Wang Chenyu, Xu Guoai, Sun Jing
New Research Activities Darparment, Beijing University of Posts and Telecommunications, Haidian District, Beijing 100876, China.
Sensors (Basel). 2017 Dec 19;17(12):2946. doi: 10.3390/s17122946.
As an essential part of Internet of Things (IoT), wireless sensor networks (WSNs) have touched every aspect of our lives, such as health monitoring, environmental monitoring and traffic monitoring. However, due to its openness, wireless sensor networks are vulnerable to various security threats. User authentication, as the first fundamental step to protect systems from various attacks, has attracted much attention. Numerous user authentication protocols armed with formal proof are springing up. Recently, two biometric-based schemes were proposed with confidence to be resistant to the known attacks including offline dictionary attack, impersonation attack and so on. However, after a scrutinization of these two schemes, we found them not secure enough as claimed, and then demonstrated that these schemes suffer from various attacks, such as offline dictionary attack, impersonation attack, no user anonymity, no forward secrecy, etc. Furthermore, we proposed an enhanced scheme to overcome the identified weaknesses, and proved its security via Burrows-Abadi-Needham (BAN) logic and the heuristic analysis. Finally, we compared our scheme with other related schemes, and the results showed the superiority of our scheme.
作为物联网（IoT）的重要组成部分，无线传感器网络（WSN）已经渗透到我们生活的方方面面，如健康监测、环境监测和交通监测等。然而，由于其开放性，无线传感器网络容易受到各种安全威胁。用户认证作为保护系统免受各种攻击的首要基本步骤，已经引起了广泛关注。众多具备形式化证明的用户认证协议如雨后春笋般涌现。最近，提出了两种基于生物特征的方案，并自信地宣称它们能够抵御包括离线字典攻击、身份冒用攻击等已知攻击。然而，在仔细审查这两种方案后，我们发现它们并不像所宣称的那样安全，并证明了这些方案容易遭受各种攻击，如离线字典攻击、身份冒用攻击、缺乏用户匿名性、缺乏前向保密性等。此外，我们提出了一种增强方案来克服已发现的弱点，并通过布罗尔斯-阿巴迪-尼达姆（BAN）逻辑和启发式分析证明了其安全性。最后，我们将我们的方案与其他相关方案进行了比较，结果显示了我们方案的优越性。
