Perfect forward secrecy in VoIP networks through design a lightweight and secure authenticated communication scheme

With the growth of the internet, development of IP based services has increased. Voice over IP (VoIP) technology is one of the services which works based on the internet and packet switching networks and uses this structure to transfer the multimedia data e.g. voices and images. Recently, Chaudhry et al., Zhang et al. and Nikooghadam et al. have presented three authentication and key agreement protocols, separately. However, in this paper, it is proved that the presented protocols by Chaudhry et al. and also Nikooghadam et al. do not provide the perfect forward secrecy, and the presented protocol by Zhang et al. not only is vulnerable to replay attack, and known session-specific temporary information attack, but also does not provide user anonymity, re-registration and revocation, and violation of fast error detection. Therefore, a secure and efficient two-factor authentication and key agreement protocol is presented. The security analysis proves that our proposed protocol is secure against various attacks. Furthermore, security of proposed scheme is formally analyzed using BAN logic and simulated by means of the AVISPA tool. The simulation results demonstrate security of presented protocol against active and passive attacks. The communication and computation cost of the proposed scheme is compared with previously proposed authentication schemes and results confirm superiority of the proposed scheme.

[1]  Hartmut König,et al.  Cryptanalysis of a SIP Authentication Scheme , 2011, Communications and Multimedia Security.

[2]  Jianhua Chen,et al.  A provably secure anonymous mutual authentication scheme with key agreement for SIP using ECC , 2018, Peer Peer Netw. Appl..

[3]  Xuemin Shen,et al.  Peer-to-Peer Networking and Applications , 2007 .

[4]  Saru Kumari,et al.  Secure anonymity-preserving password-based user authentication and session key agreement scheme for telecare medicine information systems , 2016, Comput. Methods Programs Biomed..

[5]  Eun-Jun Yoon,et al.  Cryptanalysis of DS-SIP Authentication Scheme Using ECDH , 2009, 2009 International Conference on New Trends in Information and Service Science.

[6]  Jianhua Chen,et al.  A secure mutual authentication scheme for session initiation protocol using elliptic curve cryptography , 2012, Secur. Commun. Networks.

[7]  Jianfeng Ma,et al.  A privacy preserving three-factor authentication protocol for e-Health clouds , 2016, The Journal of Supercomputing.

[8]  Dheerendra Mishra On the Security Flaws in ID-based Password Authentication Schemes for Telecare Medical Information Systems , 2014, Journal of Medical Systems.

[9]  Debiao He,et al.  Efficient provably secure password-based explicit authenticated key agreement , 2015, Pervasive Mob. Comput..

[10]  Xinsong Liu,et al.  Cryptanalysis of Arshad et al.’s ECC-based mutual authentication scheme for session initiation protocol , 2012, Multimedia Tools and Applications.

[11]  Vanga Odelu,et al.  An efficient ECC-based privacy-preserving client authentication protocol with key agreement using smart card , 2015, J. Inf. Secur. Appl..

[12]  Nassar Ikram,et al.  Elliptic curve cryptography based mutual authentication scheme for session initiation protocol , 2011, Multimedia Tools and Applications.

[13]  Muhammad Khurram Khan,et al.  An Efficient and Practical Smart Card Based Anonymity Preserving User Authentication Scheme for TMIS using Elliptic Curve Cryptography , 2015, Journal of Medical Systems.

[14]  Fan Wu,et al.  Cryptanalysis and Improvement of a User Authentication Scheme Preserving Uniqueness and Anonymity for Connected Health Care , 2015, Journal of Medical Systems.

[15]  Sebastian Mödersheim,et al.  The AVISPA Tool for the Automated Validation of Internet Security Protocols and Applications , 2005, CAV.

[16]  Dorgham Sisalem,et al.  Denial of service attacks targeting a SIP VoIP infrastructure: attack scenarios and prevention mechanisms , 2006, IEEE Network.

[17]  Lixiang Li,et al.  A secure and efficient mutual authentication scheme for session initiation protocol , 2016, Peer Peer Netw. Appl..

[18]  Muhammad Sher,et al.  A single round-trip SIP authentication scheme for Voice over Internet Protocol using smart card , 2013, Multimedia Tools and Applications.

[19]  Morteza Nikooghadam,et al.  Security analysis and improvement of two authentication and key agreement schemes for session initiation protocol , 2015, The Journal of Supercomputing.

[20]  Mohammad S. Obaidat,et al.  Design and Analysis of an Enhanced Patient-Server Mutual Authentication Protocol for Telecare Medical Information System , 2015, Journal of Medical Systems.

[21]  Jia Lun Tsai Efficient Nonce-based Authentication Scheme for Session Initiation Protocol , 2009, Int. J. Netw. Secur..

[22]  Jian Wang,et al.  Secure SIP authentication scheme supporting lawful interception , 2013, Secur. Commun. Networks.

[23]  Luca Veltri,et al.  SIP security issues: the SIP authentication procedure and its processing load , 2002 .

[24]  Ibrahim Sogukpinar,et al.  SIP Authentication Scheme using ECDH , 2007 .

[25]  Lixiang Li,et al.  An advanced elliptic curve cryptography based mutual authentication scheme for session initiation protocol , 2016, Inf. Technol. Control..

[26]  Chou Chen Yang,et al.  Secure authentication scheme for session initiation protocol , 2005, Comput. Secur..

[27]  Sourav Mukhopadhyay,et al.  A secure and efficient ECC-based user anonymity-preserving session initiation authentication protocol using smart card , 2014, Peer-to-Peer Networking and Applications.

[28]  Mark Handley,et al.  SIP: Session Initiation Protocol , 1999, RFC.

[29]  Saru Kumari,et al.  Cryptanalysis and improvement of a robust smart card secured authentication scheme on SIP using elliptic curve cryptography , 2015, Multimedia Tools and Applications.

[30]  Shehzad Ashraf Chaudhry,et al.  A secure authentication scheme for session initiation protocol by using ECC on the basis of the Tang and Liu scheme , 2014, Secur. Commun. Networks.

[31]  Morteza Nikooghadam,et al.  A lightweight authentication and key agreement protocol preserving user anonymity , 2017, Multimedia Tools and Applications.

[32]  Martín Abadi,et al.  A logic of authentication , 1990, TOCS.

[33]  Lixiang Li,et al.  An anonymous two-factor authenticated key agreement scheme for session initiation protocol using elliptic curve cryptography , 2015, Multimedia Tools and Applications.

[34]  Muhammad Khurram Khan,et al.  A provably secure anonymous authentication scheme for Session Initiation Protocol , 2016, Secur. Commun. Networks.

[35]  Zhihua Cai,et al.  Efficient and flexible password authenticated key agreement for Voice over Internet Protocol Session Initiation Protocol using smart card , 2014, Int. J. Commun. Syst..

[36]  Xiong Li,et al.  Design of a secure anonymity-preserving authentication scheme for session initiation protocol using elliptic curve cryptography , 2018, J. Ambient Intell. Humaniz. Comput..

[37]  Wei-Kuan Shih,et al.  Robust smart card secured authentication scheme on SIP using Elliptic Curve Cryptography , 2014, Comput. Stand. Interfaces.

[38]  Sourav Mukhopadhyay,et al.  A secure password-based authentication and key agreement scheme using smart cards , 2015, J. Inf. Secur. Appl..

[39]  Liping Zhang,et al.  An energy efficient authenticated key agreement protocol for SIP-based green VoIP networks , 2016, J. Netw. Comput. Appl..

[40]  Lawrence C. Stewart,et al.  HTTP Authentication: Basic and Digest Access Authentication , 1999 .

[41]  Naveen K. Chilamkurti,et al.  An improved authentication protocol for session initiation protocol using smart card , 2015, Peer Peer Netw. Appl..

[42]  Jianfeng Ma,et al.  Cryptanalysis of smart‐card‐based password authenticated key agreement protocol for session initiation protocol of Zhang et al. , 2015, Int. J. Commun. Syst..

[43]  Mohammad Sabzinejad Farash Security analysis and enhancements of an improved authentication for session initiation protocol with provable security , 2016, Peer Peer Netw. Appl..

[44]  Costas Lambrinoudakis,et al.  Survey of security vulnerabilities in session initiation protocol , 2006, IEEE Communications Surveys & Tutorials.

[45]  Ruhul Amin,et al.  A Secure Three-Factor User Authentication and Key Agreement Protocol for TMIS With User Anonymity , 2015, Journal of Medical Systems.

[46]  Zhihua Cai,et al.  Cryptanalysis and improvement of password-authenticated key agreement for session initiation protocol using smart cards , 2014, Secur. Commun. Networks.

[47]  Yuqing Zhang,et al.  A new provably secure authentication and key agreement protocol for SIP using ECC , 2009, Comput. Stand. Interfaces.

[48]  Hsiao-Hwa Chen,et al.  A secure and efficient SIP authentication scheme for converged VoIP networks , 2010, Comput. Commun..

[49]  Morteza Nikooghadam,et al.  An efficient and secure authentication and key agreement scheme for session initiation protocol using ECC , 2014, Multimedia Tools and Applications.

[50]  Muhammad Khurram Khan,et al.  An enhanced privacy preserving remote user authentication scheme with provable security , 2015, Secur. Commun. Networks.