofs of security in the random oracle model do not necessarily imply security in the real world. Recent high profile incidents also indicate the real risk of a server being compromised and information stored on the server leaked. Verifier-based password-authenticated key exchange (VPAKE) protocols have been identified as a viable solution to overcome such limitations. In this paper, we propose a novel verifier-based anonymous password-authenticated key exchange (VAPAKE) protocol constructed using smooth projective hashing function. The proposed protocol only involves two-round interactions for mutual implicit authentication. We then prove the security of the protocol in the standard model.
An anonymous authentication and key agreement protocol in smart living

Fengyin Li,Xinying Yu,Yang Cui,Siqi Yu,Yuhong Sun,Yilei Wang,Huiyu Zhou

DOI: https://doi.org/10.1016/j.comcom.2022.01.019

IF: 5.047

2022-01-01

Computer Communications

Abstract:Wireless Sensor Networks (WSNs) play an indispensable role in the application of smart homes, smart healthcare, and precision agriculture. However, WSNs confront privacy risks that hinder its practical applications. The leakage of privacy is one of the key factors to restrict the development of WSNs. Hence, in this paper, we propose an Anonymous Authentication and Key Agreement protocol (AAKA) to accomplish identity authentication and privacy protection. Based on the dynamic sequence number, the shared secret value, and the dynamic random number, the AAKA protocol implements a two-way authentication and keys negotiation among users, gateway, and sensors, which achieves the secure access control of legitimate users to WSNs and ensures the confidential transmission of data over the public channel. We perform the security proof with BAN logic for security evaluation. The performance analysis demonstrates that compared with other WSNs authentication schemes, the AAKA protocol obtained better security features, smaller storage, and more efficient communication. Therefore, it is more suitable for applications in smart living.
Analysis and Improvement of RFID Security Authentication Protocol HSAP

ZHANG Wenli

DOI: https://doi.org/10.3969/j.issn.2095-2163.2012.05.024

2012-01-01

Abstract:With the growing application of RFID systems,more and more attention are paid to RFID security issues.Hash-based RFID security protocol has been widely used due to its low-cost,but its safety performance is not perfect.The paper presents an improved security authentication protocol IHSAP based on the analysis of the existing security protocol and this protocol can prevent many threats including contents privacy,location tracing,replay attack,spoofing attack etc.So it is a better security protocol in performance,and it has some practical value in the actual environment.
An Improved Anonymous Remote User Authentication Scheme with Key Agreement Based on Dynamic Identity

Yajuan Shi,Han Shen,Yuanyuan Zhang,Jianhua Chen

DOI: https://doi.org/10.14257/ijseia.2015.9.5.25

2015-01-01

International Journal of Software Engineering and Its Applications

Abstract:To keep the pace with the development of internet technology, remote user authentication techniques become more and more important to protect user's privacy. Recently, Kumari, et al., presented an improved remote user authentication scheme with key agreement based on dynamic-identity using smart card. This scheme allows legal users to change the password at his will without the need to connect the server. They claimed that their scheme could resist smart card stolen or loss attack, user impersonation and server masquerading attack, and provide user anonymity and untraceability and so on. However, our research indicates that their scheme is completely unsafe. Furthermore, the scheme can't provide the proper mutual authentication. In this manuscript, we will propose a new scheme, which can withstand those attacks mentioned above and provide the perfect user anonymity and forward secrecy. Security analysis makes it clear that the improved scheme apparently is more secure and practical.
Design of EAP authentication subsystem in Radius server

Chang LIU,Cheng-quan AN

DOI: https://doi.org/10.3969/j.issn.1672-0946.2016.02.020

2016-01-01

Abstract:Information security of wireless network has been an important factor that limits its development.A solution to this problem is to deploy the EAP authentication subsystem in the authentication server.Radius is the most widely used AAA protocol to provide user authenti-cation, authorization and accounting services.Based on EAP protocol, it can support a vari-ety of different security authentication methods on the Radius server.In this paper, an EAP authentication subsystem was presented on the Radius server.This system supports five au-thentication methods including EAP-MD5, EAP-MSCHAPv2, EAP-TLS, EAP-TTLS, EAP-PEAP, and has good security and expansibility.
An ID-Based Key Agreement and Authentication Scheme in WLAN

Han LIU,Da-wu GU,Qing-zu SHI

DOI: https://doi.org/10.3321/j.issn:1006-2467.2005.08.029

2005-01-01

Shanghai Jiaotong Daxue Xuebao/Journal of Shanghai Jiaotong University

Abstract:The wireless local area network (WLAN) security standard made by China (WAPI)——uses public key certificates mechanism to implement two-way authentication and private communication. It provides good security solution for large-scale WLAN. However, the system based on WAPI is complex and has security flaws. The identity-based cryptosystem was adopted in WLAN to implement key agreement and two-way authentication. This scheme simplifies the system architecture and is more feasible in small-scale or middle-scale WLAN. It also overcomes the security flaws in WAPI. By the performance analysis, security analysis and contrast to WAPI, the new scheme is proved to be more suitable for small-scale or middle-scale WLAN.
ID Authentication-based Key Exchange for Wireless Security

WANG Ying-jie,LUO Wei,XU Xiao-fei

DOI: https://doi.org/10.3969/j.issn.1002-0802.2009.11.031

2009-01-01

Abstract:Authenticated key exchange (AKE) protocols are designed to allow mutual authentication and generation of a cryptographically-secure session key. For wireless security, the password-based authentication scheme is usually vulnerable to dictionary attack though might have a low system cost. This paper proposes an ID authentication-based key exchange scheme for wireless security, which has light computational overhead, is resistant to impersonation attack, and also of other security attributes.
Analyzing the Security Flaws of Internet Key Exchange Protocols

张勇,冯东雷,陈涵生,白英彩

2002-01-01

Journal of Software

Abstract:IKE (Internet key exchange, RFC2409) describes a suite of Internet key exchange protocols for establishing security associations and obtaining authenticated keying material. A security flaw in these IKE protocols is observed and a simple modification is proposed. In this paper, it is pointed out that there is a neglected security flaw in the amended IKE protocols. And a successful attack on the amended IKE protocols is also provided. A new amendment to IKE protocols is proposed, and the reasons which cause the two security flaws are analyzed by using BAN logic successfully.
E-SAKA Algorithm for Key Agreement

yang zhaolu,fan lei,li jianhua

DOI: https://doi.org/10.3969/j.issn.1002-0802.2003.03.036

2003-01-01

Abstract:Key agreement is the procedure that t he two sides of the communication negotiate a session key.A simple au-thenticated key agreement algorith m(SAKA)and its enhanced protocols have been developed.They are simple,but some weak-nesses are founded in them.
On Security Analysis of an After-the-fact Leakage Resilient Key Exchange Protocol

Zheng Yang,Shuangqing Li

DOI: https://doi.org/10.1016/j.ipl.2015.08.006

IF: 0.851

2016-01-01

Information Processing Letters

Abstract:In this paper, we revisit the security result of an authenticated key exchange (AKE) scheme proposed in AsiaCCS'14 by Alawatugoda, Stebila and Boyd (which is referred to as ASB scheme). The ASB scheme is proved to be secure in a new bounded (continuous) after-the-fact leakage extended Canetti–Krawczyk (B(C)AFL-eCK) model without random oracles, where the B(C)AFL-eCK is extended from the eCK model. However we disprove their security results. We first show an attack against ASB scheme in the eCK model. This also implies that the insecurity of ASB scheme in the B(C)AFL-eCK model. Secondly we point out that the security of ASB scheme is incorrectly reduced to DDH assumption. A solution is proposed to fix the problem of ASB scheme with minimum changes, which yields a new ASB' scheme. We prove the eCK security of ASB' in the random oracle model under Gap Diffie–Hellman assumption.
Weakness Analysis and Improvement of a Gateway-Oriented Password-Based Authenticated Key Exchange Protocol

He Debiao,Chen Jianhua,Hu Jin

2010-01-01

Abstract:He Debiao, Chen Jianhua, Hu Jin School of Mathematics and Statistics, Wuhan University, Wuhan, Hubei 430072, China hedebiao@163.com Abstract: Recently, Abdalla et al. proposed a new gateway-oriented password-based authenticated key exchange (GPAKE) protocol among a client, a gateway, and an authentication server, where each client shares a human-memorable password with a trusted server so that they can resort to the server for authentication when want to establish a shared session key with the gateway. In the letter, we show that a malicious client of GPAKE is still able to gain information of password by performing an undetectable on-line password guessing attack and can not provide the implicit key confirmation. At last, we present a countermeasure to against the attack.

Research and Improvement on EAP-AKA

Improved EAP-AKA Protocol Based on Redirection Defense

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

Security analysis of the eCK model

Analysis and Application of Eap_aka for Ieee Standard 802.16E

Study of Network Authentication Based on RADIUS Protocol

Security Analysis on an Improvement of RSA-Based Password Authenticated Key Exchange.

Comparative Studies on Authentication and Key Exchange Methods for 802.11 Wireless LAN

Analysis and Improvement of a Password-Based Authenticated Key Exchange Protocol

Strongly Secure Two Party Authenticated Key Agreement Scheme

A Provably-Secure and Efficient Verifier-Based Anonymous Password-Authenticated Key Exchange Protocol

An anonymous authentication and key agreement protocol in smart living

Analysis and Improvement of RFID Security Authentication Protocol HSAP

An Improved Anonymous Remote User Authentication Scheme with Key Agreement Based on Dynamic Identity

Design of EAP authentication subsystem in Radius server

An ID-Based Key Agreement and Authentication Scheme in WLAN

ID Authentication-based Key Exchange for Wireless Security

Analyzing the Security Flaws of Internet Key Exchange Protocols

E-SAKA Algorithm for Key Agreement

On Security Analysis of an After-the-fact Leakage Resilient Key Exchange Protocol

Weakness Analysis and Improvement of a Gateway-Oriented Password-Based Authenticated Key Exchange Protocol