Analysis and improvement of a multi-factor biometric authentication scheme

Abstract

In order to enhance the security in wireless communication, authentication schemes come to be more crucial and widely deployed recently, especially those which are referred to as multi-factor biometric authentication that base on password, biometrics, and smart card protections. A new scheme in this way was proposed in 2010 by Li and Hwang. Then Das extended the work of Li et al. and made an improvement of their weak scheme in 2011. However, in 2012, Younghwa An demonstrated that Das's protocol failed to achieve mutual authentication for the server and the user. In this paper, it is described that Younghwa An's scheme cannot withstand the following two attacks. (i) It is still vulnerable to replay attack, then an adversary can masquerade as the legal server. (ii) It cannot provide user anonymity and resistance to user masquerading attack, because an adversary can execute the re-registration process by intercepting the ID i in the login phase. Therefore, an improvement to Younghwa An's scheme is presented in this paper. Then, security formal analysis of the modified scheme using the Burrows-Abadi-Needham logic is given, which demonstrates that the modified scheme with slight high computation costs can protect against the several possible attacks.

Security-enhanced three-factor remote user authentication scheme based on Chebyshev chaotic maps

“…In addition, the running time of XOR operation is rather low, and we thus ignore the timing results. We can see that previous schemes 18,19,21 are more efficient than other schemes since they do not use Diffie-Hellman key exchange. Compared with Park et al's 24 scheme, our scheme consumes more computation resources for providing stronger security guarantee, but we think the additional computation cost is acceptable and worthwhile.…”

“…However, An 19 pointed out that Das' scheme also cannot withstand impersonation attack and server spoofing attack. Although An 19 put forward a new three-factor authentication scheme, Khan and Kumari 20 demonstrated that this scheme cannot resist offline guessing attack, Cao and Ge 21 showed that this scheme is vulnerable to replay attack. Subsequently, Yeh et al 22 and Wu et al 23 further analyzed the security of these schemes.…”

An independent three‐factor mutual authentication and key agreement scheme with privacy preserving for multiserver environment and a survey

“…Xu and Wu 46 found that Xie et al's scheme 45 is vulnerable to desynchronization attacks, and proposed an improvement. 35 (A2, A3) 37,38 Choi et al 37 -Park et al 38 (A3, A4) 39 Zhao et al 39 -…”

A Secure and Efficient Multi-Factor Mutual Certificateless Authentication with Key Agreement Protocol for Mobile Client-Server Environment on ECC without the third-party

“…Similarly, in protocol [17], the smart privileged insider attacker who knows , 1 , and in registration phase can impersonate a legal user. Similarly, in protocol [16], the smart privileged insider attacker of the registration center who knows , , and can impersonate a legal user. Wu et al [17] have illustrated many weaknesses of protocol [19].…”