1. 1 Three-Party Authenticated Key Agreements and Its Applications- PCSs Roaming Protocol 李添福 (Tian-Fu Lee) 國立成功大學資訊工程博士 Cryptography/ Network security/ Wireless networks communication/ Algorithmic graph theory/ Database and data engineering

2. 2 Outlines Three-Party Authenticated Key Agreements (3PAKA) Applications Portable Communication Systems (PCSs) Roaming Protocol RFID Protocol E-Payment Protocol Electronic Medical Record Security and Privacy Vehicular Mobile Network Proposed PCSs Roaming Protocol Delegation-Based Authentication Protocol for PCSs Security discussion Computational comparison & Experimental Results Conclusions

3. 3 Three-Party Authenticated Key Agreements An authenticated key agreement protocol is an interactive method for two or more parties to determine session keys based on their secret keys or public/private keys. Authentication Key agreement / key exchange SK Secure communication Trusted server

4. 4 Portable Communication Systems Roaming Protocol Mobile Station Visited NetworkHome Network PDA cellular phone notebook

5. 5 RFID Protocol TagReaderDatabase Server

6. 6 E-Payment Protocol Buyer Seller E-Bank

7. 7 醫療資訊安全 - 電子病歷安全與隱私 (Electronic Medical Record Security and Privacy) IC card Hospital 政府衛生行政單位 電子病歷 Database 健保機關 一般民眾

8. 8 Vehicular Mobile Network

9. 9 Proposed PCSs Roaming Protocol  Delegation-Based Authentication Protocol for PCSs

10. 10 Delegation-Based Authentication Protocol for PCSs Registration On-line authentication process i-th Off-line authentication process

11. 11 Delegation-Based Authentication Protocol for PCSs MSVN HN Delegation (  (x),K) (x,v=g x ) Public key (v) Proxy signature Verify the signature by v

12. 12 On-line authentication process Sing  (msg.),K Verify K MS ( ,K) VN (K VH ; pk:v) HN ( ,K VH ) K  ID MS SK,h(token) SK, token Obtain SK

13. 13 i-th Off-line authentication process E SK i (token i,h(token i+1 )) Verify token i Keep h(token i+1 ) Compute SK i+1 MS (SK i, token i ) VN (SK i, h(token i )) HN Compute SK i+1

14. 14 comparison Previous Scheme: token i and token i+1 are independent.  HN can forge token i  Have not non-repudiation  Charge Problem : Mobile users deny has used services and refuse to pay. Overcharge mobile users for services that he did not request. [IEEE Trans. Wireless Commun. 2005] Proposed Scheme: All token i are chained by backward hash-chain and are decided by MS.  HN cannot forge token i  Have non-repudiation  Pre-Compute and reduce the computational cost in MS. [IEEE Trans. Wireless Commun. 2009]

15. 15 i-th Off-line authentication process E SK i (token i ) Verify token i Keep token i = h(token i+1 ) Compute SK i+1 MS (SK i, token i ) VN (SK i, h(token i )) HN Compute SK i+1 Pre-compute and store h (1) (n 1 ), h (2) (n 1 ) (=token n ), …, h (n) (n 1 )(=token 2 ), h (n+1) (n 1 )(=token 1 ) token 1

16. 16 Security Discussion GSMMGSMPublic-key based scheme Lee & Yeh's Scheme Proposed Scheme Identity privacy No Yes Non-repudiation No YesNoYes Mutual-authen. (MS-VN) No Yes Easy key management Yes NoYes Low computational load Yes NoYes Good commu. efficiency Yes NoYes

17. 17 Computational comparison of MS * : Can be pre-computed in this entry. hash functionsecret-key computation (encryption/decryption) public-key computation (signature/verification) GSM 2(n+1)1(n+1)0 MGSM 1(n+1) 0 Public-key based scheme 002n2n Lee & Yeh's scheme On-line 211Pre.* Off-line 3n3nn0 Proposed schemeOn-line (n+1)Pre. * +211Pre.* Off-line nn0

18. 18 Experimental Results

19. 19 Experimental Results

20. 20 Conclusions Three-party authenticated key agreements and its applications Proposed secure and efficient delegation- based authentication protocol for PCSs Future researches Vehicular Mobile Network Electronic Medical Record Security and Privacy

21. 21 References Lee, T.-F., Hwang, T. and Lin C.-L. “Enhanced Three-Party Encrypted Key Exchange without Server Public Keys,” Computers & Security, Volume: 23, Issue: 7, pp. 571-577, October, 2004. Wen, H.-A., Lee, T.-F. and Hwang, T. “A Provably Secure Three-Party Password-based Authenticated Key Exchange Protocol Using Weil Pairing,” IEE Proc. Communications, Vol. 152, No. 2, pp. 138- 143, April 2005. Lee, T.-F., Liu, J.-L., Sung, M.-J., Yang, S.-B. and Chen, C.-M., “Communication-Efficient Three- Party Protocols for Authentication and Key Agreement”, Computers and Mathematics with Applications, Vol. 58, No, 4, pp.641-648, August, 2009. Lee, T.-F., Chang, C.-C. and Hwang, T. “Private Authentication Techniques for the Global Mobility Network,” Wireless Personal Communications, Vol. 35,Issue: 4, pp. 329-336, December 2005. Lee, W.-B. and Yeh, C.-K., “A new delegation-based authentication protocol for use in portable communication systems,” IEEE Trans. Wireless Commun., vol. 4, no.1, pp.57-64, January 2005. Lee, T.-F., Chang, S.-H., Hwang, T. and Chong, S.-K., “Enhanced Delegation-Based Authentication Protocol for PCSs”, IEEE Trans. Wireless Commun., Vol.8, No. 5, pp. 2166-2171, May 2009.