Abstract
User authentication is an important technology for E-commerce, especially when it is done by using smart cards. Authentication schemes based on smart cards can guarantee that a user using the smart card is legal and has the authorization to access resources (eg., a bank account or a remote server) behind the smart card. Due to its usefulness, authentication schemes based on smart cards have been widely researched in recent years. In 2014, Choi introduced a security enhanced anonymous multi-server authenticated key agreement scheme using smart card and biometrics. Kuo et. al recently found that Choi’s scheme is insecure against card losing attack and made an improvement to deal with the problem. However, in this paper, we will show that Kuo et. al’s new scheme made the situation even worse. In their new scheme, any server having communicated with and received information from a card of a user can impersonate the user and enjoy the service (eg., on-line shopping) from the server on behalf of the original user without the card on-hand. We conduct a detailed analysis of flaws in their scheme in the hope that no similar mistakes are made in the future. An improved scheme is left as a future work.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Chuang, M.C., Chen, M.C.: An anonymous multi-server authenticated key agreement scheme based on trust computing using smart cards and biometrics. Expert Systems with Applications 41(4), 1411–1418 (2014)
Chen, C.-M., Ku, W.-C.: Stolen-verifier attack on two new strong-password authentication protocols. IEICE Transactions on Communications 85(11), 2519–2521 (2002)
Chen, C.-M., Wang, K.H., Wu, T.Y., Pan, J.S., Sun, H.M.: A Scalable Transitive Human-Verifiable Authentication Protocol for Mobile Devices. IEEE Transactions on Information Forensics and Security 8(8), 1318–1330 (2013)
Chien, H.Y., Jan, J.K., Tseng, Y.M.: An efficient and practical solution to remote authentication: Smart Card. Computer & Security 21, 372–375 (2002)
Choi, Y., Nam, J., Lee, D., Kim, J., Jung, J., Won, D.: Security enhanced anonymous multi-server authenticated key agreement scheme using smart card and biometrics. The Scientific World Journal 2014, Article 281305 (2014)
Das, M.L., Saxena, A., Gulati, V.P.: A dynamic ID-based remote user authentication scheme. IEEE Transactions on Consumer Electronics 50(2), 629–631 (2004)
Farash, M.S., Attari, M.A.: An efficient and provably secure three-party password-based authenticated key exchange protocol based on Chebyshev chaotic maps. Nonlinear Dynamics 77, 399–411 (2014)
Hwang, M.S., Chong, S.K., Chen, T.Y.: DoS resistant ID-based password authentication scheme using smart cards. Journal of Systems and Software 83, 163–172 (2010)
He, D.J., Ma, M., Zhang, Y., Chen, C., Bu, J.J.: A strong user authentication scheme with smart cards for wireless communications. Computer Communication 34, 367–374 (2011)
Juang, W.S., Chen, S.T., Liaw, H.T.: Robust and efficient password-authenticated key agreement using smart card. IEEE Transactions on Industrial Electronics 5, 2551–2556 (2008)
Kuo, W.C., Wei, H.J., Chen, Y.H., Chen, J.C.: An enhanced secure anonymous authentication scheme based on smart cards and biometrics for multi-server environments. In: Proc. of The 10th Asia Joint Conference on Information Security (AsiaJCIS 2015) (2015)
Ku, W.-C., Chen, C.-M., Lee, H.-L.: Cryptanalysis of a variant of Peyravian-Zunic’s password authentication scheme. IEICE Transactions on Communications 86(5), 1682–1684 (2003)
Lee, N.Y., Chiu, Y.C.: Improved remote authentication scheme with smart card. Computer Standards & Interfaces 27, 177–180 (2005)
Lee, S.W., Kim, H.S., Yoo, K.Y.: Improvement of Chien et al.s remote user authentication scheme using smart cards. Computer standards & Interfaces 27(2), 181–183 (2005)
Liu, M., Shieh, W.G.: On the security of Yoon and Yoo’s biometrics remote user authentication scheme. WSEAS Transactions on Information Science and Applications 11, 94–103 (2014)
Song, R.: Advanced smart card based password authentication protocol. Computer Standards & Interfaces 32, 321–325 (2010)
Sun, H.M.: An efficient remote user authentication scheme using smart cards. IEEE Transactions on Consumer Electronics 46, 958–961 (2000)
Sun, H.M., Hung, C.F., Chen, C.M.: An improved digital rights management system based on smart cards. In: Proc. of Digital EcoSystems and Technologies Conference (DEST 2007) (2007)
Sun, D.Z., Huai, J.P., Sun, J.Z., Li, J.X., Zhang, J.W., Feng, Z.Y.: Improvements of Juang et al.s password-authenticated key agreement scheme using smart cards. IEEE Transactions on Industrial Electronics 56, 2284–2291 (2009)
Wang, Y., Liu, J., Xiao, F., Dan, J.: A more efficient and secure dynamic ID-based remote user authentication scheme. Computer Communications 32(4), 583–585 (2009)
Wu, J., Zhu, W.T., Feng, D.G.: Improvement of a fingerprint-based remote user authentication scheme. International Journal of Security and its Applications 2(3), 208 (2008)
Yang, D., Yang, B.: A biometric password-based multi-server authentication scheme with smart card. IEEE International Conference on Computer Design and Applications 5, 554–559 (2010)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2016 Springer International Publishing Switzerland
About this paper
Cite this paper
Pan, JS., Tso, R., Wu, ME., Chen, CM. (2016). Security Analysis of an Anonymous Authentication Scheme Based on Smart Cards and Biometrics for Multi-server Environments. In: Zin, T., Lin, JW., Pan, JS., Tin, P., Yokota, M. (eds) Genetic and Evolutionary Computing. GEC 2015. Advances in Intelligent Systems and Computing, vol 388. Springer, Cham. https://doi.org/10.1007/978-3-319-23207-2_7
Download citation
DOI: https://doi.org/10.1007/978-3-319-23207-2_7
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-23206-5
Online ISBN: 978-3-319-23207-2
eBook Packages: EngineeringEngineering (R0)