To provide secure communication, the authentication-and-key-agreement scheme plays a vital role in multi-server environments, Internet of Things (IoT), wireless sensor networks (WSNs), etc. This scheme enables users and servers to negotiate for a common session initiation key. Our proposal first analyzes Amin et al.’s authentication scheme based on RSA and proves that it cannot provide perfect forward secrecy and user un-traceability, and is susceptible to offline password guessing attack and key-compromise user impersonation attack. Secondly, we provide that Srinivas et al.’s multi-server authentication scheme is not secured against offline password guessing attack and key-compromise user impersonation attack, and is unable to ensure user un-traceability. To remedy such limitations and improve computational efficiency, we present a multi-server two-factor authentication scheme using elliptic curve cryptography (ECC). Subsequently, employing heuristic analysis and Burrows–Abadi–Needham logic (BAN-Logic) proof, it is proven that the presented scheme provides security against all known attacks, and in particular provides user un-traceability and perfect forward security. Finally, appropriate comparisons with prevalent works demonstrate the robustness and feasibility of the presented solution in multi-server environments.

With the widespread popularity of Internet-enabled devices, mobile users can request and receive messages anytime and anywhere, which facilitates information feedback for smart city management. However, few people are willing to reflect or report some violations of law and discipline around them, and more people choose to ignore. In general, there are two major reasons for this phenomenon. First, reporting with a real name is highly recommended, but it is difficult to send trusted and reliable reporting messages without revealing the reporter's identity. Second, generally no benefit, users usually lack the motivation to report due to worrying about being retaliated. In this paper, we propose an effective anonymous reporting system called ReportCoin, a novel Blockchain-based incentive anonymous reporting system. ReportCoin guarantees user identity privacy and reporting message reliability throughout the reporting process. On the one hand, ReportCoin allows nondeterministic mobile users to vote the reporting by signing and to send anonymous announcements in the non-fully trusted network. On the other hand, ReportCoin motivates users with incentives to report without worrying about the disclosure of identity information to be retaliated. Meanwhile, account information and transaction records in ReportCoin are open, transparent, and tamperresistant. The theoretical analysis and extensive experimental results show that ReportCoin is efficient and practical.

With the development of Internet of Things (IoT) technologies, Internet-enabled devices have been widely used in our daily lives. As a new service paradigm, cloud computing aims at solving the resource-constrained problem of Internet-enabled devices. It is playing an increasingly important role in resource sharing. Due to the complexity and openness of wireless networks, the authentication protocol is crucial for secure communication and user privacy protection. In this paper, we discuss the limitations of a recently introduced IoT-based authentication scheme for cloud computing. Furthermore, we present an enhanced three-factor authentication scheme using chaotic maps. The session key is established based on Chebyshev chaotic-based Diffie–Hellman key exchange. In addition, the session key involves a long-term secret. It ensures that our scheme is secure against all the possible session key exposure attacks. Besides, our scheme can effectively update user password locally. Burrows–Abadi–Needham logic proof confirms that our scheme provides mutual authentication and session key agreement. The formal analysis under random oracle model proves the semantic security of our scheme. The informal analysis shows that our scheme is immune to diverse attacks and has desired features such as three-factor secrecy. Finally, the performance comparisons demonstrate that our scheme provides optimal security features with an acceptable computation and communication overheads.

No abstract

No abstract