A Study on Symmetric-Key based User Authentication in IoT - young Lee, Jae; ., . (International Journal of Engineering and Technology, 2018)
Background/Objectives: The user authentication scheme by Lee et al., during logins, contains errors of identifiable user IDs and vulnerability to attacks as significant random numbers of servers are easily calculated. Methods/Statistical analysis: User authentication scheme by Lee et al., utilizes message values from login requests. At this point, to avoid the issues of unidentifiable user IDs, which supposed to be from the messages, but are omitted, being used for calculations, they are set to be stored in RGB instead. For random number issues being easily calculated, when executing logins with smart-cards issued for users who completed server registrations, h(b||x) is used instead. Findings: The thesis modified the uses of unidentifiable user IDs from login request messages for authentications into of stored values which resulted from connections between user IDs and a secret key, by servers. Servers practice registrations, calculating figures, including Ji, Qi, Yi, Ri, Li, Ai, Mi and AIDi by using the received IDi, calculated RPWi, secret key k, withdrawal of user registration request Ni and random number b. At this point, having servers use IDiâŠ•x stored in RGR, instead of the problematic unidentifiable user IDs, IDi, for calculations of Ji, Yi and AIDi, authentication process is improved. Random number b is significant for authentications. If it is exposed to attackers, it can be abused by various attacks. To improve the random number being easily calculated during user logins with issued smart-cards, the Ri, Li and Ai formulas using b were modified into using h(b||x). During logins, smart-cards calculate ri=KiâŠ•h(IDi||PWi) and RPWi=h(ri||PWi) with IDiand PWi, and h(b||x)=RiâŠ•h(IDi||x) with Bi, Ri and the deducted h(IDi||x)=BiâŠ•RPWiâŠ•ri. Deducting b via using h(b||x) is unavailable. Improvements/Applications: Based on the proposed authentication scheme by Lee et al., errors prior to authentication and random number being easily calculated are improved, hence, enabled countermeasures against attacks abusing random number. Â Â