KSII Transactions on Internet and Information Systems (TIIS)

Korean Society for Internet Information (한국인터넷정보학회)
권호 표지
DOI QR코드

DOI QR Code

An Enhanced Privacy-Aware Authentication Scheme for Distributed Mobile Cloud Computing Services

  • Xiong, Ling (School of Information Science and Technology, Southwest Jiaotong University) ;
  • Peng, Daiyuan (School of Information Science and Technology, Southwest Jiaotong University) ;
  • Peng, Tu (School of Software, Beijing Institute of Technology) ;
  • Liang, Hongbin (School of Transportation and Logistics, Southwest Jiaotong University)
  • Received : 2017.03.26
  • Accepted : 2017.08.23
  • Published : 2017.12.31
Download PDF
⟨ Previous Next ⟩

Abstract

With the fast growth of mobile services, Mobile Cloud Computing(MCC) has gained a great deal of attention from researchers in the academic and industrial field. User authentication and privacy are significant issues in MCC environment. Recently, Tsai and Lo proposed a privacy-aware authentication scheme for distributed MCC services, which claimed to support mutual authentication and user anonymity. However, Irshad et.al. pointed out this scheme cannot achieve desired security goals and improved it. Unfortunately, this paper shall show that security features of Irshad et.al.'s scheme are achieved at the price of multiple time-consuming operations, such as three bilinear pairing operations, one map-to-point hash function operation, etc. Besides, it still suffers from two minor design flaws, including incapability of achieving three-factor security and no user revocation and re-registration. To address these issues, an enhanced and provably secure authentication scheme for distributed MCC services will be designed in this work. The proposed scheme can meet all desirable security requirements and is able to resist against various kinds of attacks. Moreover, compared with previously proposed schemes, the proposed scheme provides more security features while achieving lower computation and communication costs.

Keywords

References

  1. Z. Qin, J. Sun, A. Wahaballa, W. Zheng, H. Xiong, and Z. Qin, "A secure and privacy-preserving mobile wallet with outsourced verification in cloud computing," Computer Standards & Interfaces, vol. 54, Part 1, pp.55-60, 2017. https://doi.org/10.1016/j.csi.2016.11.012
  2. A. A. Mohammed, X. Kong, L. Liu, F. Xia, S. Abolfazli, Z. Sanaei, and A. Tolba., "BoDMaS: Bio-inspired Selfishness Detection and Mitigation in Data Management for Ad-hoc Social Networks," Ad Hoc Networks, vol.55, pp.119-131, 2017. https://doi.org/10.1016/j.adhoc.2016.09.013
  3. Z. Ning, F. Xia, X. Kong, and Z. Chen, "Social-oriented resource management in cloud-based mobile networks," IEEE Cloud Computing, vol.3, no. 4, pp.24-31, 2016. https://doi.org/10.1109/MCC.2016.82
  4. C.Doukas, T. Pliakas, L. Maglogiannis, "Mobile healthcare information management utilizing cloud computing and android OS,"in Proc. of Engineering in Medicine and Biology Society (EMBC), 2010 Annual International Conference of the IEEE, 2010.
  5. X. Yang, X. Huang, J. Han, and C. Su,"Improved handover authentication and key pre-distribution for wireless mesh networks," Concurrency and Computation: Practice and Experience, vol. 28, no.10, pp. 2978-2990, 2016. https://doi.org/10.1002/cpe.3544
  6. B. Alami Milani and N. Jafari Navimipour, "A systematic literature review of the data replication techniques in the cloud environments," Big Data Research, 2017.
  7. G. Chen, H. Jin, D. Zou, B. B. Zhou, and W. Qiang, "A lightweight software fault-tolerance system in the cloud environment," Concurrency and Computation: Practice and Experience, vol. 27, no.12, pp. 2982-2998, 2015. https://doi.org/10.1002/cpe.3190
  8. S. Z. Mohammadi and J. N. Navimipour, "Invalid cloud providers' identification using the support vector machine," International Journal of Next-Generation Computing, 2017.
  9. T. H. Dinh, C. Lee, D. Niyato and P. Wang, "A survey of mobile cloud computing: architecture, applications, and approaches," WIRELESS COMMUNICATIONS AND MOBILE COMPUTING, vol.13, no.18, pp.1587-1611, 2013. https://doi.org/10.1002/wcm.1203
  10. M. R. Rahimi, J. Ren, C. H. Liu, A.V. Vasilakos, N. Venkatasubramanian, "Mobile Cloud Computing: A Survey, State of Art and Future Directions," Mobile Netw Appl, vol.19, pp.133-143, 2014. https://doi.org/10.1007/s11036-013-0477-4
  11. A. R. Khan, M. Othman, S.A. Madani, S. U. Khan, "A Survey of Mobile Cloud Computing Application Models," IEEE COMMUNICATIONS SURVEYS & TUTORIALS, vol.16, no.1, pp.393-413, 2014. https://doi.org/10.1109/SURV.2013.062613.00160
  12. A. N. Khan, M.L. MatKiah, S.U. Khan, S.A. Madani, "Towards secure mobile cloud computing: A survey," Future Generation Computer Systems, vol.29, no.5, pp.1278-1299, 2013. https://doi.org/10.1016/j.future.2012.08.003
  13. Q. Jiang, J.F Ma, And F.S. Wei, "On the Security of a Privacy-Aware Authentication Scheme for Distributed Mobile Cloud Computing Services," IEEE Systems Journal, vol.99, pp.1-4, 2016.
  14. J.L.Tsai and N.W. Lo, "A privacy-aware authentication scheme for distributed mobile cloud computing services," IEEE Systems Journal, vol.9, no.3, pp. 805-815, 2015. https://doi.org/10.1109/JSYST.2014.2322973
  15. Microsoft,Windows Live ID, 2011, [Online]. Available: https://account.live.com/.
  16. OpenID Foundation, OpenID Authentication 2.0, 2007, [Online]. Available: http://openid.net/specs/ openid-authentication-2_0.html
  17. A. Irshad, M. Sher, H.F. Ahmad, B. A. Alzahrani, S. A.Chaudhry, R. Kumar, "An improved Multi-server Authentication Scheme for Distributed Mobile Cloud Computing Services," KSII TRANSACTIONS ON INTERNET AND INFORMATION SYSTEMS, vol.10, no.12, pp.5529-5552, 2016. https://doi.org/10.3837/tiis.2016.12.021
  18. D. Pointcheval, S. Zimmer, "Multi-factor authenticated key exchange," Applied cryptography and network security, 2008.
  19. D. Wang, D. He, P. Wang, and C.H. Chu,"Anonymous two-factor authentication in distributed systems: Certain goals are beyond attainment," IEEE Trans. Dependable Secure Comput., vol.12, no.4, pp. 428-442, 2015. https://doi.org/10.1109/TDSC.2014.2355850
  20. D.Wang and P.Wang,"On the usability of two-factor authentication," in Proc. 10th Int. Conf. Security Privacy Commun, 2014.
  21. C.C. Chang; T.C.Wu, "Remote Password Authentication with Smart Cards," IEEE Proceedings, vol.138, pp.165-168, 1991. https://doi.org/10.1049/ip-d.1991.0023
  22. S. Lee, I.Ong, H.T. Lim, H.J. Lee,"Two factor authentication for cloud computing," International Journal of KIMICS, vol.8, no.4, pp. 427-432, 2010.
  23. A.J. Choudhury, P. Kumar, M. Sain, et al., "A Strong User Authentication Framework for Cloud Computing," in Proc. of IEEE Asia -Pacific Services Computing Conference, 2011.
  24. N. Chen, R. Jiang, "Security Analysis and Improvement of User Authentication Framework for Cloud Computing," Journal of Networks, vol.9, no.1, pp.198-203, 2014.
  25. H.X. Li , F.H. Li, C.G. Song, Y.L. Yan,"Towards Smart Card Based Mutual Authentication Schemes in Cloud Computing," KSII TRANSACTIONS ON INTERNET AND INFORMATION SYSTEMS, vol.9, no.7, pp.2719-2735, 2015. https://doi.org/10.3837/tiis.2015.07.022
  26. J. Hughes,"Profiles for the OASIS Security Assertion Markup Language(SAML)V2.0," OASIS Standard, 2005.
  27. E. Chen, Y. Pei and S. Chen,"OAuth Demystified for Mobile Application Developers," in Proc. of the 2014 ACM SIGSAC Conference on Computer and Communications Security, Scottsdale, Arizona, USA, pp.892-903, 2012.
  28. A. Armando, R. Carbone, L. Compagna, J. Cuellar, G. Pellegrino, A. Sorniotti,"An authentication flaw in browser-based Single Sign-On protocols," Impact and remediations, Computers and Security, vol.33, pp.41-58, 2013. https://doi.org/10.1016/j.cose.2012.08.007
  29. S. Halevi and H. Krawczyk, "Public-key cryptography and password protocols," ACM Trans. Inform. Syst. Secur., vol. 2, pp. 230-268, 1999. https://doi.org/10.1145/322510.322514
  30. D.B He, S.Zeadally, N.Kumar, W.Wu, "Efficient and anonymous mobile user authentication protocol using self-certified public key cryptography for multi-server architectures," IEEE Transactions on information forensics and Security, vol.9, pp.2052-2064, 2016.
  31. W.B. Hsieh and J.S. Leu,"An anonymous mobile user authentication protocol using self-certified public keys based on multi-server architectures," The Journal of Supercomputing, vol.70, no.1, pp.133-148, 2014. https://doi.org/10.1007/s11227-014-1135-8
  32. R. Amin and G. P. Biswas,"Design and analysis of bilinear pairing based mutual authentication and key agreement protocol usable in multi-server environment," Wireless Personal Communications, vol.84, no.1, pp.439-462, 2015. https://doi.org/10.1007/s11277-015-2616-7
  33. Y.P. Liao and C.M. Hsiao,"A novel multi-server remote user authentication scheme using self-certified public keys for mobile clients," Future Generation Computer Systems, vol.29, no.3, pp.886-900, 2013. https://doi.org/10.1016/j.future.2012.03.017
  34. V. Odelu, A. K. Das, S. Kumari, X. Huang, M. Wazid,"Provably secure authenticated key agreement scheme for distributed mobile cloud computing services," Future Generation Computer Systems,vol.68, pp.74-88, 2017. https://doi.org/10.1016/j.future.2016.09.009
  35. D He, N Kumar, MK Khan, L Wang,"Efficient Privacy-Aware Authentication Scheme for Mobile Cloud Computing Services," IEEE Systems Journal, vol.PP, no.99, pp.1-11, 2016.
  36. R. Amin, S.H. Islam, G.P. Biswas, D. Giri, M.K. Khan,"Kumar N., A more secure and privacy-aware anonymous user authentication scheme for distributed mobile cloud computing environments," Security and Communication Network, vol.9, no.17, pp.4650-4666, 2016. https://doi.org/10.1002/sec.1655
  37. V. Odelu, A. Kumar and A. Goswami, "A secure biometrics-based multi-server authentication protocol using smart cards," IEEE Transactions on information forensics and Security, vol.9, pp.1953-1966, 2015.
  38. M. Bellare, D. Pointcheval, and P. Rogaway,"Authenticated key agreement secure against dictionary attacks," in Proc. of EUROCRYPT,pp. 139-155, 2000.
  39. M. Jakpbsson and D. Pointcheval," Mutual authentication for low-power mobile devices," in Proc. of FC, pp. 178-195, 2001.

Cited by

  1. Efficient Hierarchical Authentication Protocol for Multiserver Architecture vol.2020, pp.None, 2017, https://doi.org/10.1155/2020/2523834
  2. An Identity-Based Anonymous Three-Party Authenticated Protocol for IoT Infrastructure vol.2020, pp.None, 2017, https://doi.org/10.1155/2020/8829319
  3. Provably Secure ECC-Based Three-Factor Authentication Scheme for Mobile Cloud Computing with Offline Registration Centre vol.2021, pp.None, 2017, https://doi.org/10.1155/2021/8848032