多媒體網路安全實驗室 A novel user authentication and privacy preserving scheme with smartcards for wireless communications 作者 :Chun-Ta Li,Cgeng-Chi Lee 出處 :Mathematical and Computer Modelling,2012 報告人 : 葉瑞群 日期 :2012/09/07

多媒體網路安全實驗室 Outline Introduction 1 Review of He et al.’s scheme 2 Three weaknesses in He et al.’s scheme 33 The proposed scheme 44 Security analusis of the proposed scheme 35 Functionality features and performance analysis of the proposed scheme 46 Conclusions 37 2

多媒體網路安全實驗室 1.Introduction(1/3)  Generally speaking, mobile users (MU) can access the services provided by the home agent of the MU (HA) in a visited foreign agent of the MU (FA). 3

多媒體網路安全實驗室 1.Introduction(2/3)  Recently, He et al. [5] showed that Wu et al.’s scheme is vulnerable to several weaknesses and then proposed a strong user authentication scheme with smart cards for wireless communications. 4

多媒體網路安全實驗室 1.Introduction(3/3) In this paper we will show that He et al.’s scheme has three weaknesses as follows.  1. Lack of user friendliness.  2. Unfairness in key agreement.  3. Attacks against the user anonymity. 5

多媒體網路安全實驗室 2.Review of He et al.’s scheme(1/7) TABLE 1 (I) MUThe mobile user PW MU The password of MU ID MU The identity of MU HAThe home agent of Ui ID HA The identity of HA FAThe foreign agent of MU roamed ID FA The identity of FA NThe master secret key stored in HA TXTX A timestamp generated by an entity X SKThe common session key ⊕ The bitwise XOR operation H(.)A collision free one-way hash function 6

多媒體網路安全實驗室 2.Review of He et al.’s scheme(2/7) TABLE 1 (II) ||String concatenation E k [.]/D k [.]The symmetric encryption/decryption function with key K E k {.}/D k [{.}The asymmetric encryption/decryption function with key K ⇒ A secure channel →A common channel 7

多媒體網路安全實驗室 2.Review of He et al.’s scheme (3/7) – Registration phase [1] MU HA ID MU,H(PW MU ⊕ d) TK MU = H(ID MU ||X HA ) SK MU = H(N||ID MU ) r = TK MU ⊕ ID HA ⊕ E N [(ID MU ||m)] {TK MU,SK MU,H(.),r} SK * MU = H(ID MU ||H(PW MU )) ⊕ SK MU V MU = TK MU ⊕ H(ID MU ||H(PW MU ⊕ d)) H MU = H(TK MU ) {V MU,H MU,SK * MU,H(.),d,r} 8

多媒體網路安全實驗室 2.Review of He et al.’s scheme (4/7) – Login phase [2] MU FA Smart card TK * MU = V MU ⊕ H(ID MU ||H(PW MU ⊕ d)) H * MU = H(TK * MU ) check H * MU = H MU SK MU = H(ID MU ||H(PW MU )) ⊕ SK * MU L = H(T MU ⊕ SK MU ) F = E L [H(T MU )||ID FA ||x 0 ||x] n = r ⊕ TK MU = ID HA ⊕ E N [(ID MU ||m)] m1{n,F,ID HA,T MU } 9

多媒體網路安全實驗室 2.Review of He et al.’s scheme (5/7) – Authentication phase [3] - I 10

多媒體網路安全實驗室 2.Review of He et al.’s scheme (6/7) – Authentication phase [3] - II 11

多媒體網路安全實驗室 2.Review of He et al.’s scheme (7/7) – Password change phase [4] Smart card TK * MU = V MU ⊕ H(ID MU ||H(PW MU || ⊕ d)) H * MU = H(TK * MU ),Check H * MU = H MU MU Input PW NEW MU Smart card SK’ MU = H(ID MU ||H(PW NEW MU )) ⊕ SK MU = H(ID MU ||H(PW NEW MU )) ⊕ H(ID MU ||H(PW MU )) ⊕ SK * MU, Replaces SK’ MU →SK * MU V’ MU = TK MU ⊕ H(ID MU ||H(PW NEW MU ⊕ d NEW )),Replaces V’ MU →V MU {V’ MU,H MU,SK’ MU,H(.),d NEW,r},PW NEW MU 12

多媒體網路安全實驗室 3. Three weaknesses in He et al.’s scheme(1/3) 1.Lack of user friendliness  Authors assumed that the bit length of MU’s ID MU is 128 bit and MU has to bear in mind such a 128 bit identity (usually in the form of as many as 32 hexadecimal ASCII characters). 13

多媒體網路安全實驗室 3. Three weaknesses in He et al.’s scheme(2/3) 2.Unfairness in key agreement  The MU can always choose x 0 and x, where x 0 and x are two 256 bits random number generated by the MU alone, such that in Step V7,the common session key computed by the FA according to SK = H(H(H(N ‖ ID MU )) ‖ x ‖ x 0 ) is always the MU’s pre-determined x 0 and x. 14

多媒體網路安全實驗室 3. Three weaknesses in He et al.’s scheme(3/3) 3. Attacks against the user’s anonymity  Consider that a mobile user MU roams into the foreign network and sends the login message m1 = {n,F,ID HA,T MU } to the FA to access service, the contents of n and ID HA are for the mobile user MU’s exclusive use and these two values always unchanging in Step L 4 of the login phase. 15

多媒體網路安全實驗室 4.The proposed scheme(1/7) Notations p,qpublic large prime numbers S HA = cHA selects a private key P HA =g c mod pHA computes its public key S FA = eFA selects a private key P FA = g e mod pFA computes its public key 16

多媒體網路安全實驗室 4.The proposed scheme(2/7) Registration phase [1] MU HA ID MU,H(ID MU ⊕ PW MU ⊕ d) TK MU = H(N||ID MU ) ⊕ H(ID MU ⊕ PW MU ⊕ d) r = ID HA ⊕ E N [(ID MU ||m)] TK MU,H(.),r TK MU,H(.),r,d 17

多媒體網路安全實驗室 4.The proposed scheme(3/7) Login phase [2] MU FA Smart card TK * MU = TK MU ⊕ H(ID MU ⊕ PW MU ⊕ d) = H(N||ID MU ) A = g a mod p L = H(T MU ⊕ TK * MU ), F = E L [T MU ||ID FA ||A] DH = P HA a mod p = g ac mod p, M=E DH [r] MU DH’ = P FA a mod p = g ea mod p m 1 = {A,T MU,U=E DH’ [M,F,ID HA,T MU ]} 18

多媒體網路安全實驗室 4.The proposed scheme(4/7) Authentication phase [3] I 19

多媒體網路安全實驗室 4.The proposed scheme(5/7) Authentication phase [3] II 20

多媒體網路安全實驗室 4.The proposed scheme(6/7) Authentication phase [3] III MU FA HA SK = B a mod p = g ba mod p D SK [Z] = TCert MU,H(H(N||ID MU )||D),A,B,D 21

多媒體網路安全實驗室 4.The proposed scheme(7/7) Password change phase [4] MU 、 Smart card TK * MU = TK MU ⊕ H(ID MU ⊕ PW MU ⊕ d)=H(N||ID MU ) H(ID MU ⊕ PW NEW MU ⊕ d’) TK NEW MU = TK * MU ⊕ H(ID MU ⊕ PW NEW MU ⊕ d’) Replaces TK NEW MU,d’ 22

多媒體網路安全實驗室 5.Security analusis of the proposed scheme(1/3)  The proposed scheme is able to provide user anonymity.  m 1 = {A,T MU,U=E DH’ [M,F,ID HA,T MU ]}  Step1 DH’ = A e mod p =g ae mod p  Step2 D DH’ [U] = M,F,ID HA,T MU 23

多媒體網路安全實驗室 5.Security analusis of the proposed scheme(2/3) MU FA HA DH’ DH’’ DH SK 24

多媒體網路安全實驗室 5.Security analusis of the proposed scheme(3/3)  The proposed scheme meets the security requirement for perfect forward secrecy. (Diffie-Hellman)  Attacker cannot launch any attack to obtain the MU’s real identity ID MU and password PW MU. TK ∗ MU = H(N ‖ ID MU ) 25

多媒體網路安全實驗室 6.Functionality features and performance analysis of the proposed scheme(1/1) 26

多媒體網路安全實驗室  More recently, He et al. showed that Wu et al.,’s smart card based authentication scheme with user anonymity is vulnerable to several weaknesses and then proposed a secure and light-weight user authentication scheme. 27

多媒體網路安全實驗室