Secure biometric-based authentication scheme with smart card revocation/reissue for wireless sensor networks

Abstract

Wireless sensor networks (WSNs) are ad-hoc networks composed primarily of a large number of sensor nodes with limited power, computation, storage and communication capabilities. The issue of securing and authenticating communications in such a network is problematic, and thus an adversary has an opportunity to capture a sensor node directly from the target field and extract all the information from its memory. In 2013, Yoon and Kim proposed an advanced biometric-based user authentication scheme for WSNs. Choi et al. analyzed Yoon and Kim's scheme and performed a security cryptanalysis in 2016. They demonstrated that Yoon and Kim's scheme had several security problems, and proposed instead an improved biometric-based user authentication scheme using fuzzy extraction. However, we cryptanalyze Choi et al.'s scheme and demonstrate that their scheme is vulnerable to insider attack and has a problem with smart card revocation/reissue. To overcome these drawbacks, we propose a secure biometric-based authentication scheme in WSNs that is secure against inside adversaries and provides secure and efficient smart card revocation/reissue.

Three-Factor User Authentication and Key Agreement Using Elliptic Curve Cryptosystem in Wireless Sensor Networks

“…Recently, to improve the security of two-factor authentication schemes that are vulnerable to guessing attacks and subject to inefficient password change policies in WSNs, biometric-based user authentication schemes, combined with smart cards and passwords, have drawn considerable attention in research [15,16,17,18,19]. Biometric-based user authentication in the WSN becomes inherently more reliable and secure than traditional two-factor user authentication schemes [20].…”

Improving Biometric-Based Authentication Schemes with Smart Card Revocation/Reissue for Wireless Sensor Networks

“…Park et al [14] claimed that if $\mathcal{A}$ wants to masquerade as the sensor node $S_j$, $\mathcal{A}$ is required to compute $hfalse(SI{D}_{j}false|false|yfalse)$. This is because the symmetric key $k_g=h(h(SI{D}_j||y)||T_g)$.…”

“…Park et al [14] claimed that, although $\mathcal{A}$ could get the identity $I{D}_i$ in some way, $GW$ checks the legitimacy of the user on the requested identity, and $\mathcal{A}$ cannot compute $M_i$ and the revocation/reissue request message $Z_i$ without the biometric information of $U_i$. However, $\mathcal{A}$ can modify the revocation/reissue request message.…”

Improvement of Wu et al.'s Three-Factor User Authentication Scheme for Wireless Sensor Networks

“…A wireless sensor network (WSN) is a distributed network of autonomous sensors that are typically used to collect information about environmental or physical conditions. Wireless sensor networks are applicable to a variety of applications such as environmental monitoring, health care, smart grid and surveillance [1][2][3][4] because they can be easily deployed without a significant cost penalty.…”

“…In general, a WSN system consists of four entities: (1) user interface, (2) sensor node that measures physical or environmental conditions, (3) gateway node that forwards the information received from the sensor nodes to a central server, (4) central server that collects the information from the sensor nodes and analyze it. Naturally, however, the security of WSN is critical because network packets can be easily captured and modified in WSN due to the inherent characteristics of wireless networks.…”