1. Authentication protocol providing user anonymity and untraceability in wireless mobile communication systems Computer Networks Volume: 44, Issue: 2, February 5, 2004, pp. 267-273 Park, Chang-Seop 2007/6/6 H.-H. Ou

2. 2 Summary (1/2) Goals –Authentication protocol for wireless mobile communication systems Anonymity Untraceability Situation –Low computational power of mobile stations Computation overhead must be low –Lower bandwidth and higher channel error rate Minimize the message sizes and number of messages exchanged

3. 2007/6/6 H.-H. Ou 3 Summary (2/2) Skills –Anonymity Alias Encrypting the real identity –Untraceability Alias should be changed at each session Proposed –Authentication key exchange based on secret key certificate Hash chain –Untraceability and secure channel Error-correcting codes

4. 2007/6/6 H.-H. Ou 4 Error-correcting codes (1/2) A linear algebraic structure –Denoted by (N, K, D) N : length, K : dimension, D : minimum distance –G : K by N generator matrix –H : (N-K) by N parity check matrix G ‧ H T = 0 –Binary K tuple m can be encoded to an N bit codeword c = m ‧ G –Error vector e added to the codeword c results in a vector r = c + e –If the Hamming weight of e is less than or equal to t = (D-1)/2, r can be decoded into c based on the syndrome vector s = r ‧ H T

5. 2007/6/6 H.-H. Ou 5 S Error-correcting codes (2/2) r C M G ‧ e ＋ HTHT ‧

6. 2007/6/6 H.-H. Ou 6 Proposed MSAS Random select x i x i-1 = h 0 (X i ) for i = s,s-1,..1 id, x 0 f(K AS, [id || x 0 ]) Store Register m= f(K AS, [id || x 0 ]), c=m ‧ G z i =[i || x i ]   e j (i) r = c+ e j (i) r r ‧ H T = [ m, e j (i) ] e j (i)   z i =[ i|| x i ] Check x i with h 0 i (x 0 ) Session key K i =h 1 (x i ) One to one correspondence between error vectors and integers

7. 2007/6/6 H.-H. Ou 7 Our Proposed MSAS SID M, TID M, R M G A, G M, H M Register m M = SID M ⊕ R A ’ || R M, c m =m m ‧ G A z M = TID M = TID M ’ ⊕ R M ’   e M r M = c M + e M rMrM r M ‧ H A T = [ m M, e M ] e M   z M = TID M Look database Check SID M ⊕ R A ’ m A = SID A ⊕ R M || R A, c A =m A ‧ G M z A = TID A = TID A ’ ⊕ R A ’   e A r A = c A + e A Session key K = R M ⊕ R A SID A, TID A, R A G M, G MA, H A rArA r A ‧ H M T = [ m A, e A ] e A   z A = TID A Look database Check SID A ⊕ R M Store TID M new = TID M ⊕ R A, R A TID A new = TID A ⊕ R M Store TID M new = TID M ⊕ R A TID A new = TID A ⊕ R M, R M

8. 2007/6/6 H.-H. Ou 8 Our Proposed (simple mode) MSAS SID M, TID M, R M G A, G M, H M Register SID M ⊕ R A ’ || R M + TID M Session key K = R M ⊕ R A SID A, TID A, R A G M, G A, H A SID A ⊕ R M || R A + TID A TID M = TID M ’ ⊕ R A ’ TID A = TID A ’ ⊕ R M ’ TID M, SID M, TID A, SID A, R A, G M Database TID A, SID A, TID M, SID M, R A, G A Database