Cryptanalysis of two anonymous user authentication schemes for wireless sensor networks

doi:10.11772/j.issn.1001-9081.2015.12.3424

Journal of Computer Applications ›› 2015, Vol. 35 ›› Issue (12): 3424-3428.DOI: 10.11772/j.issn.1001-9081.2015.12.3424

• Information security • Previous Articles Next Articles

Cryptanalysis of two anonymous user authentication schemes for wireless sensor networks

XUE Feng¹, WANG Ding^1,2, CAO Pinjun¹, LI Yong¹

1. Department of Training, PLA Bengbu Automobile Sergeant Institute, Bengbu Anhui 233011, China;
2. School of Electronics Engineering and Computer Science, Peking University, Beijing 100871, China

Received:2015-06-02 Revised:2015-07-19 Online:2015-12-10 Published:2015-12-10

对两个无线传感器网络中匿名身份认证协议的安全性分析

薛锋¹, 汪定^1,2, 曹品军¹, 李勇¹

1. 解放军蚌埠汽车士官学校训练部, 安徽蚌埠 233011;
2. 北京大学信息科学技术学院, 北京 100871

通讯作者: 汪定(1985-),男,湖北十堰人,博士研究生,CCF会员,主要研究方向:密码学、无线网络安全
作者简介:薛锋(1975-),男,陕西宜川人,讲师,主要研究方向:密码学、信息安全工程;曹品军(1979-),男,山东曹县人,硕士,主要研究方向:密码与信息安全;李勇(1980-),男,山东新泰人,讲师,主要研究方向:网络与信息安全。
基金资助:
国家自然科学基金资助项目(61472016)。

Abstract

Abstract: Aiming at the problem of designing secure and efficient user authentication protocols with anonymity for wireless sensor networks, based on the widely accepted assumptions about the capabilities of attackers and using the scenarios-based attacking techniques, the security of two recently proposed two-factor anonymous user authentication schemes for wireless sensor networks was analyzed. The following two aspects were pointed out:1) the protocol suggested by Liu etc. (LIU C, GAO F, MA C, et al. User authentication protocol with anonymity in wireless sensor network. Computer Engineering, 2012, 38(22):99-103) cannot resist against offline password guessing attack as the authors claimed and is also subject to a serious design flaw in usability; 2) the protocol presented by Yan etc. (YAN L, ZHANG S, CHANG Y. A user authentication and key agreement scheme for wireless sensor networks. Journal of Chinese Computer Systems, 2013, 34(10):2342-2344) cannot withstand user impersonation attack and offline password guessing attack as well as fall short of user un-traceability. The analysis results demonstrate that, these two anonymous authentication protocols have serious security flaws, which are not suitable for practical applications in wireless sensor networks.

Key words: identity authentication, two-factor protocol, anonymity, offline password guessing attack, user impersonation attack

摘要： 针对设计安全高效的无线传感器网络环境下匿名认证协议的问题,基于广泛接受的攻击者能力假设,采用基于场景的攻击技术,对新近提出的两个无线传感器网络环境下的双因子匿名身份认证协议进行了安全性分析。指出刘聪等提出的协议(刘聪,高峰修,马传贵,等.无线传感器网络中具有匿名性的用户认证协议.计算机工程,2012,38(22):99-103)无法实现所声称的抗离线口令猜测攻击,且在协议可用性方面存在根本性设计缺陷;指出闫丽丽等提出的协议(闫丽丽,张仕斌,昌燕.一种传感器网络用户认证与密钥协商协议.小型微型计算机系统,2013,34(10):2342-2344)不能抵抗用户仿冒攻击和离线口令猜测攻击,且无法实现用户不可追踪性。结果表明,这两个匿名身份认证协议都存在严重安全缺陷,不适于在实际无线传感器网络环境中应用。

关键词: 身份认证, 双因子协议, 匿名性, 离线口令猜测攻击, 用户仿冒攻击

CLC Number:

TP393.08

XUE Feng, WANG Ding, CAO Pinjun, LI Yong. Cryptanalysis of two anonymous user authentication schemes for wireless sensor networks[J]. Journal of Computer Applications, 2015, 35(12): 3424-3428.

薛锋, 汪定, 曹品军, 李勇. 对两个无线传感器网络中匿名身份认证协议的安全性分析[J]. 计算机应用, 2015, 35(12): 3424-3428.

References

[1] NEWELL A, YAO H, RYKER A. Node-capture resilient key establishment in sensor networks:design space and new protocols[J]. ACM Computing Surveys, 2014, 47(2):1-24.
[2] WANG D, WANG P. On the anonymity of two-factor authentication schemes for wireless sensor networks:attacks, principle and solutions[J]. Computer Networks, 2014, 73:41-57.
[3] BONNEAU J. The science of guessing:analyzing an anonymized corpus of 70 million passwords[C]//Proceedings of the 2012 IEEE Symposium on Security and Privacy. Piscataway:IEEE, 2012:538-552.
[4] DAS M. Two-factor user authentication in wireless sensor networks[J]. IEEE Transactions on Wireless Communications, 2009, 8(3):1086-1090.
[5] HE D, GAO Y, CHAN S, et al. An enhanced two-factor user authentication scheme in wireless sensor networks[J]. Ad Hoc Sensor & Wireless Networks, 2010, 10(4):361-371.
[6] XUE K, MA C, HONG P, et al.A temporal-credential-based mutual authentication and key agreement scheme for wireless sensor networks[J]. Journal of Network and Computer Applications, 2012, 36(1):316-323.
[7] MESSERGES T S, DABBISH E A, SLOAN R H. Examining smart-card security under the threat of power analysis attacks[J]. IEEE Transactions on Computers, 2002, 51(5):541-552.
[8] KIM T H, KIM C, PARK I. Side channel analysis attacks using AM demodulation on commercial smart cards with seed[J]. Journal of Systems and Software, 2012, 85(12):2899-2908.
[9] WANG D, WANG P. Offline dictionary attack on password authentication schemes using smart cards[C]//Proceedings of the 16th Information Security Conference. Berlin:Springer, 2014:1-16.
[10] LIU C, GAO F, MA C, et al. User authentication protocol with anonymity in wireless sensor network[J]. Computer Engineering, 2012, 38(22):99-103. (刘聪,高峰修,马传贵,等.无线传感器网络中具有匿名性的用户认证协议[J].计算机工程,2012,38(22):99-103.)
[11] YAN L, ZHANG S, CHANG Y. A user authentication and key agreement scheme for wireless sensor networks[J]. Journal of Chinese Computer Systems, 2013, 34(10):2342-2344. (闫丽丽,张仕斌,昌燕.一种传感器网络用户认证与密钥协商协议[J].小型微型计算机系统,2013,34(10):2342-2344.)
[12] WANG D, MA C,WENG C,et al. Cryptanalysis and improvement of a remote user authentication scheme for resource-limited environment[J]. Journal of Electronics & Information Technology, 2012, 34(10):2520-2526. (汪定,马春光,翁臣,等.一种适于受限资源环境的远程用户认证方案的分析与改进[J].电子与信息学报,2012,34(10):2520-2526.)
[13] ZAN Y, LIU W, JIANG F. Remote user mutual authentication scheme based on dynamic ID[J]. Journal of Information Engineering University, 2014,15(3):262-269. (昝亚洲,刘文芬,蒋峰云.基于动态ID的远程用户交互认证方案[J].信息工程大学学报,2014,15(3):262-269.)
[14] XUE F, WANG D, WANG L, et al. Cryptanalysis of two smartcard-based remote user password authentication protocols[J]. Journal of Computer Applications, 2012, 32(7):221-224. (薛锋,汪定,王立萍,等.对两个基于智能卡的远程用户口令认证协议的安全性分析[J].计算机应用,2012,32(7):221-224.)
[15] MA C, WANG D, ZHAO S. Security flaws in two improved remote user authentication schemes using smart cards[J]. International Journal of Communication Systems, 2014, 27(10):2215-2227.

Cryptanalysis of two anonymous user authentication schemes for wireless sensor networks

对两个无线传感器网络中匿名身份认证协议的安全性分析

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics

[1]	Deyuan LIU, Jingquan ZHANG, Xing ZHANG, Wunan WAN, Shibin ZHANG, Zhi QIN. Cross-chain identity authentication scheme based on certificate-less signcryption [J]. Journal of Computer Applications, 2024, 44(12): 3731-3740.
[2]	Ran ZHAI, Xuebin CHEN, Guopeng ZHANG, Langtao PEI, Zheng MA. Improved K-anonymity privacy protection algorithm based on different sensitivities [J]. Journal of Computer Applications, 2023, 43(5): 1497-1503.
[3]	Hongliang TIAN, Jiayue WANG, Chenxi LI. Data storage scheme based on hybrid algorithm blockchain and node identity authentication [J]. Journal of Computer Applications, 2022, 42(8): 2481-2486.
[4]	Dingkang LIN, Jiaqi YAN, Nandeng BA, Zhenhao FU, Haochen JIANG. Survey of anonymity and tracking technology in Monero [J]. Journal of Computer Applications, 2022, 42(1): 148-156.
[5]	WU Kaifan, YIN Xinchun. Lightweight anonymous mutual authentication protocol based on random operators for radio frequency identification system [J]. Journal of Computer Applications, 2021, 41(6): 1621-1630.
[6]	DU Xinyu, WANG Huaqun. Dynamic group based effective identity authentication and key agreement scheme in LTE-A networks [J]. Journal of Computer Applications, 2021, 41(6): 1715-1722.
[7]	LIU Xiangyu, XIA Guoping, XIA Xiufeng, ZONG Chuanyu, ZHU Rui, LI Jiajia. Personalized privacy protection for spatio-temporal data [J]. Journal of Computer Applications, 2021, 41(3): 643-650.
[8]	Liu YANG, Yun LI. Hybrid K-anonymous feature selection algorithm [J]. Journal of Computer Applications, 2021, 41(12): 3521-3526.
[9]	Li LI, Hongfei YANG, Xiuze DONG. Hierarchical file access control scheme with identity-based multi-conditional proxy re-encryption [J]. Journal of Computer Applications, 2021, 41(11): 3251-3256.
[10]	ZHANG Xinglan, ZHAO Yijing. Two-way synchronous quantum identity authentication protocol based on single photon [J]. Journal of Computer Applications, 2020, 40(9): 2634-2638.
[11]	JIANG Zetao, XU Juanjuan. Heterogenous cross-domain identity authentication scheme based on signcryption in cloud environment [J]. Journal of Computer Applications, 2020, 40(3): 740-746.
[12]	Meishu ZHANG, Yabin XU. Personalized privacy protection method for data with multiple numerical sensitive attributes [J]. Journal of Computer Applications, 2020, 40(2): 491-496.
[13]	CUI Weirong, DU Chenglie. Privacy preserving attribute matching method based on CP-ABE in social networks [J]. Journal of Computer Applications, 2018, 38(4): 1051-1057.
[14]	NING Xueli, LUO Yonglong, XING Kai, ZHENG Xiaoyao. Frequent location privacy-preserving algorithm based on geosocial network [J]. Journal of Computer Applications, 2018, 38(3): 688-692.
[15]	SHAO Dongyang, KANG Baoyuan, WANG Jiaqiang. Analysis and improvement of two electronic cash schemes [J]. Journal of Computer Applications, 2018, 38(2): 386-389.