A more secure digital rights management authentication scheme based on smart card

Abstract

Digital rights management (DRM) system is a technology based mechanism to ensure only authorized access and legal distribution/consumption of the protected digital content. DRM system deals with the whole lifecycle of the digital content including production, management, distribution and consumption. DRM schemes are effective means for the transfer of digital content and safeguard the intellectual property. Recently, Yang et al. proposed a smart-card based DRM authentication scheme providing mutual authentication and session key establishment among all the participants of the DRM environment. We show that their scheme does not resist threats like smart card attack; fails to provide proper password update facility; and does not follow forward secrecy. To overcome these weaknesses, we propose an improvement of Yang et al.'s scheme. The security of our scheme remains intact even if the smart card of the user is lost. In our scheme, user's smart card is capable of verifying the correctness of the inputted identity and password and hence contributes to achieve an efficient and user-friendly password update phase. In addition, the session keys established between the participating entities are highly secure by virtue of forward secrecy property. We conduct security analysis and comparison with related schemes to evaluate our improved scheme. During comparison, we also highlight the computational cost/time complexity at the user and the server side in terms of the execution time of various operations. The entire analysis shows that the design of the improved scheme is robust enough for the for DRM environment.

LAKS-NVT: Provably Secure and Lightweight Authentication and Key Agreement Scheme Without Verification Table in Medical Internet of Things

“…However, these designed protocols were vulnerable to various potential attacks, including privileged insider, impersonation and offline password guessing attacks, because they relied exclusively on the password. Many subsequent MAKA schemes have been designed to overcome these security weaknesses using smart cards [7]- [9] and/or biometrics [10]- [12]. However, these schemes stored user sensitive data in a server database, hence if the server stored data is revealed by an adversary, the whole system collapses.…”

An improved anonymous authentication scheme for roaming in ubiquitous networks

“…For the analysis of the security of Chaudhry et al and the proposed scheme in this paper, we consider the adversarial model with following the capacity of adversary: The adversary has full control over the public communication channel, which means that can eavesdrop, insert, delete, alter, or intercept any of the transmitted messages of the public channel. If obtains a stolen or lost mobile device of a user in some way, he/she is able to extract the secret parameters from the device using side-channel attacks [ 33 – 36 ]. is capable of enumerating off-line all of the possible items in the Cartesian product within polynomial time, where and denote the dictionary spaces of the identity and password, respectively [ 37 , 38 ].…”

“…If obtains a stolen or lost mobile device of a user in some way, he/she is able to extract the secret parameters from the device using side-channel attacks [ 33 – 36 ].…”

Provable analysis and improvement of smart card–based anonymous authentication protocols

“…1,2,14 The protocol of Kuo et al 1 is secure against stolen smart card similar to the protocol of Li et al But the protocol of Bapana et al 14 is vulnerable to stolen smart card and stolen server attacks. In the same year, Kumari et al 15 proposed a powerful scheme that is resistant against stolen smart card, stolen verifier, and insider attacks. Also, some lightweight schemes have been recently designed.…”