A Secure Chaotic Hash-Based Biometric Remote User Authentication Scheme Using Mobile Devices

Traditional remote user authentication methods mainly employ the possession of a token (magnetic cards, cell phones, personal digital assistant (PDA), and notebook computers, etc.) and/or the knowledge of a secret (password, etc.) in order to establish the identity of an individual. In 2006, Khan et al. proposed an efficient and practical chaotic hash-based fingerprint biometric remote user authentication scheme on mobile devices. The current paper, however, demonstrates that Khan et al.'s scheme is vulnerable to a privileged insider's attacks and impersonation attacks by using lost or stolen mobile devices. Also, we present an improvement to their scheme in order to isolate such problems.