The password-based authentication protocol is the conventional authentication protocol in many distributed systems to authenticate the remote users. However, a passwordbased protocol is vulnerable to the guessing attack, the replay attack, the stolen-verifier problem and the forgery attack [1]. These attacks bother the SAS protocol [2], the revised SAS-1 [3], the revised SAS-2 [3] and the OSPA ...

Recently new protocols have been proposed in IETF for protecting remote client authentication protoocols by running them within a secure tunnel. Examples of such protocols are PIC, PEAP and EAP-TTLS. One goal of these new protocols is to enable the migration from legacy client authentication protocols to more secure protocols, e.g., from plain EAP type to, say, PEAP. In these protocols, the sec...

Providing banking services, especially online banking and electronic payment systems, has always been associated with high concerns about security risks. In this paper, customer authentication for their transactions in electronic banking has been discussed, and a more appropriate way of using biometric fingerprint data, as well as encrypting those data in a different way, has been suggest...

This paper focuses on authentication with three types of entities: a user who sends an authentication request, an service provider who receives and verifies the request, and a database who supplies the authentication-server with information for verifying the request. This paper presents novel authentication protocols that satisfy the following important properties: (1) secure against replay att...

When an IP network is unable to provide users with demanded services, it usually outsources to other networks. Outsourcing will involve the process of authenticating users for services over IP networks. The process can become complex when different networks have different authentication schemes, in which users are required to provide varying sets of information for service authentication. In th...

Ž . The broadband integrated services digital network B-ISDN offers a wide variety of services to its customers. From both provider’s and user’s perspective, a fair and flexible billing system is indispensable to the operation of B-ISDN. In this paper, we discuss different billing policies, and their corresponding authentication protocols, which can be used by the B-ISDN billing system. Flat ra...

A new efficient authentication protocol providing anonymous channels in the global system for mobile communications is presented, using algorithms A3, A5 and A8. The protocol is the result of a combination between the recent GSM authentication scheme proposed by Lee, Hwang and Yang (LHY) and the anonymous channel protocol presented by Lin and Jan (LJ). The result is a protocol with all the feat...

The Extensible Authentication Protocol (EAP) is a framework for transporting authentication credentials. EAP offers simpler interoperability and compatibility across authentication methods. EAP supports multiple authentication methods. In this paper, we have modelled the Extensible Authentication Protocol as a finite state machine. The various entities in our model are Authenticator, EAP Server...

This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The person(s) controlling the copyright in some of this material may not have granted the IETF Trust the right to allow modifications of such material outside the IETF Standards Process. Without obtaining an adequate license from the person(s) controlling t...

Security protocols typically employ an authentication phase followed by a protected data exchange. In some cases, such TLS, these two phases are tightly integrated, while in other cases, such as EAP (Extensible Authentication Protocol) and Kerberos, they are separate and often implemented in different endpoints. However, careless application of this separation has lead to several vulnerabilitie...