![](bg4.png)
request message S
1
(I). Recall that IDMA is the out-
put of PRF F and C is the output of an IND-CCA
secure symmetric encryption scheme. Due to the in-
distinguishability property of a PRF F, it is computa-
tionally infeasible to distinguish between IDMA and
a random value in {0, 1}
l
. The probability of suc-
cess for an attacker to distinguish between C and a
random element in the ciphertext space is negligible
under the IND-CCA assumption (Bellare, 1997). The
nonce N is randomly selected from Z
∗
p
. At the same
time, MS runs a secure digital signature scheme in
(NIST, 2009) to generate Sig
σ
(N) for a service item
I, giving one-time σ and (IDMA, Γ, m
w
). It is also
straightforward to show that events E
1
and E
2
oc-
cur with negligible probability, where E
1
is the event
that a HLR-generated verification key (IDMA, Γ, m
w
)
is used more than once, and E
2
is the event that an
attacker forges a new, valid message/signature pair
with respect to any HLR-generated verification key.
We have assumed that the probability of deriving
MS identity information from its associated delega-
tion constraint information m
w
is negligible. The part
“IDH” is used to point to the end of the ciphertext C.
Therefore, an attacker can’t find a link of part in S
1
(I)
with the past.
Impersonation Attacks. The enhanced protocol
can efficiently preventan attacker from impersonating
attacks, since the scheme provides secure mutual au-
thentication mechanisms between a roaming MS and
VLR, MS and HLR, or VLR and HLR. Consider the
following impersonation attack scenarios in this pro-
tocol.
An attacker cannot impersonate a legitimate VLR
to cheat MS, since he does not possess the cor-
rect values N and [T
V,M
]
σ
. By intercepting the ex-
changing messages in steps (2) and (4), an outside
attacker first obtain C=[ck, ts, T
exp
, IDV, N, IDMA
′
]
σ
and [IDV, N, [T
V,M
]
σ
]
ck
. Then, she/he tries to cheat
MS by replaying previously reply messages (e.g.,
[IDV, N
′
, [T
′
V,M
]
σ
]
ck
). However, N is different from
those within C in the replayed messages and, there-
fore, it would be rejected by MS. Furthermore, an
inside attacker cannot impersonate the visited VLR
to cheat MS. Since the delegation key σ is unknown
to the inside attacker, and she/he cannot generate
[T
V,M
]
σ
, where T
V,M
={IDV, N, σ
′
}, IDV and N are
chosen by MS, and σ
′
can be verified with the pub-
lic information Γ
′
.
An attacker hasn’t the power to impersonate HLR
while communicating with VLR and to impersonate
VLR while communicating with HLR, since neither
the long-term secret key K
(V,H)
nor a valid IDV in C is
possessed. Hence, while communicating with HLR,
an attacker can neither generate the valid messages in
step (2) to guarantee that the matching of IDV is done
in a consistent way. At the same time, the lack of
key K
(V,H)
implies that it can not decrypt the response
C
V,H
. Likewise, she/he generate the responding con-
firmation C
V,H
while communicating with VLR.
MS and its HLR can authenticate their messages
so that an attacker cannot impersonate them any more.
Since the delegation key σ is unknown to the at-
tacker, and she/he cannot generate a valid cipher-
text C=[ck, ts, T
exp
, IDV, N, IDMA
′
]
σ
. Here, IDMA
′
=B
l
(F(σ, IDMA)), and ts and N are generated by M.
Similarly, the attacker can neither generate the re-
sponding confirmation [T
V,M
]
σ
.
Replay Attacks and DoS Attacks. In DoS attacks,
the attackers may flood a large number of illegal ac-
cess requests to the HLR. Their aim is to consume
critical resources in the HLR. By exhausting these
critical resources, the attacker can prevent the HLR
from serving legitimate users. In HLR-online authen-
tication, for every access request S
1
(I) from all users
that have registered in the HLR, HLR has to perform
two decryption operations and check the validity of
the requesters. These can easily be exploited by the
attacker.
The basic idea as adopted in (Tang, 2008a) is to
use a proxy signature along with mobile authenti-
cation. HLR performs a mobile authentication only
when the proxy signature can be verified by a VLR.
The following steps describe the proxy signature
verification procedure performed by a VLR. For each
request S
1
(I) that is received, extract the nonce N and
its signature Sig
σ
(N)=(R, s). VLR verifies this value
Sig
σ
(N) with the corresponding verification informa-
tion (IDM, Γ, m
w
) of MS, then S
1
(I) is considered to
be legitimate if (sT)⊎(h(
∏
(R)|N)R) = Γ. Otherwise,
the request is illegitimate. Then, VLR construct a re-
quest message S
2
= {IDMA, C} for legitimate S
1
(I),
and send it to the HLR. Thus, it is difficult for an at-
tacker to launch an effective DoS attack to HLR.
Furthermore, we make use of the nonce N to pre-
vent replay attacks. Thus, our solution does not suffer
from this attacks.
Table 1: Security comparison with other related schemes.
(Lee, 2005) (Tang, 2008b) (Youn, 2010) Ours
SP
1
No No Yes Yes
SP
2
No No Yes Yes
SP
3
Yes Yes Yes Yes
SP
4
Yes Yes Yes Yes
SP
5
Yes Yes Yes Yes
We also compare our scheme to other contributory
mobile authentication schemes including the schemes
in (Lee, 2005; Tang, 2008b; Youn, 2010). Table 1
summarizes the security properties of four schemes.
WINSYS 2011 - International Conference on Wireless Information Networks and Systems
126