Choi Younsung, Lee Youngsook, Moon Jongho, Won Dongho
Department of Cyber Security, Howon University, Impi-Myeon, Gunsan-Si, Jeonrabuk-Do 573-718, Korea.
Department of Computer Engineering, Sungkyunkwan University, 2066 Seoburo, Suwon, Gyeonggido 440-746, Korea.
PLoS One. 2017 May 1;12(5):e0176250. doi: 10.1371/journal.pone.0176250. eCollection 2017.
With the rapid development of personal information and wireless communication technology, user authentication schemes have been crucial to ensure that wireless communications are secure. As such, various authentication schemes with multi-factor authentication have been proposed to improve the security of electronic communications. Multi-factor authentication involves the use of passwords, smart cards, and various biometrics to provide users with the utmost privacy and data protection. Cao and Ge analyzed various authentication schemes and found that Younghwa An's scheme was susceptible to a replay attack where an adversary masquerades as a legal server and a user masquerading attack where user anonymity is not provided, allowing an adversary to execute a password change process by intercepting the user's ID during login. Cao and Ge improved upon Younghwa An's scheme, but various security problems remained. This study demonstrates that Cao and Ge's scheme is susceptible to a biometric recognition error, slow wrong password detection, off-line password attack, user impersonation attack, ID guessing attack, a DoS attack, and that their scheme cannot provide session key agreement. Then, to address all weaknesses identified in Cao and Ge's scheme, this study proposes a security enhanced multi-factor biometric authentication scheme and provides a security analysis and formal analysis using Burrows-Abadi-Needham logic. Finally, the efficiency analysis reveals that the proposed scheme can protect against several possible types of attacks with only a slightly high computational cost.
随着个人信息和无线通信技术的快速发展，用户认证方案对于确保无线通信安全至关重要。因此，人们提出了各种多因素认证方案来提高电子通信的安全性。多因素认证涉及使用密码、智能卡和各种生物特征识别技术，为用户提供最大程度的隐私和数据保护。曹和葛分析了各种认证方案，发现Younghwa An的方案容易受到重放攻击（即对手伪装成合法服务器）以及用户伪装攻击（即不提供用户匿名性，允许对手在登录期间拦截用户ID来执行密码更改过程）。曹和葛改进了Younghwa An的方案，但仍存在各种安全问题。本研究表明，曹和葛的方案容易受到生物特征识别错误、错误密码检测缓慢、离线密码攻击、用户伪装攻击、ID猜测攻击、拒绝服务攻击的影响，并且他们的方案无法提供会话密钥协商。然后，为了解决曹和葛方案中发现的所有弱点，本研究提出了一种安全增强的多因素生物特征认证方案，并使用Burrows-Abadi-Needham逻辑进行了安全分析和形式化分析。最后，效率分析表明，所提出的方案仅需略微高一点的计算成本就能抵御几种可能类型的攻击。
