An Advanced ECC ID-Based Remote Mutual Authentication Scheme for Mobile Devices

Abstract

Recently, Elliptic Curve Cryptosystem (ECC) based remote authentication scheme has been used for mobile devices. For instance, Yang and Change proposed an ID-based remote mutual authentication with key agreement scheme for mobile devices on Elliptic Curve Cryptosystem in 2009. However, in this paper, we found that their scheme still is vulnerable to insider attack and impersonation attack. Therefore, we proposed an advanced ECC ID-Based remote mutual authentication scheme for mobile devices to solve the issues. Furthermore, we analyzed our scheme to show that our scheme is more secured to authenticate users and remote servers for mobile devices.

An Efficient and More Secure ID Based Mutual Authentication Scheme Based on ECC for Mobile Devices

“…This section evaluates the performance of the proposed scheme in terms computation cost of proposed scheme with other schemes [2,3,4,5,6]. To estimate the computation cost of proposed scheme, the following notations are defined: PM is the time complexity to execute elliptic curve scalar point multiplication, H is the time complexity to execute hash operation and PA is the time complexity to execute elliptic curve scalar point addition.…”

“…However, the security of mobile communication has topped the list of concerns for mobile phone users. In 2009, Yang [6] proposed a system combining elliptic curve and identity-based cryptosystems to enhance security. They claimed that their system's secure against various attacks, such as replay attack, impersonation attack.…”

An improved ID-based client authentication with key agreement scheme on ECC for mobile client-server environments

“…Recently, several ID-based client authentication schemes [5,[9][10][11][19][20][21][22][23] have been found in literature. However, these are vulnerable to various attacks such as replay attack [5,11,20,21], privileged-insider attack [14,[23][24][25], impersonation attack [5,9], lost/stolen smartcard attack [23,24], known session-specific temporary information attack [5,11,12,14,25], and many logged-in users' attack [5,11,12,14,25].…”

“…However, these are vulnerable to various attacks such as replay attack [5,11,20,21], privileged-insider attack [14,[23][24][25], impersonation attack [5,9], lost/stolen smartcard attack [23,24], known session-specific temporary information attack [5,11,12,14,25], and many logged-in users' attack [5,11,12,14,25]. In addition, some of these schemes are faces from the problem of users' anonymity [5,11,14,25], perfect forward security [5,9] and clock synchronization [9][10][11]25]. In 2011, Debiao et al [14] proposed an ID-based client authentication with key agreement scheme on ECC for mobile client-server environments.…”

“…Recently, ECC [3,4]-based public key cryptosystem has attracted a great attention due to its shorter length key such as 160 bit ECC-based key provides same level of security as of 1024 bit RSA-based key, low storage and faster computation. Thus, several ECC-based client authentication schemes [5][6][7][8][9][10][11][12][13][14][15] have been proposed by the researchers to reduce the computation and communication loads on mobile devices. Despite the suitability of ECC-based scheme for low-power mobile devices, ECC-based cryptosystem has some other limitations like PKI-based cryptosystem.…”