Browse > Article
http://dx.doi.org/10.3837/tiis.2018.01.025

Cryptanalysis and improvement of a Multi-server Authentication protocol by Lu et al.  

Irshad, Azeem (Department of Computer Science & Software Engineering, International Islamic University)
Sher, Muhammad (Department of Computer Science & Software Engineering, International Islamic University)
Alzahrani, Bander A. (Faculty of Computing & Information Technology, King Abdulaziz University)
Albeshri, Aiiad (Faculty of Computing & Information Technology, King Abdulaziz University)
Chaudhry, Shehzad Ashraf (Department of Computer Science & Software Engineering, International Islamic University)
Kumari, Saru (Chaudhary Charan Singh University)
Publication Information
KSII Transactions on Internet and Information Systems (TIIS) / v.12, no.1, 2018 , pp. 523-549 More about this Journal
Abstract
The increasing number of subscribers and demand of multiplicity of services has turned Multi-Server Authentication (MSA) into an integral part of remote authentication paradigm. MSA not only offers an efficient mode to register the users by engaging a trusted third party (Registration Centre), but also a cost-effective architecture for service procurement, onwards. Recently, Lu et al.'s scheme demonstrated that Mishra et al.'s scheme is unguarded to perfect forward secrecy compromise, server masquerading, and forgery attacks, and presented a better scheme. However, we discovered that Lu et al.'s scheme is still susceptible to malicious insider attack and non-compliant to perfect forward secrecy. This study presents a critical review on Lu et al.'s scheme and then proposes a secure multi-server authentication scheme. The security properties of contributed work are validated with automated Proverif tool and proved under formal security analysis.
Keywords
Multi-server authentication; remote authentication; biometrics; cryptanalysis;
Citations & Related Records
연도 인용수 순위
  • Reference
1 Lamport L., "Password authentication with insecure communication," ACM Communication, 24 (11), 770-772, 1981.   DOI
2 He D, Kumar N, Chen J, Lee C, Chilamkurti N, Yeo S., "Robust anonymous authentication protocol for health-care applications using wireless medical sensor networks," Multimedia Systems, 21(1), 49-60, 2013.   DOI
3 Lu Y, Li L, Peng H, Yang Y., "An enhanced biometric based authentication scheme for telecare medicine information systems using elliptic curve cryptosystem," Journal of Medical Systems, 39(3), 1-8, 2015.
4 Wang D, Ma C, Gu D, Cui Z., "Cryptanalysis of two dynamic ID-based remote user authentication schemes for multi-server architecture," Network and System Security, 7645, 462-475, 2012.
5 Li X, Ma J, Wang W, Liu C., "A novel smart card and dynamic ID based remote user authentication scheme for multi-server environments," Mathematical and Computer Modelling, 58, 85-95, 2013.   DOI
6 Sun D, Huai J, Sun J, Li J, Zhang J, Feng Z., "Improvements of Juang's password authenticated key agreement scheme using smart cards," IEEE Transactions on Industrial Electronics, 56(6), 2284-2291, 2009.   DOI
7 Yu J, Wang G, Mu Y, Gao W., "An efficient generic framework for three-factor authentication with provably secure instantiation," IEEE Transactions on Information Forensics and Security, 9(12), 2302-2313, 2014.   DOI
8 He D, Zeadally S., "Authentication protocol for an ambient assisted living system," IEEE Communications Magazine, 53(1): 71-77, 2015.   DOI
9 Tsai J., "Efficient multi-server authentication scheme based on one-way hash function without verification table," Computers & Security, 27(3-4): 115-121, 2008.   DOI
10 Irshad, A., Sher, M., Chaudhary, S. A., Naqvi, H., & Farash, M. S., "An efficient and anonymous multi-server authenticated key agreement based on chaotic map without engaging Registration Centre," The Journal of Supercomputing, 72(4), 1623-1644, 2016.   DOI
11 Chaudhry, S. A., Khan, I., Irshad, A., Ashraf, M. U., Khan, M. K., & Ahmad, H. F., "A provably secure anonymous authentication scheme for Session Initiation Protocol," Security and Communication Networks, 2016.
12 Irshad, A., Sher, M., Nawaz, O., Chaudhry, S. A., Khan, I., & Kumari, S., "A secure and provable multi-server authenticated key agreement for TMIS based on Amin et al. scheme," Multimedia Tools and Applications, 1-27, 2016.
13 Mishra D, Ashok K. D, Mukhopadhyay S., "A secure user anonymity-preserving biometric-based multi-server authenticated key agreement scheme using smart cards," Expert Systems with Applications, 41(18), 8129-8143, 2014.   DOI
14 Yang D, Yang B., "A biometric password-based multi-server authentication scheme with smart card," IEEE International Conference on Computer Design and Applications (ICCDA), 5, 554-559, 2010.
15 Yoon E, Yoo K., "Robust biometrics-based multi-server authentication with key agreement scheme for smart cards on elliptic curve cryptosystem," Journal of Supercomputing, 63(1), 235-255, 2013.   DOI
16 He D., "Security flaws in a biometrics-based multi-server authentication with key agreement scheme," IACR Cryptology, 1-9, 2011.
17 Irshad, A., Sher, M., Chaudhry, S. A., Xie, Q., Kumari, S., & Wu, F., "An improved and secure chaotic map based authenticated key agreement in multi-server architecture," Multimedia Tools and Applications, 1-38, 2017.
18 Chuang M, Chen M., "An anonymous multi-server authenticated key agreement scheme based on trust computing using smart cards and biometrics," Expert Systems with Applications, 41, 1411-1418, 2014.   DOI
19 Li, X., Niu, J., Kumari, S., Liao, J., & Liang, W., "An enhancement of a smart card authentication scheme for multi-server architecture," Wireless Personal Communications, 80(1), 175-192, 2015.   DOI
20 Wu, F., Xu, L., Kumari, S., & Li, X., "A novel and provably secure biometrics-based three-factor remote authentication scheme for mobile client-server networks," Computers & Electrical Engineering, 45, 274-285, 2015.   DOI
21 He D, Wang D., "Robust biometrics-based authentication scheme for multiserver environment," IEEE Systems Journal, 9(3), 816-823, 2015.   DOI
22 Jiang, Q., Ma, J., Li, G., & Li, X., "Improvement of robust smart-card-based password authentication scheme," International Journal of Communication Systems, 28(2), 383-393, 2015.   DOI
23 Burrow M, Abadi M, Needham R., "A logic of authentication," ACM Transactions on Computer Systems, 8(1), 18-36, 1990.   DOI
24 Li, X., Niu, J., Kumari, S., Khan, M. K., Liao, J., & Liang, W., "Design and analysis of a chaotic maps-based three-party authenticated key agreement protocol," Nonlinear Dynamics, 80(3), 1209-1220, 2015.   DOI
25 Jiang, Q., Ma, J., Lu, X., & Tian, Y., "An efficient two-factor user authentication scheme with unlinkability for wireless sensor networks," Peer-to-Peer Networking and Applications, 8(6), 1070-1081, 2015.   DOI
26 Jiang, Q., Khan, M. K., Lu, X., Ma, J., & He, D., "A privacy preserving three-factor authentication protocol for e-Health clouds," The Journal of Supercomputing, 72(10), 3826-3849, 2016.   DOI
27 Li, X., Niu, J., Kumari, S., Islam, S. H., Wu, F., Khan, M. K., & Das, A. K., "A novel chaotic maps-based user authentication and key agreement protocol for multi-server environments with provable security. Wire. Pers. Comm., 89(2), 569-597, 2016.   DOI
28 Lu, Y., Li, L., Peng, H., & Yang, Y., "A biometrics and smart cards-based authentication scheme for multi-server environments," Security and Communication Networks, 8(17), 3219-3228, 2015.   DOI
29 Dodis Y, Kanukurthi B, Katz J, Reyzin L, Smith A., "Robust Fuzzy Extractors and Authenticated Key Agreement From Close Secrets," IEEE Transactions on Information Theory, 58(9), 6207-6222, 2012.   DOI
30 Dodis Y, Reyzin L, Smith A., "Fuzzy extractors: how to generate strong keys from biometrics and other noisy data" Advances in Cryptology-EUROCRYPT, 3027: 523-540, 2004.
31 Odelu, V., Ashok, K. D., and Adrijit G. "A secure biometrics-based multi-server authentication protocol using smart cards," IEEE Transactions on Information Forensics and Security, 10(9), 1953-1966, 2015.   DOI
32 Koblitz, N., Elliptic Curve Cryptosystems. Math. Of Comp., Vol. 48, 203-209, 1987.   DOI
33 Ashok, K. D., Odelu, V., and Adrijit G., "A Secure and Robust User Authenticated Key Agreement Scheme for Hierarchical Multi-medical Server Environment in TMIS," Journal of Medical Systems, 39(9), 1-24, 2015.   DOI
34 Ashok, K. D., "A secure user anonymity-preserving three-factor remote user authentication scheme for the telecare medicine information systems," Journal of medical systems, 39(3), 1-20, 2015.   DOI
35 Chatterjee, S., and Das, A.K., "An effective ECC-based user access control scheme with attribute-based encryption for wireless sensor networks," Secur. Commun. Netw., 8(9), 1752-1771, 2015.   DOI
36 Das, A.K., Paul, N.R., Tripathy, L., "Cryptanalysis and improvement of an access control in user hierarchy based on elliptic curve cryptosystem," Information Sciences, 209(C), 80-92, 2012.   DOI
37 Chaudhry SA, Farash MS, Naqvi H, Islam SH, Shon T, Sher M, "A robust and efficient privacy aware handover authentication scheme for wireless networks," Wireless Personal Communication, 2015.
38 Ch, S. A., Sher, M., Ghani, A., Naqvi, H., & Irshad, A., "An efficient signcryption scheme with forward secrecy and public verifiability based on hyper elliptic curve cryptography," Multimedia Tools and Applications, 74(5), 1711-1723, 2015.   DOI
39 Lu Y, Li L, Yang Y., "Robust and efficient biometrics based password authentication scheme for telecare medicine information systems using extended chaotic maps," Journal of Medical Systems, 2015.
40 Li C, Hwang M., "An efficient biometrics-based remote user authentication scheme using smart cards," Journal of Network and Computer Applications, 33(1), 1-5, 2010.   DOI
41 Kilinc, H. H., & Yanik, T., "A survey of SIP authentication and key agreement schemes," Communications Surveys & Tutorials, IEEE, 16(2), 1005-1023, 2014.   DOI
42 Xie, Q., Hu, B., Dong, N., & Wong, D. S., "Anonymous three-party password-authenticated key exchange scheme for telecare medical information systems," PLoS One, 9(7), e102,747, 2014.   DOI
43 Odelu, V., Das, A. K., & Goswami, A., "SEAP: secure and efficient authentication protocol for NFC applications using pseudonyms," IEEE Transactions on Consumer Electronics, 62(1), 30-38, 2016.   DOI
44 Amin, R., Islam, S. H., Biswas, G. P., Khan, M. K., & Kumar, N., "An efficient and practical smart card based anonymity preserving user authentication scheme for TMIS using elliptic curve cryptography," Journal of medical systems, 39(11), 1-18, 2015.   DOI