Abstract:Providing secure, efficient, and privacy-preserving user authentication in mobile networks is a challenging problem due to the inherent mobility of users, variety of attack vectors, and resource-constrained nature of user devices. Recent studies show that identity-based cryptosystems can eliminate the certificate overhead and thus address the issues associated with public-key infrastructure technology-which is a rare bit of good news in today's computer security world. In this paper, we employ three representative identity-based remote user authentication schemes (i.e., Truong et al.'s scheme, Li et al.'s scheme, and Zhang et al.'s scheme) as case studies to reveal the challenges and subtleties in designing a practical authentication scheme for mobile devices. First, we demonstrate that Truong et al.'s scheme, which was presented at the IEEE AINA 2012, cannot achieve a few important security goals under our new attacking scenarios: 1) it fails to resist against known session-specific temporary information attack; 2) it cannot withstand key compromise impersonation attack; and 3) it is of poor usability. Second, we show that Li et al.'s privacy-preserving scheme, which was proposed at GLOBECOM 2012, is subject to some subtle (yet severe) efficiency problems that make it virtually impossible for any practical use. Third, we scrutinize a "provably secure" scheme for roaming services in mobile networks designed by Zhang et al. at SCN 2015 and find it prone to collusion attack and replay attack. Further, we investigate into the underlying causes for these identified failures, and figure out an improvement over Truong et al.'s scheme to overcome the revealed challenges while maintaining reasonable efficiency.

A Study of Anonymity in a Mobile Computing Environment

A Survey on the Technology of Anonymity

An Efficient Delegation-Based Anonymous Authentication Protocol

A Secured and Efficient Anonymous Roaming Scheme of Mobile Internet

Design and Implement of the Anonymous Communications in the Mobile IP Networks

A Note on "An Anonymous and Certificateless Identity Authentication Protocol for Mobile Edge Computing"

Scalable and Efficient Mobile Authentication Scheme Preserving User Privacy

A Novel User Authentication Scheme with Anonymity for Wireless Communications.

Further Improvement of an Authentication Scheme with User Anonymity for Wireless Communications.

Mutual Authentication and Key Exchange Protocols for Roaming Services in Wireless Mobile Networks

A Novel Three-Factor Authentication and Key Agreement Scheme Providing Anonymity in Global Mobility Networks

Mutual Authentication with Anonymity for Roaming Service with Smart Cards in Wireless Communications.

Achieving Anonymous Communication in Ad Hoc Networks

Design and Validation of an Efficient Authentication Scheme with Anonymity for Roaming Service in Global Mobility Networks

Universal Authentication Protocols for Anonymous Wireless Communications

An Efficient and Provably Secure Anonymous User Authentication and Key Agreement for Mobile Cloud Computing.

Mutual authentication and key exchange protocols with anonymity property for roaming services

Improved privacy-preserving authentication scheme for roaming service in mobile networks

On the Challenges in Designing Identity-Based Privacy-Preserving Authentication Schemes for Mobile Devices

Survey of Anonymous Routing Protocols for Mobile Ad Hoc Networks

Provide Privacy for Mobile P2P Systems