Browse > Article
http://dx.doi.org/10.3837/tiis.2017.12.026

An Enhanced Privacy-Aware Authentication Scheme for Distributed Mobile Cloud Computing Services  

Xiong, Ling (School of Information Science and Technology, Southwest Jiaotong University)
Peng, Daiyuan (School of Information Science and Technology, Southwest Jiaotong University)
Peng, Tu (School of Software, Beijing Institute of Technology)
Liang, Hongbin (School of Transportation and Logistics, Southwest Jiaotong University)
Publication Information
KSII Transactions on Internet and Information Systems (TIIS) / v.11, no.12, 2017 , pp. 6169-6187 More about this Journal
Abstract
With the fast growth of mobile services, Mobile Cloud Computing(MCC) has gained a great deal of attention from researchers in the academic and industrial field. User authentication and privacy are significant issues in MCC environment. Recently, Tsai and Lo proposed a privacy-aware authentication scheme for distributed MCC services, which claimed to support mutual authentication and user anonymity. However, Irshad et.al. pointed out this scheme cannot achieve desired security goals and improved it. Unfortunately, this paper shall show that security features of Irshad et.al.'s scheme are achieved at the price of multiple time-consuming operations, such as three bilinear pairing operations, one map-to-point hash function operation, etc. Besides, it still suffers from two minor design flaws, including incapability of achieving three-factor security and no user revocation and re-registration. To address these issues, an enhanced and provably secure authentication scheme for distributed MCC services will be designed in this work. The proposed scheme can meet all desirable security requirements and is able to resist against various kinds of attacks. Moreover, compared with previously proposed schemes, the proposed scheme provides more security features while achieving lower computation and communication costs.
Keywords
Mobile cloud computing; single sign-on; trust third party; authentication; user anonymity;
Citations & Related Records
Times Cited By KSCI : 3  (Citation Analysis)
연도 인용수 순위
1 S. Halevi and H. Krawczyk, "Public-key cryptography and password protocols," ACM Trans. Inform. Syst. Secur., vol. 2, pp. 230-268, 1999.   DOI
2 D.B He, S.Zeadally, N.Kumar, W.Wu, "Efficient and anonymous mobile user authentication protocol using self-certified public key cryptography for multi-server architectures," IEEE Transactions on information forensics and Security, vol.9, pp.2052-2064, 2016.
3 W.B. Hsieh and J.S. Leu,"An anonymous mobile user authentication protocol using self-certified public keys based on multi-server architectures," The Journal of Supercomputing, vol.70, no.1, pp.133-148, 2014.   DOI
4 Z. Qin, J. Sun, A. Wahaballa, W. Zheng, H. Xiong, and Z. Qin, "A secure and privacy-preserving mobile wallet with outsourced verification in cloud computing," Computer Standards & Interfaces, vol. 54, Part 1, pp.55-60, 2017.   DOI
5 D He, N Kumar, MK Khan, L Wang,"Efficient Privacy-Aware Authentication Scheme for Mobile Cloud Computing Services," IEEE Systems Journal, vol.PP, no.99, pp.1-11, 2016.
6 R. Amin and G. P. Biswas,"Design and analysis of bilinear pairing based mutual authentication and key agreement protocol usable in multi-server environment," Wireless Personal Communications, vol.84, no.1, pp.439-462, 2015.   DOI
7 Y.P. Liao and C.M. Hsiao,"A novel multi-server remote user authentication scheme using self-certified public keys for mobile clients," Future Generation Computer Systems, vol.29, no.3, pp.886-900, 2013.   DOI
8 V. Odelu, A. K. Das, S. Kumari, X. Huang, M. Wazid,"Provably secure authenticated key agreement scheme for distributed mobile cloud computing services," Future Generation Computer Systems,vol.68, pp.74-88, 2017.   DOI
9 V. Odelu, A. Kumar and A. Goswami, "A secure biometrics-based multi-server authentication protocol using smart cards," IEEE Transactions on information forensics and Security, vol.9, pp.1953-1966, 2015.
10 R. Amin, S.H. Islam, G.P. Biswas, D. Giri, M.K. Khan,"Kumar N., A more secure and privacy-aware anonymous user authentication scheme for distributed mobile cloud computing environments," Security and Communication Network, vol.9, no.17, pp.4650-4666, 2016.   DOI
11 M. Bellare, D. Pointcheval, and P. Rogaway,"Authenticated key agreement secure against dictionary attacks," in Proc. of EUROCRYPT,pp. 139-155, 2000.
12 M. Jakpbsson and D. Pointcheval," Mutual authentication for low-power mobile devices," in Proc. of FC, pp. 178-195, 2001.
13 G. Chen, H. Jin, D. Zou, B. B. Zhou, and W. Qiang, "A lightweight software fault-tolerance system in the cloud environment," Concurrency and Computation: Practice and Experience, vol. 27, no.12, pp. 2982-2998, 2015.   DOI
14 A. A. Mohammed, X. Kong, L. Liu, F. Xia, S. Abolfazli, Z. Sanaei, and A. Tolba., "BoDMaS: Bio-inspired Selfishness Detection and Mitigation in Data Management for Ad-hoc Social Networks," Ad Hoc Networks, vol.55, pp.119-131, 2017.   DOI
15 Z. Ning, F. Xia, X. Kong, and Z. Chen, "Social-oriented resource management in cloud-based mobile networks," IEEE Cloud Computing, vol.3, no. 4, pp.24-31, 2016.   DOI
16 C.Doukas, T. Pliakas, L. Maglogiannis, "Mobile healthcare information management utilizing cloud computing and android OS,"in Proc. of Engineering in Medicine and Biology Society (EMBC), 2010 Annual International Conference of the IEEE, 2010.
17 X. Yang, X. Huang, J. Han, and C. Su,"Improved handover authentication and key pre-distribution for wireless mesh networks," Concurrency and Computation: Practice and Experience, vol. 28, no.10, pp. 2978-2990, 2016.   DOI
18 B. Alami Milani and N. Jafari Navimipour, "A systematic literature review of the data replication techniques in the cloud environments," Big Data Research, 2017.
19 S. Z. Mohammadi and J. N. Navimipour, "Invalid cloud providers' identification using the support vector machine," International Journal of Next-Generation Computing, 2017.
20 T. H. Dinh, C. Lee, D. Niyato and P. Wang, "A survey of mobile cloud computing: architecture, applications, and approaches," WIRELESS COMMUNICATIONS AND MOBILE COMPUTING, vol.13, no.18, pp.1587-1611, 2013.   DOI
21 M. R. Rahimi, J. Ren, C. H. Liu, A.V. Vasilakos, N. Venkatasubramanian, "Mobile Cloud Computing: A Survey, State of Art and Future Directions," Mobile Netw Appl, vol.19, pp.133-143, 2014.   DOI
22 Microsoft,Windows Live ID, 2011, [Online]. Available: https://account.live.com/.
23 A. N. Khan, M.L. MatKiah, S.U. Khan, S.A. Madani, "Towards secure mobile cloud computing: A survey," Future Generation Computer Systems, vol.29, no.5, pp.1278-1299, 2013.   DOI
24 Q. Jiang, J.F Ma, And F.S. Wei, "On the Security of a Privacy-Aware Authentication Scheme for Distributed Mobile Cloud Computing Services," IEEE Systems Journal, vol.99, pp.1-4, 2016.
25 J.L.Tsai and N.W. Lo, "A privacy-aware authentication scheme for distributed mobile cloud computing services," IEEE Systems Journal, vol.9, no.3, pp. 805-815, 2015.   DOI
26 OpenID Foundation, OpenID Authentication 2.0, 2007, [Online]. Available: http://openid.net/specs/ openid-authentication-2_0.html
27 A. Irshad, M. Sher, H.F. Ahmad, B. A. Alzahrani, S. A.Chaudhry, R. Kumar, "An improved Multi-server Authentication Scheme for Distributed Mobile Cloud Computing Services," KSII TRANSACTIONS ON INTERNET AND INFORMATION SYSTEMS, vol.10, no.12, pp.5529-5552, 2016.   DOI
28 D. Pointcheval, S. Zimmer, "Multi-factor authenticated key exchange," Applied cryptography and network security, 2008.
29 D. Wang, D. He, P. Wang, and C.H. Chu,"Anonymous two-factor authentication in distributed systems: Certain goals are beyond attainment," IEEE Trans. Dependable Secure Comput., vol.12, no.4, pp. 428-442, 2015.   DOI
30 D.Wang and P.Wang,"On the usability of two-factor authentication," in Proc. 10th Int. Conf. Security Privacy Commun, 2014.
31 A. R. Khan, M. Othman, S.A. Madani, S. U. Khan, "A Survey of Mobile Cloud Computing Application Models," IEEE COMMUNICATIONS SURVEYS & TUTORIALS, vol.16, no.1, pp.393-413, 2014.   DOI
32 J. Hughes,"Profiles for the OASIS Security Assertion Markup Language(SAML)V2.0," OASIS Standard, 2005.
33 C.C. Chang; T.C.Wu, "Remote Password Authentication with Smart Cards," IEEE Proceedings, vol.138, pp.165-168, 1991.   DOI
34 S. Lee, I.Ong, H.T. Lim, H.J. Lee,"Two factor authentication for cloud computing," International Journal of KIMICS, vol.8, no.4, pp. 427-432, 2010.
35 A.J. Choudhury, P. Kumar, M. Sain, et al., "A Strong User Authentication Framework for Cloud Computing," in Proc. of IEEE Asia -Pacific Services Computing Conference, 2011.
36 N. Chen, R. Jiang, "Security Analysis and Improvement of User Authentication Framework for Cloud Computing," Journal of Networks, vol.9, no.1, pp.198-203, 2014.
37 H.X. Li , F.H. Li, C.G. Song, Y.L. Yan,"Towards Smart Card Based Mutual Authentication Schemes in Cloud Computing," KSII TRANSACTIONS ON INTERNET AND INFORMATION SYSTEMS, vol.9, no.7, pp.2719-2735, 2015.   DOI
38 E. Chen, Y. Pei and S. Chen,"OAuth Demystified for Mobile Application Developers," in Proc. of the 2014 ACM SIGSAC Conference on Computer and Communications Security, Scottsdale, Arizona, USA, pp.892-903, 2012.
39 A. Armando, R. Carbone, L. Compagna, J. Cuellar, G. Pellegrino, A. Sorniotti,"An authentication flaw in browser-based Single Sign-On protocols," Impact and remediations, Computers and Security, vol.33, pp.41-58, 2013.   DOI