A Study on Symmetric-Key based User Authentication in IoT

Jae young Lee; . .

doi:10.14419/ijet.v7i2.33.18011

Authors

Jae young Lee
. .

Received date: August 20, 2018

Accepted date: August 20, 2018

Published date: June 8, 2018

DOI:

https://doi.org/10.14419/ijet.v7i2.33.18011

Keywords:

IoT, User Authentication, Symmetric-Key, Smart-Card, Attack, Wireless Sensor Network.

Abstract

Background/Objectives: The user authentication scheme by Lee et al., during logins, contains errors of identifiable user IDs and vulnerability to attacks as significant random numbers of servers are easily calculated.
Methods/Statistical analysis: User authentication scheme by Lee et al., utilizes message values from login requests. At this point, to avoid the issues of unidentifiable user IDs, which supposed to be from the messages, but are omitted, being used for calculations, they are set to be stored in RGB instead. For random number issues being easily calculated, when executing logins with smart-cards issued for users who completed server registrations, h(b||x) is used instead.
Findings: The thesis modified the uses of unidentifiable user IDs from login request messages for authentications into of stored values which resulted from connections between user IDs and a secret key, by servers. Servers practice registrations, calculating figures, including J_i, Q_i, Y_i, R_i, L_i, A_i, M_i and AID_i by using the received ID_i, calculated RPW_i, secret key k, withdrawal of user registration request N_i and random number b. At this point, having servers use ID_iâŠ•x stored in RGR, instead of the problematic unidentifiable user IDs, ID_i, for calculations of J_i, Y_i and AID_i, authentication process is improved.
Random number b is significant for authentications. If it is exposed to attackers, it can be abused by various attacks. To improve the random number being easily calculated during user logins with issued smart-cards, the R_i, L_i and A_i formulas using b were modified into using h(b||x). During logins, smart-cards calculate r_i=K_iâŠ•h(ID_i||PW_i) and RPW_i=h(r_i||PW_i) with ID_iand PW_i, and h(b||x)=R_iâŠ•h(ID_i||x) with B_i, R_i and the deducted h(ID_i||x)=B_iâŠ•RPW_iâŠ•r_i. Deducting b via using h(b||x) is unavailable.
Improvements/Applications: Based on the proposed authentication scheme by Lee et al., errors prior to authentication and random number being easily calculated are improved, hence, enabled countermeasures against attacks abusing random number.
Â
Â

References

[1] Kim, D.H. (2013). Security for IoT Service. Journal of Korea Institute of Communication and Information Services, 30(8), 53-65.
[2] Pyo,C.S., Kang, H.Y.,Kim, N. S., Bang, H.C.(2013). IoT (M2M) technology trends and development prospects. Journal of The Korean Institute of Communication Sciences, 30(8), 3-10.
[3] Park, K.S., Lee, S.Y., Park, Y.H., Park, Y.H.(2015). An ID-based Remote User Authentication Scheme in IoT. Journal of Korea Multimedia Society, 18(12), 1483-1491.
[4] Moon, J. H., Choi, Y. S., Won, D. H. (2016). A Secure Attribute-based Authentication Scheme for Cloud Computing. KIISE Transaction on Computing Practices, 22(8), 345- 350.
[5] Wang, Y. Y.,Liu, J. Y., Xiao, F. X., Dan, J. (2009). A more Efficient and Secure Dynamic ID-based Remote User Authentication Scheme. Computer Communications, 32(4), 583-585.
[6] Chang,Y. F.,Tai, W. L., Chang, H. C. (2014). Untraceable Dynamic-identity-based Remote User Authentication Scheme with Verifiable Password Update. International Journal of Communication Systems, 27(11), 3430-3440.
[7] Li, X., Niu, J.,Liao, J., Liang, W. (2015).Cryptanalysis of a Dynamic Identity-based Remote User Authentication Scheme with Verifiable Password Update. International Journal of Communication Systems, 28(2), 374-382.
[8] Kumari, S., Khan, M.K.,Li, X. (2014).An Improved Remote User Authentication Scheme with Key Agreement. Computers & Electrical Engineering, 40(6), 1997-2012.
[9] Ramasamy, R.,Muniuandi, A.P. (2009).New Remote Mutual Authentication Scheme Using Smart Cards. Transactions on Data Privacy, 2(2), 141-152.
[10] Lee, Y. S., Won, D. H. (2010). Cryptanalysis and Enhancement of a Remote User Authentication Scheme Using Smart Cards. Journal of the Korea Society of Computer and Information, 15(1), 139-147.
[11] Hwang, M. S., Li, L. H.(2002). A New Remote User Authentication Scheme using Smart Cards. IEEE transactions on Consumer Electronics, 46(1), 28-30.
[12] Kim, H.S.(2015). Remote User Authentication Scheme with Key Agreement Providing Forward Secrecy. Journal of Security Engineering, 12(1), 1-12.
[13] Lee, S.Y., Park, K.S., Park, Y.H., Park, Y. H. (2016). Symmetric Key-Based Remote User Authentication Scheme with Forward Secrecy. Journal of Korea Multimedia Society, 19(3), 585-594.
[14] Moon, J.H., Won, D.H.(2017). An Enhanced Symmetric Key-Based Remote User Authentication Scheme with Forward Secrecy. Journal of Korea Multimedia Society,20(3), 500-510.