1. 多媒體網路安全實驗室 A novel user identification scheme with key distribution preserving user anonymity for distributed computer networks Date:2011/10/05 報告人：向峻霈 出處 : Wen-Shenq Juang, Sian-Teng Chen, and Horng-Twu Liaw IEEE Transactions on Industrial Electronics, VOL.55, NO.6,2008

2. 多媒體網路安全實驗室 Outline Introduction 1 Proposed scheme 2 Security Analysis 33 Functionality comparison 44 Conclusion 35 2

3. 多媒體網路安全實驗室 Introduction  In various network environments, if a user needs to use or control a remote server  needs to pass the authentication scheme 3

4. 多媒體網路安全實驗室 Introduction  Fan et al. proposed a robust remote authentication scheme with smart cards  Advantages  low computation for smart cards  no password table  passwords chosen by the users themselves  withstanding the replay attack  server authentication  withstanding the dictionary attack  revoking the lost cards without changing the users’ identities 4

5. 多媒體網路安全實驗室 Introduction  Drawbacks  no ability of anonymity  higher computation and communication cost  no session key agreement  cannot prevent the insider attack 5

6. 多媒體網路安全實驗室 Parameter generation phase  Server sets up the system parameters  Chooses a large prime number P  Fp :y 2 = x 3 +ax+b mod P  4a 3 +27b 2 mod P ≠ 0,  G is a generator point of a large order n  selects a random number x  Computes a corresponding public key Pk i = X i x G //X i -> secret key  (P S,P,E p,G,n) ->publish 6

7. 多媒體網路安全實驗室 Registration phase 7 ClientServer { ID i,h( PW i || b) } b i =E s ( h(PW||b) ||ID i ||CI i || h(ID i ||CI i ||h(PW i ||b)) ) V i = h(ID i,s,CI i ) Card =( ID i,CI i,b i,v i ) Card =( ID i,CI i,b i,v i,b ) CIID 1ID 1 2ID 2 …… n ID n tag smart card Card =( ID i,CI i,b i,v i,b ) e = r * G c = r * P s = r * x * G //as a point over E p Precomputation Phasece use in the log-in phase

8. 多媒體網路安全實驗室 Log-in phase 8 Server E vi (e),b i s->decrypts bi V i = h(ID i,s,CI i ) -> decrypts E vi (e) IDi is in the registration CIi is stored in the registration table ------------------check ok c = r * x * G M S = h(c || u || V i ) smart card e = r * G c = r * P s = r * x * G V i = h(ID i,s,CI i ) ID i ||CI i ||h(PW i ||b)) u,M s Checks M s M U = h(h(PW i ||b)||V i ||c||u) S k = h(V i,c,u) MUMU Checks Checks M U S k = h(V i,c,u)

9. 多媒體網路安全實驗室 Password-Changing Phase 9 Server E sk (ID i,h(PW i *||b *)) b i * =E s ( h(PWi*||b*) ||ID i ||CI i || h(ID i ||CI i ||h(PW i *||b*)) ) smart card

10. 多媒體網路安全實驗室 Security analysis  Mutual authentication  Preventing the replay attack  Preventing the insider attack  Preventing the Offline Dictionary Attack Without the Smart card  Preventing the Offline Dictionary Attack With the Smart Card 10

11. 多媒體網路安全實驗室 Log-in phase 11 Server E vi (e),b i s->decrypts bi V i = h(ID i,s,CI i ) -> decrypts E vi (e) IDi is in the registration CIi is stored in the registration table ------------------check ok c = r * x * G M S = h(c || u || V i ) smart card e = r * G c = r * P s = r * x * G V i = h(ID i,s,CI i ) ID i ||CI i ||h(PW i ||b)) u,M s Checks M s M U = h(h(PW i ||b)||V i ||c||u) S k = h(V i,c,u) MUMU Checks Checks M U S k = h(V i,c,u) Mutual Authentication

12. 多媒體網路安全實驗室 Log-in phase 12 Server E vi (e),b i s->decrypts bi V i = h(ID i,s,CI i ) -> decrypts E vi (e) IDi is in the registration CIi is stored in the registration table ------------------check ok c = r * x * G M S = h(c || u || V i ) smart card e = r * G c = r * P s = r * x * G V i = h(ID i,s,CI i ) ID i ||CI i ||h(PW i ||b)) u,M s Checks M s M U = h(h(PW i ||b)||V i ||c||u) S k = h(V i,c,u) MUMU Checks Checks M U S k = h(V i,c,u) Preventing the replay attack

13. 多媒體網路安全實驗室 Registration phase 13 ClientServer { ID i,h( PW i || b) } b i =E s ( h(PW||b) ||ID i ||CI i || h(ID i ||CI i ||h(PW i ||b)) ) V i = h(ID i,s,CI i ) Card =( ID i,CI i,b i,v i ) Card =( ID i,CI i,b i,v i,b ) CIID 1ID 1 2ID 2 …… n ID n smart card Card =( ID i,CI i,b i,v i,b ) e = r * G c = r * P s = r * x * G //as a point over E p Precomputation Phasece use in the log-in phase Preventing the insider attack

14. 多媒體網路安全實驗室 Log-in phase 14 Server E vi (e),b i s->decrypts bi V i = h(ID i,s,CI i ) -> decrypts E vi (e) IDi is in the registration CIi is stored in the registration table ------------------check ok c = r * x * G M S = h(c || u || V i ) smart card e = r * G c = r * P s = r * x * G V i = h(ID i,s,CI i ) ID i ||CI i ||h(PW i ||b)) u,M s Checks M s M U = h(h(PW i ||b)||V i ||c||u) S k = h(V i,c,u) MUMU Checks Checks M U S k = h(V i,c,u) Preventing the offline dictionary attack without the smart card

15. 多媒體網路安全實驗室 Log-in phase 15 Server E vi (e),b i s->decrypts bi V i = h(ID i,s,CI i ) -> decrypts E vi (e) IDi is in the registration CIi is stored in the registration table ------------------check ok c = r * x * G M S = h(c || u || V i ) smart card e = r * G c = r * P s = r * x * G V i = h(ID i,s,CI i ) ID i ||CI i ||h(PW i ||b)) u,M s Checks M s M U = h(h(PW i ||b)||V i ||c||u) S k = h(V i,c,u) MUMU Checks Checks M U S k = h(V i,c,u) Preventing the Offline Dictionary Attack With the Smart Card

16. 多媒體網路安全實驗室 Cost and Functionality Consideration 16

17. 多媒體網路安全實驗室 17 E1: computation cost of registration E2: computation cost of the precomputation phase for the client E3: computation cost of login for the client E4: computation cost of login for the server

18. 多媒體網路安全實驗室 Functionality comparison  C1 : low communication and computation cost  C2 : no password table  C3 : users can choose the password by themselves  C4 : no Time-Synchronization Problem  C5 : mutual authentication  C6 : revoking a lost card without changing the user’s identity  C7 : identity protection  C8 : session key agreement  C9 : preventing the offline dictionary attack with the secret information stored in the smart card 18

19. 多媒體網路安全實驗室 Functionality comparison 19 Yang &Shieh scheme Hwang &Li scheme Fan et al scheme Juang scheme Sun scheme Chien et al scheme The propose d scheme C1XXOOOOO C2OOOOOOO C3OXXOXOO C4OXXOXXO C5XXOOXOO C6XXXXXXO C7XXXXXXO C8XXOOXXO C9XXXXXXO

20. 多媒體網路安全實驗室 Conclusion  Low Communication and Computation Cost  No Password Table  Choosing and Changing of Passwords by Users  No Time-Synchronization Problem  Identity Protection  Revoking the Lost Cards Without Changing  Session Key Agreement 20

21. 多媒體網路安全實驗室