Skip to main content
SpringerLink
Log in

Weakness in Zhang et al.’s Authentication Protocol for Session Initiation Protocol

  • Conference paper
  • First Online:
Advanced Information Technology, Services and Systems (AIT2S 2017)

Part of the book series: Lecture Notes in Networks and Systems ((LNNS,volume 25))

Abstract

Authentication is the most security service required by Session Initiation Protocol (SIP). In recently years, Zhang et al. proposed for the first time an efficient and flexible authentication protocol for SIP using smart card and Elliptic Curve Cryptography. But, in 2014, Zhang et al. showed that their latest proposed protocol is vulnerable to impersonation attack. In order to improve their protocol, Zhang et al. proposed a second protocol. However, in this work we demonstrate that Zhang et al.’s protocol is vulnerable to server spoofing attack. Furthermore to overcome the weakness of Zhang et al.’s protocol we propose an improved and secured SIP authentication and key exchange protocol. The security analysis shows that our proposed protocol can resist to various attack including server spoofing attack.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 169.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 219.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., Schooler, E.: SIP: Session Initiation Protocol. RFC 3261 (Proposed Standard). Updated by RFCs 3265, 3853, 4320, 4916, 5393, June 2002

    Google Scholar 

  2. Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., Leach, P., Luotonen, A., Stewart, L.: HTTP Authentication: Basic and Digest Access Authentication, June 1999

    Google Scholar 

  3. Durlanik, A., Sogukpinar, I.: SIP authentication scheme using ECDH. World Enformatika Soc. Trans. Eng. Comput. Technol. 8, 350–353 (2005)

    Google Scholar 

  4. Huang, H., Wei, W., Brown, G.E.: A new efficient authentication scheme for session initiation protocol. In: Proceedings of the 9th Joint Conference on Information Sciences (2006)

    Google Scholar 

  5. Yoon, E.J., Yoo, K.Y., Kim, C., Hong, Y.S., Jo, M., Chen, H.H.: A secure and efficient SIP authentication scheme for converged VoIP networks. Comput. Commun. 33(14), 1674–1681 (2010)

    Article  Google Scholar 

  6. Liu, W., Koenig, H.: Cryptanalysis of a SIP authentication scheme. In: 12th IFIP TC6/TC11 International Conference, CMS 2011. Lecture Notes in Computer Science, vol. 7025, pp. 134–143 (2011)

    Google Scholar 

  7. Xie, Q.: A new authenticated key agreement for session initiation protocol. Int. J. Commun. Syst. 25(1), 47–54 (2012)

    Article  Google Scholar 

  8. Zhang, L., Tang, S., Cai, Z.: Efficient and flexible password authenticated key agreement for voice over internet protocol session initiation protocol using smart card. Int. J. Commun. Syst. 27(11), 2691–2702 (2013)

    Google Scholar 

  9. Wu, K., Gong, P., Wang, J., Yan, X., Li, P.: An improved authentication protocol for session initiation protocol using smart card and elliptic curve cryptography. Rom. J. Inf. Sci. Technol. 16(4), 324–335 (2013)

    Google Scholar 

  10. Tu, H., Kumar, N., Chilamkurti, N., Rho, S.: An improved authentication protocol for session initiation protocol using smart card. Peer-to-Peer Netw. Appl., 1936–6442 (2013). doi:10.1007/s12083-014-0248-4

  11. Jiang, Q., Ma, J., Tian, Y.: Cryptanalysis of smart-card-based password authenticated key agreement protocol for session initiation protocol of zhang et al. Int. J. Commun. Syst. 28(7), 1340–1351 (2014)

    Article  Google Scholar 

  12. Zhang, L., Tang, S., Cai, Z.: Cryptanalysis and improvement of password-authenticated key agreement for session initiation protocol using smart cards. Secur. Commun. Netw. 7, 2405–2411 (2014)

    Article  Google Scholar 

  13. Farash, M.S.: Security analysis and enhancements of an improved authentication for session initiation protocol with provable security. Peer-to-Peer Netw. Appl. doi:10.1007/s12083-014-0315-x

  14. Mishra, D., Das, A.K., Mukhopadhyay, S.: A secure and efficient ECC-based user anonymity-preserving session initiation authentication protocol using smart card. Peer-to-Peer Netw. Appl. doi:10.1007/s12083-014-0321-z

  15. Zhu, W., Chen, J., He, D.: Enhanced authentication protocol for session initiation protocol using smart card. Int. J. Electr. Secur. Digital Forensics 7(40), 330–342 (2015)

    Article  Google Scholar 

  16. Chaudhry, S.A., Mahmood, K., Naqvi, H., Sher, M.: A secure authentication scheme for session initiation protocol based on elliptic curve cryptography. In: 2015 IEEE International Conference on Computer and Information Technology, Ubiquitous Computing and Communications. Dependable, Autonomic and Secure Computing, Pervasive Intelligence and Computing (2015)

    Google Scholar 

  17. Kumari, S., Chaudhry, S.A., Wu, F., Li, X., Farash, M.S., Khan, M.K.: An improved smart card based authentication scheme for session initiation protocol. Peer-to-Peer Netw. Appl. 10, 92–105 (2015)

    Article  Google Scholar 

  18. Arshad, H., Nikooghadam, M.: An efficient and secure authentication and key agreement scheme for session initiation protocol using ECC. Multimed Tools Appl. 75, 181–197 (2014)

    Article  Google Scholar 

  19. Lin, H., Wen, F., Du, C.: An anonymous and secure authentication and key agreement scheme for session initiation protocol. Multimed Tools Appl. 76, 2315–2329 (2016)

    Article  Google Scholar 

  20. Azrour, M., Farhaoui, Y., Ouanan, M.: A new secure authentication and key exchange protocol for session initiation protocol using smart card. Int. J. Netw. Secur. 19(6), 866–875 (2017). doi:10.6633/IJNS.201711.19(6).2)

    Google Scholar 

  21. Azrour, M., Ouanan, M., Farhaoui, Y.: SIP authentication protocols based on elliptic curve cryptography: survey and comparison. Indones. J. Electr. Eng. Comput. Sci. 4(1), 231–239 (2016)

    Article  Google Scholar 

  22. Azrour, M., Farhaoui, Y., Ouanan, M.: Cryptanalysis of Farash et al.’s SIP authentication protocol. Int. J. Dyn. Syst. Differ. Equ. (in press)

    Google Scholar 

  23. Azrour, M., Farhaoui, Y., Ouanan, M., et al.: A server spoofing attack on Zhang et al. SIP authentication protocol. Int. J. Tomogr. Simul. 30(3), 47–58 (2017)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. M2I Laboratory, ASIA Team, Department of Computer Science, Faculty of Sciences and Techniques, Moulay Ismail University, Errachidia, Morocco

    Mourade Azrour, Yousef Farhaoui & Mohammed Ouanan

Authors
  1. Mourade Azrour
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Yousef Farhaoui
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Mohammed Ouanan
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Mourade Azrour .

Editor information

Editors and Affiliations

  1. Faculty of Sciences and Technologies, Tangier, Morocco

    Mostafa Ezziyyani

  2. Faculty of Sciences and Technologies, University Hassan 1st, Settat, Morocco

    Mohamed Bahaj

  3. Faculty of Sciences and Technologies, Mohammedia, Morocco

    Faddoul Khoukhi

Rights and permissions

Reprints and permissions

Copyright information

© 2018 Springer International Publishing AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Azrour, M., Farhaoui, Y., Ouanan, M. (2018). Weakness in Zhang et al.’s Authentication Protocol for Session Initiation Protocol. In: Ezziyyani, M., Bahaj, M., Khoukhi, F. (eds) Advanced Information Technology, Services and Systems. AIT2S 2017. Lecture Notes in Networks and Systems, vol 25. Springer, Cham. https://doi.org/10.1007/978-3-319-69137-4_22

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-69137-4_22

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-69136-7

  • Online ISBN: 978-3-319-69137-4

  • eBook Packages: EngineeringEngineering (R0)

Publish with us

Policies and ethics

Search

Navigation