62
ISSN 1392–124X (print), ISSN 2335–884X (online) INFORMATION TECHNOLOGY AND CONTROL, 2016, T. 45, Nr. 1
Cryptanalysis and Improvement of an Enhanced Two-Factor User
Authentication Scheme in Wireless Sensor Networks
Fushan Wei
1;2
, Jianfeng Ma
1
, Qi Jiang
1
, Jian Shen
3
, Chuangui Ma
2
1
School of Computer Science and Technology, Xidian University
Xi’an 710071, China
2
State Key Laboratory of Mathematical Engineering and Advanced Computing,
Zhengzhou 450002, China
e-mail: weifs831020@163.com
3
School of Computer and Software, Nanjing University of Information Science and Technology,
Nanjing 210000, China
http://dx.doi.org/10.5755/j01.itc.45.1.11949
Abstract. In order to address the scenario in which the user wants to access the real-time data directly from the
sensor node in wireless sensor networks (WSNs), Das proposed a two-factor authentication scheme. In 2010, Khan et
al. pointed out that Das’s scheme has some security flaws and proposed an improved scheme. Recently, Yuan
demonstrated that Khan et al.’s improvement is still insure against several attacks. Yuan also proposed an enhanced
two-factor user authentication scheme using user’s biometrics to fix the security flaws in Khan et al.’s scheme. In this
paper, we show that Yuan’s scheme still suffers from the stolen smart card attack and the GW-node impersonation
attack. Moreover, biometric keys are misused in Yuan’s scheme such that even the valid user cannot pass the biometric
verification. To remedy these problems, we propose an improved two-factor authenticated key distribution scheme
based on fuzzy extractors. Security and performance analysis demonstrates that our scheme is more secure and efficient
than previous schemes.
Keywords: wireless sensor networks; two-factor authentication; bio-metrics; smart card.
1. Introduction
Wireless sensor network (WSN) is a high and new
technology that consists of spatially distributed auto-
nomous sensors to cooperatively monitor physical or
environ-mental conditions and pass their data through
the network to a main location. WSNs are widely used
in many applications, such as battlefield surveillance,
health care monitoring, forest fire detection, water
quality monitoring, and traffic control [1]. WSNs are
often deployed in an unattended or a rather hostile
environment, and the data collected are confidential
and valuable. Therefore, user authentication is a
primary concern in WSNs before accessing data from
the sensor nodes [2–4].
Usually, most of the queries in WSN applications
are managed by base sta-tions or Gateway nodes
(GW-nodes) of the network. However, there are also
great needs to access the real-time data inside the
WSN. In such cases, the user can directly access the
real-time data from the sensor nodes(S-nodes) when
needed, not only from the GW-node. In order to
address security concerns in such a scenario, Das [5]
presented a two-factor user authentication scheme
using smart card and password. Two-factor
authentication is an approach to authenticate someone
which requires the presentation of two different kinds
of authentication factors [6, 7]. In two-factor
authentication, compromise of one authentication
factor could not break the two-factor authentication.
Hence, two-factor authentication schemes are more
difficult to compromise. Das claimed his scheme can
resist replay attack, stolen-verifier attack, guessing
attack, and impersonation attack. However, Das’s
scheme is found to be insecure against various attacks.
Nyang and Lee [8] demonstrated that Das’s scheme is
insecure against off-line dictionary attack, sensor node
compromising attack, and does not protect query
response messages. They also proposed an improved
scheme to overcome the drawbacks of Das’s schemes.
Chen and Shih [9] showed that Das’s scheme does not
provide mutual authentication and proposed their