title: Security analysis and improvement of an anonymous authentication scheme for roaming services.
abstract: An anonymous authentication scheme for roaming services in global mobility networks allows a mobile user visiting a foreign network to achieve mutual authentication and session key establishment with the foreign-network operator in an anonymous manner. In this work, we revisit He et al.'s anonymous authentication scheme for roaming services and present previously unpublished security weaknesses in the scheme: (1) it fails to provide user anonymity against any third party as well as the foreign agent, (2) it cannot protect the passwords of mobile users due to its vulnerability to an offline dictionary attack, and (3) it does not achieve session-key security against a man-in-the-middle attack. We also show how the security weaknesses of He et al.'s scheme can be addressed without degrading the efficiency of the scheme.
authors.affiliation: Department of Cyber Investigation Police, Howon University, 64 3-gil, Gunsan, Jeollabuk-do 573-718, Republic of Korea.
authors.forename: Youngsook
authors.initials: Y
authors.lastname: Lee
authors.affiliation: Department of Computer Engineering, Sungkyunkwan University, 2066 Seoburo, Suwon, Gyeonggido 440-746, Republic of Korea.
authors.forename: Juryon
authors.initials: J
authors.lastname: Paik
mesh_terms: D000465:Algorithms; D040421:Cell Phone; D003195:Computer Communication Networks; D016494:Computer Security; D003199:Computer Systems; D006801:Humans; D007256:Information Systems; D059015:Wireless Technology