Abstract:Providing secure, efficient, and privacy-preserving user authentication in mobile networks is a challenging problem due to the inherent mobility of users, variety of attack vectors, and resource-constrained nature of user devices. Recent studies show that identity-based cryptosystems can eliminate the certificate overhead and thus address the issues associated with public-key infrastructure technology-which is a rare bit of good news in today's computer security world. In this paper, we employ three representative identity-based remote user authentication schemes (i.e., Truong et al.'s scheme, Li et al.'s scheme, and Zhang et al.'s scheme) as case studies to reveal the challenges and subtleties in designing a practical authentication scheme for mobile devices. First, we demonstrate that Truong et al.'s scheme, which was presented at the IEEE AINA 2012, cannot achieve a few important security goals under our new attacking scenarios: 1) it fails to resist against known session-specific temporary information attack; 2) it cannot withstand key compromise impersonation attack; and 3) it is of poor usability. Second, we show that Li et al.'s privacy-preserving scheme, which was proposed at GLOBECOM 2012, is subject to some subtle (yet severe) efficiency problems that make it virtually impossible for any practical use. Third, we scrutinize a "provably secure" scheme for roaming services in mobile networks designed by Zhang et al. at SCN 2015 and find it prone to collusion attack and replay attack. Further, we investigate into the underlying causes for these identified failures, and figure out an improvement over Truong et al.'s scheme to overcome the revealed challenges while maintaining reasonable efficiency.

Smart User Authentication for an Improved Data Privacy

A PRIVACY-PRESERVING AUTHENTICATION SCHEME USING BIOMETRICS FOR PERVASIVE COMPUTING ENVIRONMENTS

A Lightweight Three-Factor User Authentication Protocol for the Information Perception of IoT

An Inter-Domain Authentication Scheme For Pervasive Computing Environment

Enhanced User Data Privacy with Pay-by-data Model

Owner-Centric Protection of Unstructured Data on Smartphones.

Sensory-Data-Enhanced Authentication For Rfid-Based Access Control Systems

The House That Knows You: User Authentication Based on IoT Data

mPSAuth: Privacy-Preserving and Scalable Authentication for Mobile Web Applications

Privacy-Preserving Sensor-Based Continuous Authentication and User Profiling: A Review

Privacy-Enhanced Adaptive Authentication: User Profiling with Privacy Guarantees

Multimodal User Authentication in Smart Environments: Survey of User Attitudes

User-centric Privacy Engineering for the Internet of Things

A study on users' privacy perception with smart devices

Privacy Considerations for Risk-Based Authentication Systems

User Characteristics and Their Impact on the Perceived Usable Security of Physical Authentication Devices

On the Usability of Two-Factor Authentication.

On the Usability of Next-Generation Authentication: A Study on Eye Movement and Brainwave-based Mechanisms

Secure and Privacy-Preserving Authentication for Data Subject Rights Enforcement

Privacy Management and Interface Design for a Smart House

On the Challenges in Designing Identity-Based Privacy-Preserving Authentication Schemes for Mobile Devices