Security Analysis and Improvements of a Biometrics-based User Authentication Scheme Using Smart Cards

Abstract

Many biometrics-based user authentication schemes using smart cards have been proposed to improve the security weaknesses in user authentication system. In 2010, Chang et al. proposed an improved biometrics-based user authentication scheme without concurrency system which can withstand forgery attack, off-line password guessing attack, replay attack, etc. In this paper, we analyze the security weaknesses of Chang et al.' s scheme and we have shown that Chang et al.' s scheme is still insecure against man-in-the-middle attack, off-line biometrics guessing attack, and does not provide mutual authentication between the user and the server. And we proposed the improved scheme to overcome these security weaknesses, even if the secret information stored in the smart card is revealed. As a result, the proposed scheme is secure for the user authentication attack, the server masquerading attack, the man-in-the-middle attack, and the off-line biometrics guessing attack, does provide the mutual authentication between the user and the remote server. And, in terms of computational complexities, the proposed scheme is more effective than Chang et al.' s scheme.

Contents Error and Security Analysis of 'Security Analysis and Improvements of a Biometrics-based User Authentication Scheme Using Smart Cards'

“…[3]. 그러나 2012년에 An의 인증스킴은 Chang 등 의 인증스킴이 중간자 공격, 오프라인 생체인식 추측 공격에 취약하여, 상호인증을 보장하지 못함을 증명하였고 [2], 이러 한 취약점들을 개선한 생체정보를 이용한 스마트카드기반의 원격 사용자 인증스킴을 제안하였다. An의 인증스킴은 Chang 등의 인증스킴의 취약점 중의 하나인 스마트카드 분 실시 사용자의 생체정보가 노출되는 문제를 개선하였다고 주 장하였다 [2].…”