Applying biometrics to design three‐factor remote user authentication scheme with key agreement

Abstract

There are some biometrics‐based three‐factor remote user authentication schemes proposed by researchers for ensure high security features for network‐based application systems. Recently, Das pointed out the security flaws of Li and Hwang's three‐factor remote user authentication scheme, and proposed an enhanced biometrics‐based three‐factor remote user authentication scheme. Das's scheme overcomes the defects of Li and Hwang's scheme, and maintains the advantages of Li and Hwang's scheme at the same time. However, after detailed analysis, we find that Das's scheme remains vulnerable to forgery attack and stolen smart card attack; at the same time, Das's scheme cannot provide the session key agreement after the mutual authentication. To provide more security features, we design a three‐factor remote user authentication scheme with key agreement using biometrics. Copyright © 2013 John Wiley & Sons, Ltd.

Analyzing the mutual authenticated session key in IP multimedia server-client systems for 4G networks

“…Yoon and Yoo [32] proposed a robust client-server authentication scheme to offer strong user authentication, although Kim et al [33] pointed out that the scheme of Yoon and Yoo was not resilient to password (offline) guessing attacks. Recently, Li et al [34] found some security weaknesses of Das [31] and Lee et al [35], such as session-key agreement and key-impersonation attacks using biometric-based user authentication schemes. As a consequence, none of the existing authentication schemes [9][10][11][12][28][29][30][31][32][33][34][35][36][37][38][39][40][41][42] fulfill the security properties of the AKA protocol and resist most of the potential attacks, such as password guessing, key impersonation, and so on, in the multimedia client-server environment.…”

Cryptanalysis of a robust smart card authentication scheme for multi-server architecture

“…The password and smart card based two-factor user authentication enhanced the security. However, most of these two-factor user authentication schemes are designed for single server environments [2][3][4][5][6][7][8]. Therefore, in order to login to different servers using the single server authentication scheme, the user has to repetitively register to the different servers, and remember numerous different identities and passwords for different servers.…”

“…The user authentication scheme is the most simple and effective way to resolve this security issue, which can make the remote server to verify the identity of the user when the user wants to access the remote server. Since Lamport [1] proposed the first user authentication scheme for insecure channel, many researchers have done a lot of works and got many achievements [2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18] in this area. In the password based schemes, the user registers his identity and password to the remote server, and the server can verify the validity of the user by matching the user's identity and password with the stored information.…”

“…The smart card is an integrated circuit card which can provide identification, data storage and application processing, and can provide strong security authentication for large networks. Thereafter, the researchers have proposed password and smart card based two-factor user authentication schemes [2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18], which store the required secret information on the user's smart card and the server does not need to store a verification table. The password and smart card based two-factor user authentication enhanced the security.…”

An Improved Biometrics-Based Authentication Scheme for Telecare Medical Information Systems

“…Very recently, dozens of biometrics-based authentication schemes for TMIS have been proposed for providing the stronger security [19][20][21][22][23][24]. Nevertheless, these protocols still have more or less deficiencies and limitations in security and efficiency.…”