Security Vulnerabilities And Improvements Of Spam: A Secure Password Authentication Mechanism For Seamless Handover In Proxy Mobile Ipv6 Networks

The main contribution of this paper is to analyze a secure password authentication mechanism (SPAM), proposed by Chuang et al. in 2013 (IEEE Syst J.). The SPAM was used for designing a secure handover in Proxy Mobile IPv6 (PMIPv6) networks. Chuang et al. in the original paper claimed that SPAM provides high security properties and can resist various attacks. However, in this paper we point out that SPAM is vulnerable to the critical attacks, such as stolen smart card and off-line dictionary attack, replay attack and impersonation attack. In addition, we show that the identity of mobile nodes (MNs) and the session key between MNs and mobile access gateway (MAG) can be disclosed by an insider attacker; resultantly, anonymity and confidentiality between MNs and MAG will be completely broken in SPAM. In-order to counter these problems, an improved scheme is offered which also reduces the computational cost. Moreover, the scheme delivers the anonymity/untraceability and secure session key agreement. Finally, the security of the scheme is proved in the random oracle model.