Improving the security of 'a flexible biometrics remote user authentication scheme'
Improving the security of 'a flexible biometrics remote user authentication scheme'
复制标题
DOI：
10.1016/j.csi.2006.01.002
复制
发表时间：
2007-01-01
影响因子：
5
通讯作者：
Zhang, Jiashu
中科院分区：
文献类型：
--
作者：
Khan, Muhammad Khurram;Zhang, Jiashu
最近，Lin-Lai提出了“一种灵活的生物识别远程用户认证方案”，该方案基于El Gamal的密码系统和指纹验证，并且不需要在服务器上维护验证表。他们声称他们的方案不会受到攻击，并且适合高安全性应用；然而，我们指出他们的方案很容易受到攻击并且很容易被密码分析。我们证明他们的方案仅执行单边身份验证（仅客户端身份验证），并且用户和远程系统之间没有相互身份验证，因此他们的方案容易受到服务器欺骗攻击。为了填补这个安全漏洞，我们提出了一种改进方案，克服了 Lin-Lai 方案的弱点。因此，我们改进的安全补丁以相互身份验证的形式在客户端和远程系统之间建立了信任。此外，还讨论了基于生物识别的身份验证的一些标准，这些标准在生物识别系统的开发过程中应遵循。 (c) 2006 Elsevier B.V. 保留所有权利。
Recently, Lin-Lai proposed 'a flexible biometrics remote user authentication scheme,' which is based on El Gamal's cryptosystem and fingerprint verification, and does not need to maintain verification tables on the server. They claimed that their scheme is secured from attacks and suitable for high security applications; however, we point out that their scheme is vulnerable and can easily be cryptanalyzed. We demonstrate that their scheme performs only unilateral authentication (only client authentication) and there is no mutual authentication between user and remote system, thus their scheme is susceptible to the server spoofing attack. To fill this security gap, we present an improvement which overcomes the weakness of Lin-Lai's scheme. As a result, our improved security patch establishes trust between client and remote system in the form of mutual authentication. Moreover, some standards for biometric-based authentication are also discussed, which should be followed during the development of biometric systems. (c) 2006 Elsevier B.V. All rights reserved.