An Untraceable Biometric-Based Multi-server Authenticated Key Agreement Protocol with Revocation

Abstract

Online access has been widely adopted to distribute diversified services to customers. In this architecture, public channels are utilized to exchange information between end users and remote servers at anytime and anywhere. To achieve confidentiality and integrity for transferred data, the related parties have to authenticate each other and negotiate a secret session key to encrypt and decrypt exchanged messages. Since the Lamport's pioneering authentication work in 1981, numerous mechanisms have been proposed to enhance security as well as reduce computation and payload data. Recently, Chuang and Chen proposed a multi-server authenticated agreement protocol employing a smart card and biometric data to eliminate the weaknesses caused by parameters related to low-entropy human-memorable passwords that are stored in a physical location. However, Mishra et al. showed that Chuang and Chen's protocol is not only vulnerable to multiple attacks but also suffers from the drawback of variation of biometric data. To overcome these weaknesses, they proposed an enhanced three-factor authenticated key agreement protocol using the low-error rate Biohashing technique. Unfortunately, we found that Mishra et al.'s scheme is also vulnerable to the denial-of-service attack, the traceable user attack, the impersonation attack, and the pre-shared key attack. Furthermore, the protocol does not provide any user revocation mechanism to control user accesses. In this novel untraceable authenticated key agreement scheme, we adopt the Hamming distance to verify encrypted Biohash codes and a public-key technique to construct the revocation mechanism. Our scheme achieves not only zero errors of biometric verification but also secure against all known attacks.

Efficient Biometric Service Protocol for Cloud Services

“…A biometric-based user verified key agreement system was created by Pan et al [5] for safe access to services offered by Internet of Things (IoT) devices. Despite using lightweight operations, this technique is not immune to DoS assaults since it employs the perceptual hashing (bio hashing) procedure rather than the fuzzy extractor used by [12]. This is largely due to the fact that the bio hashing approach seldom ever generates a particular feature BH(BIOi) from the physiological biometric BIOUi of an authorized user Ui at various input times, despite the fact that it may minimise output error [12].…”

“…Despite using lightweight operations, this technique is not immune to DoS assaults since it employs the perceptual hashing (bio hashing) procedure rather than the fuzzy extractor used by [12]. This is largely due to the fact that the bio hashing approach seldom ever generates a particular feature BH(BIOi) from the physiological biometric BIOUi of an authorized user Ui at various input times, despite the fact that it may minimise output error [12]. There were several biometric applications developed by Gowroju et al [16][17][18][19][20][21] that deals with security related applications efficiently using pupil of the person.…”

Provably secure signature‐based anonymous user authentication protocol in an Internet of Things‐enabled intelligent precision agricultural environment

“…Furthermore, their scheme is not resilient against DoS attack because of usage of perceptual hashing instead of fuzzy extractor method. 37 Rao and Prema 38 proposed a data logging system using Raspberry Pi 3 based on a modified BLAKE2b hash function that can reduce the time required to hash a message. It also works as a digital signature scheme with short verification time.…”

“…To avoid such a "high rate of false rejection," we have used the fuzzy extractor method 18 because it is verified using the Hamming distance in order to avoid "false acceptance and false rejection errors". 37 Moreover, due to the use of current timestamps in each message, even if an adversary intentionally attempts to send the same message many times, these are easily detected by checking the timestamp at the receiver end (as discussed in Proposition 3), and the messages are not processed further. This means that the adversary will not be able to force the entities (users, controller nodes and smart devices) to consume resources (power, storage and computation).…”

“…In addition, it does not protect against user impersonation, stolen smart card, ESL, and privileged‐insider attacks. Furthermore, their scheme is not resilient against DoS attack because of usage of perceptual hashing instead of fuzzy extractor method 37 …”