Robust Biometrics Based Authentication and Key Agreement Scheme for Multi-Server Environments Using Smart Cards

Yanrong Lu; Lixiang Li; Xing Yang; Yixian Yang

doi:10.1371/journal.pone.0126323

Abstract

Biometrics authenticated schemes using smart cards have attracted much attention in multi-server environments. Several schemes of this type where proposed in the past. However, many of them were found to have some design flaws. This paper concentrates on the security weaknesses of the three-factor authentication scheme by Mishra et al. After careful analysis, we find their scheme does not really resist replay attack while failing to provide an efficient password change phase. We further propose an improvement of Mishra et al.’s scheme with the purpose of preventing the security threats of their scheme. We demonstrate the proposed scheme is given to strong authentication against several attacks including attacks shown in the original scheme. In addition, we compare the performance and functionality with other multi-server authenticated key schemes.

Citation: Lu Y, Li L, Yang X, Yang Y (2015) Robust Biometrics Based Authentication and Key Agreement Scheme for Multi-Server Environments Using Smart Cards. PLoS ONE 10(5): e0126323. https://doi.org/10.1371/journal.pone.0126323

Academic Editor: Wen-Bo Du, Beihang University, CHINA

Received: September 17, 2014; Accepted: March 30, 2015; Published: May 15, 2015

Copyright: © 2015 Lu et al. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited

Data Availability: All relevant data are within the paper.

Funding: This work was supported by National Natural Science Foundation of China (grant no. 61121061), the Beijing Natural Science Foundation (grant no. 4142016), and the Asia Foresight Program under NSFC Grant (grant no. 61411146001). The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript.

Competing interests: The authors have declared that no competing interests exist.

Introduction

With the swift development of wireless communications and network technologies, more and more people use wireless handheld devices (e.g.PDA, notebook and mobile phone, etc) to enjoy mobile services almost anytime and anywhere. However, open nature of networks demands for security concern of paid and protected resources available over the network [1–5]. Authentication mechanism becomes an essential need before a remote user can access the services. Since then Lamport [6] proposed the first authentication scheme, a number of authentication schemes have been put forward for different applications [7–13].

However, most of the existing password authentication schemes are based on a single-server environment which are unfit for the multi-server environments. Recently, a large number of smart cards based remote user authentication schemes for multi-server environments have been proposed. In addition, compared with other authentication schemes, schemes that only use random numbers and a hash function were getting much more attention because of their low computation costs. In 2008, Tsai [14] proposed an efficient multi-server authentication scheme using the random number and one-way hash function. After that, numerous authenticated key agreement schemes were presented for multi-server environments one after another [15–17]. In 2012, Li et al. [18] proposed a novel authenticated key exchange scheme for multi-server environments. Unfortunately, Xue et al.[19] showed that Li et al.’s scheme did not resist some types of known attacks, such as vulnerability to verifier stolen, off-line password guess, replay, denial of service and forgery attacks. Then, Xue et al. proposed an improved scheme to remedy the weaknesses of Li et al.’s scheme. Nevertheless, Lu et al.[20] observed that Xue et al.’s scheme was not only really insecure against masquerade and insider attacks but also was vulnerable to off-line password guessing attack. To improve the shortcomings of Xue et al.’s scheme, Lu et al. proposed a slight modified authentication scheme for multi-server environments.

All above mentioned authentication schemes are based on password and smart cards. Note that the password cannot be considered as a unique identity identifier and it’s needed to be remembered. Moreover, possibility of password guessing attack is also a concern. Compared with cryptographic keys and passwords, biometric keys (e.g.fingerprint, face, iris, hand geometry and palm-print, etc.) have many advantages [21], for example, they are difficult to lose or forget; they are difficult to copy or share; they are difficult to forge or distribute biometrics; they are difficult to guess; they are more difficult to break biometric keys. Recently, Chuang et al.[22] presented an efficient biometrics based authentication scheme using smart cards for multi-server environments, which was previously considered to be have more security properties. However, Mishra et al. [23] showed that Chuang et al.’s scheme was vulnerable to stolen smart card attack, server spoofing attack and impersonation attack. In addition, they proposed an improved biometrics-based multi-server authenticated key agreement scheme using smart cards and they claimed that their scheme satisfied all desirable security requirements. Unfortunately, this paper will demonstrate that the scheme cannot really resist replay attack and cannot provide an efficient password change phase.

In this paper, we concentrate on the security weaknesses of the three-factor authentication scheme by Mishra et al. After carefully analysis, we find their scheme does not really resist replay attack while fails to provide an efficient password change phase. We further propose an improvement of Mishra et al.’s scheme with the purpose of preventing the security threats of their scheme. We demonstrate the proposed scheme is given to strong authentication against several attacks including attacks showed in the original scheme. In addition, we compare the performance and functionality with other related schemes.

The rest of paper is organized as follows: In Section 2 and Section 3, we review and analyze the Mishra et al.’s scheme. In Section 4, we propose an enhancement authentication scheme for multi-sever environments. In Section 5, we present a security analysis of our scheme. Section 6 shows security and performance analyses by comparing our scheme with previous schemes. We conclude in Section 7.

Review of Mishra et al.’s scheme

There are three phases relating to Mishra et al.’s scheme which consists of the registration, login and authentication and password updating. Table 1 lists the notations used in this paper.

Download:

Table 1. Notations.

https://doi.org/10.1371/journal.pone.0126323.t001

Registration

Suppose RC is the trusted third party responsible for registration of U_i and S_j.

Server registration.

S_j sends the registration request to RC;
After receiving the request, RC sends the key PSK to S_j through a secure channel;
Upon receiving the secret key PSK, S_j stores it with aim to authorize a legitimate user.

User registration.

U_i selects his identity ID_i, password PW_i and keys his biometrics BIO_i. Then, U_i generates a random number N_i, computes W₁ = h(PW_i∣∣N_i), W₂ = h(ID_i⊕N_i) and sends the registration message {ID_i, W₁, W₂} to RC via a secure channel.
RC computes A_i = h(ID_i∣∣x∣∣T_r), B_i = h(A_i), X_i = W_i⊕B_i, Y_i = h(PSK)⊕W₂ and Z_i = PSK⊕A_i, where T_r is the registration time. Then, RC issues the smart card SC_i to U_i which contains {X_i, Y_i, Z_i, h(⋅)} over a secure channel.
Upon receiving SC_i, U_i enters his personal biometric BIO_i at the sensor and computes N = N_i⊕H(BIO_i), V = h(ID_i∣∣N_i∣∣PW_i). Finally, U_i stores {X_i, Y_i, Z_i, N, V, h(⋅)} into SC_i.

Login and authentication

U_i inserts SC_i into the terminal and inputs his identity ID_i, password PW_i and imprints his biometrics BIO_i at the sensor.
SC_i computes N_i = N⊕h(BIO_i) and checks $h (I D_{i} ∣ ∣ N_{i} ∣ ∣ P W_{i}) \overset{?}{=} V$ . If it holds, SC_i continues to compute W₁ = h(PW_i∣∣N_i), W₂ = h(ID_i⊕N_i), B_i = X_i⊕W_i and h(PSK) = Y_i⊕W₂. Then, SC_i generates a random number n₁ and computes M₁ = h(PSK)⊕n₁, M₂ = ID_i⊕h(n₁∣∣B_i) and M₃ = h(ID_i∣∣n₁∣∣B_i). Finally, U_i sends {Z_i, M₁, M₂, M₃} to S_j.
When receiving the message from SC_i, S_j immediately computes A_i = Z_i⊕PSK, n₁ = M₁⊕h(PSK), ID_i = M₂⊕h(n₁∣∣h(A_i)) and checks whether $h (n_{1} ∣ ∣ B_{i} ∣ ∣ I D_{i}) \overset{?}{=} M_{3}$ . If it is equal, S_j generates a random number n₂ and computes SK_ji = h(ID_i∣∣SID_j∣∣B_i∣∣n₁∣∣n₂), M₄ = n₂⊕h(ID_i∣∣n₁), M₅ = h(SK_ji∣∣n₁∣∣n₂). Then, S_j sends {SID_j, M₄, M₅} to SC_i.
SC_i first computes n₂ = M₄⊕h(ID_i∣∣n₁), SK_ij = h(ID_i∣∣SID_j∣∣B_i∣∣n₁∣∣n₂) and then checks whether h(SK_ij∣∣n₁∣∣n₂) is consistent with M₅. If it is true, SC_i computes M₆ = h(SK_ij∣∣n₁∣∣n₂) and delivers it to S_j.
S_j verifies the verification condition $M_{6} \overset{?}{=} h (S K_{j i} ∣ ∣ n_{1} ∣ ∣ n_{2})$ . If this verification holds, S_j can now use the keys SK_ji to communicate with U_i securely.

Password updating

U_i inputs his ID_i, PW_i and imprints his biometrics BIO_i at the sensor. SC_i computes N_i = N⊕h(BIO_i) and checks $h (I D_{i} ∣ ∣ N_{i} ∣ ∣ P W_{i}) \overset{?}{=} V$ . If SC_i determines that they are equal, then U_i can key the new password $P W_{i}^{n e w}$ . Subsequently, SC_i computes $W_{1}^{n e w} = h (P W_{i}^{n e w} ∣ ∣ N_{i}), X_{i}^{n e w} = X_{i} \oplus W_{1} \oplus W_{1}^{n e w}, V_{i}^{n e w} = h (I D_{i} ∣ ∣ N_{i} ∣ ∣ P W_{i}^{n e w})$ and replaces X_i and V_i with $X_{i}^{n e w}$ and $V_{i}^{n e w}$ , respectively.

Security analysis of Mishra et al.’s scheme

This section presents a cryptanalysis of a recently scheme proposed by Mishra et al. We show their scheme does not satisfy the key security attribute such as vulnerability to replay attack and incorrect password change phase. We assume that a malicious adversary 𝓐 has totally supervised the communication channel in login and session key establishment phases. In other words, 𝓐 has the capacity to intercept, insert, delete, refresh or update any information delivered between U_i and S_j [6].

Not withstanding the replay attack

Suppose an adversary 𝓐 has intercepted a past login message {Z_i, M₁, M₂, M₃}. He is able to launch a replay attack and login to the server by resending the eavesdropped message {Z_i, M₁, M₂, M₃} to S_j. In other words, the adversary without running the “Login phase”, sends the eavesdropped message {Z_i, M₁, M₂, M₃} to S_j. In the “Login and authentication”, upon receiving the message {Z_i, M₁, M₂, M₃}, S_j computes A_i = Z_i⊕PSK, n₁ = M₁⊕h(PSK), ID_i = M₂⊕h(n₁∣∣h(A_i)), $M_{3}^{'} = h (n_{1} ∣ ∣ B_{i} ∣ ∣ I D_{i})$ and checks whether $M_{3}^{'}$ is equal to the received M₃ or not. Since M₃ and $M_{3}^{'}$ are equal, S_j will authenticate 𝓐 and 𝓐 will be able to login to S_j. Thus, 𝓐 can easily login to S_j by re-sending an old login message. Since S_j does not check the freshness of the received login message {Z_i, M₁, M₂, M₃} and authenticate U_i in (3) of the “Login and authentication”, S_j will not be able to discover replay attack.

Incorrect password change phase

The user U_i inserts his smart card into a card reader and enters his identity ID_i, password PW_i and imprints his personal biometric BIO_i at the sensor corresponding to his smart card. Then smart card computes N_i = N⊕h(BIO_i), $V_{i}^{'} = h (I D_{i} ∣ ∣ N_{i} ∣ ∣ P W_{i})$ and compares $V_{i}^{'}$ with the stored value of V in its memory to verify the legitimacy of U_i. Once the authenticity of cardholder is verified then U_i can instruct smart card to change his password. Afterwards, smart card asks the cardholder to resubmit a new password $P W_{i}^{n e w}$ , then X_i = B_i⊕h(PW_i∣∣N_i) and V = h(ID_i∣∣N_i∣∣PW_i) stored in the smart card can be updated with $X_{i}^{n e w} = X_{i} \oplus W_{1} \oplus W_{1}^{n e w}$ and $V_{i}^{n e w} = h (I D_{i} ∣ ∣ N_{i} ∣ ∣ P W_{i}^{n e w})$ , where $W_{1}^{n e w} = h (P W_{i}^{n e w} ∣ ∣ N_{i})$ . The $X_{i}^{n e w}$ value contains older password PW_i in h(PW_i∣∣N_i). Therefore, the modified $X_{i}^{n e w}$ is not correct.

The proposed scheme

In this section, we will present our robust biometrics based authentication scheme using smart cards for multi-sever environments. In our scheme, there are also three participants, the user U_i, the server S_j and the registration center RC. RC chooses the secret key PSK and a secret number x and shares them with S_j via a secure channel. We will describe all the phases relating to our scheme in the subsections, i.e. registration, login and authentication, and password update, where registration and login and authentication phases are shown in Fig 1.

Download:

Fig 1. Registration and authentication phases.

https://doi.org/10.1371/journal.pone.0126323.g001

Registration

U_i keys his biometrics BIO_i, identity ID_i and password PW_i. Then, U_i sends {ID_i, h(PW_i∣∣H(BIO_i))} to RC.
Upon receiving the message from U_i, RC computes X_i = h(ID_i∣∣x), V = h(ID_i∣∣h(PW_i∣∣H(BIO_i))). Then, RC stores {X_i, V_i, h(PSK)} into a smart card and submits them to U_i.
U_i computes Y_i = h(PSK)⊕y, and replaces h(PSK) with Y_i. Finally, the smart card stores the values of {X_i, Y_i, V_i, h(⋅)}.

Login and authentication

U_i inserts his smart card into device and enters his identity ID_i, password PW_i and biometrics BIO_i. Then, the smart card validates whether V_i = h(ID_i∣∣h(PW_i∣∣H(BIO_i))) is equal to the stored V. If it holds, the smart card generates a random number n₁ and computes K = h((y⊕Y_i)∣∣SID_j), M₁ = K⊕ID_i, M₂ = n₁⊕K, M₃ = h(PW_i∣∣H(BIO_i))⊕K, Z_i = h(B_i∣∣n₁∣∣h(PW_i∣∣H(BIO_i))∣∣T₁). Finally, U_i submits {Z_i, M₁, M₂, M₃, T₁} to S_j, where T₁ is the current timestamp.
Upon receiving the message from U_i, S_j first checks whether T_c−T₁ ≤ ΔT and then computes K = h(SID_j∣∣h(PSK)) by using a secure pre-shared key PSK. Then, S_j retrieves ID_i = M₁⊕K, n₁ = M₂⊕K, h(PW_i∣∣BIO_i) = M₃⊕K. Now, S_j computes X_i = h(ID_i∣∣x) and verifies whether $h (X_{i} ∣ ∣ n_{1} ∣ ∣ h (P W_{i} ∣ ∣ H (B I O_{i}))) \overset{?}{=} Z_{i}$ . If it holds, S_j generates a random number n₂ and computes SK_ji = h(n₁∣∣n₂∣∣K∣∣X_i), M₄ = n₂⊕h(n₁∣∣h(PW_i∣∣H(BIO_i))∣∣X_i), M₅ = h(ID_i∣∣n₁∣∣n₂∣∣K∣∣T₂). Then, S_j sends back authentication message {M₄, M₅, T₂} to U_i, where T₂ is the current timestamp.
After checking the freshness of T₂, U_i first computes n₂ = M₄⊕h(n₁∣∣h(PW_i∣∣H(BIO_i))∣∣X_i) and then verifies whether h(ID_i∣∣n₁∣∣n₂∣∣K) is equal to the received M₅. If they are equal, U_i computes the common session key SK_ij = h(n₁∣∣n₂∣∣K∣∣X_i) and sends {M₆ = h(SK_ij∣∣ID_i∣∣n₂∣∣T₃), T₃} to S_j, where T₃ is the current timestamp.
S_j verifies the freshness T₃ and the correctness of M₆ by using SK_ji. If they do not hold, S_j stops the execution; Otherwise, S_j confirms the common session key SK_ji with U_i.

Password updating

U_i first inputs his smart card into the device and provides his identity ID_i, password PW_i and biometrics BIO_i. Then, the smart card validates whether V_i = h(ID_i∣∣h(PW_i∣∣H(BIO_i))) is equal to the stored V_i. If they are not equal, the smart card refuses the request; Otherwise, U_i keys in the new password $P W_{i}^{n e w}$ . Finally, the smart card computes $V_{i}^{n e w} = h (I D_{i} ∣ ∣ h (P W_{i}^{n e w} ∣ ∣ H (B I O_{i})))$ and replaces V_i by $V_{i}^{n e w}$ .

Security analysis of the proposed scheme

In this section, we first adopt Burrows-Abadi-Needham (BAN)Logic [24] to demonstrate the completeness of the proposed scheme. Then, we conduct discussion and a cryptanalysis of the proposed scheme through both the informal and formal analyses.

Verifying the proposed scheme with BAN logic

BAN logic [24] is a set of rules for defining and analyzing information exchange schemes. It helps its users determine whether exchanged information is trustworthy, secured against eavesdropping, or both. It has been highly successful in analyzing the security of authentication schemes. First, we introduce some notations and logical postulates of BAN logic in Table 2.

BAN logical postulates
1. Message-meaning rule: $\frac{A ∣ \equiv A \overset{K}{\leftrightarrow} B, A ⊲ < X >_{K}}{A ∣ \equiv ∣ B \sim X}$ : if A believes that the key K is shared by A and B, and sees X encrypted with K, then A believes that B once said X.
2. Fresh conjuncatenation rule: $\frac{A ∣ \equiv # (X)}{A ∣ \equiv # (X, Y)}$ : if A believes freshness of X, then A believes freshness of the (X, Y).
3. Belief rule: $\frac{A ∣ \equiv X, A ∣ \equiv Y}{A ∣ \equiv (X, Y)}$ : if A believes X and Y, then A believes (X, Y).
4. Nonce-verification rule: $\frac{A ∣ \equiv # (X), A ∣ \equiv B ∣ \sim X}{A ∣ \equiv B ∣ \equiv X}$ : if A believes that X could have been uttered only recently and that B once said X, then A believes that B believes X.
5. Jurisdiction rule: $\frac{A ∣ \equiv B \Rightarrow X, A ∣ \equiv B ∣ \sim X}{A ∣ \equiv X}$ : if A believes that B has jurisdiction over X and A trusts B on the truth of X, then A believes X.
Establishment of security goals
$g_{1} . S_{j} ∣ \equiv U_{i} ∣ \equiv U_{i} \overset{S K_{i j}}{\leftrightarrow} S_{j}$
$g_{2} . S_{j} ∣ \equiv U_{i} \overset{S K_{i j}}{\leftrightarrow} S_{j}$
$g_{3} . U_{i} ∣ \equiv S_{j} ∣ \equiv U_{i} \overset{S K_{j i}}{\leftrightarrow} S_{j}$
$g_{4} . U_{i} ∣ \equiv U_{i} \overset{S K_{j i}}{\leftrightarrow} S_{j}$
Idealized scheme
$U_{i} : < n_{1}, I D_{i}, h (P W_{i} ‖ H (B I O_{i})) >_{K}, {(n_{1}, X_{i}, T_{1})}_{h (P W_{i} ‖ H (B I O_{i}))}, {(n_{2}, U_{i} \overset{S K_{i j}}{\leftrightarrow} S_{j}, T_{3})}_{I D_{i}}$
S_j: < n₁, X_i, h(PW_i∣∣H(BIO_i)) > n₂, (ID_i, n₁, n₂, T₂)_K
Initiative premises
p₁. U_i∣ ≡ #n₁ p₂. U_i∣ ≡ S_j ⇒ #n₂ p₃. S_j∣ ≡ #n₁ p₄. S_j∣ ≡ #n₂
$p_{5} . S_{j} ∣ \equiv U_{i} \overset{K}{\leftrightarrow} S_{j} p_{6} . U_{i} ∣ \equiv U_{i} \overset{K}{\leftrightarrow} S_{j}$
p₇. U_i∣ ≡ ID_i p₈. S_j∣ ≡ U_i ⇒ h(PW_i∣∣BIO_i)
p₉. S_j∣ ≡ U_i ⇒ ID_i p₁₀. U_i∣ ≡ S_j ⇒ X_i
p₁₁. $S_{j} ∣ \equiv U_{i} \Rightarrow U_{i} \overset{S K_{i j}}{\leftrightarrow} S_{j} p_{12}$ . $U_{i} ∣ \equiv S_{j} \Rightarrow U_{i} \overset{S K_{i j}}{\leftrightarrow} S_{j}$
Scheme analysis
a₁. By p₅ and S_j⊲ < n₁, ID_i, h(PW_i∣∣BIO_i) > K, we apply the message-meaning rule to derive: S_j∣ ≡ U_i∣ ∼ (n₁, ID_i, h(PW_i∣∣H(BIO_i)))
a₂. By a₁ and p₃, we apply the fresh conjuncatenation rule and the nonce-verification rule to derive: S_j∣ ≡ U_i∣ ≡ (n₁, ID_i, h(PW_i∣∣H(BIO_i)))
a₃. By a₂, p₃ and p₈, we apply the belief rule and the jurisdiction rule to derive: S_j∣ ≡ ID_i
a₄. By a₃ and $S_{j} ⊲ {(n_{2}, U_{i} \overset{S K_{i j},}{\leftrightarrow} S_{j}, T_{3})}_{I D_{i}}$ , we apply the message-meaning rule to derive: $S_{j} ∣ \equiv U_{i} ∣ \sim (n_{2}, U_{i} \overset{S K_{i j}}{\leftrightarrow} S_{j}, T_{3})$
a₅. By p₄ and a₄, we apply the fresh conjuncatennation rule and the nonce-verification rule to derive: $S_{j} ∣ \equiv U_{i} ∣ \equiv (n_{2}, U_{i} \overset{S K_{i j}}{\leftrightarrow} S_{j}, T_{3})$
g₁. By a₅, we apply the belief rule to derive: $S_{j} ∣ \equiv U_{i} ∣ \equiv U_{i} \overset{S K_{i j}}{\leftrightarrow} S_{j}$
g₂. By g₁ and p₁₁, we apply the jurisdiction rule to derive: $S_{j} ∣ \equiv U_{i} \overset{S K_{i j}}{\leftrightarrow} S_{j}$
a₆. By p₆ and U_i⊲(ID_i, n₁, n₂, T₂)_K, we apply the message-meaning rule to derive: U_i∣ ≡ S_j∣ ∼ (ID_i, n₁, n₂, T₂)
a₇. By p₂ and a₉, we apply the fresh conjuncatenation rule and the nonce-verification rule to derive: U_i∣ ≡ S_j∣ ≡ (ID_i, n₁, n₂, T₂)
a₈. By a₇, we apply the belief rule to derive: U_i∣ ≡ S_j∣ ≡ n₂
a₉. By p₂ and a₈, we apply the jurisdiction rule to derive: U_i∣ ≡ n₂
a₁₀. By a₉ and U_i⊲ < n₁, X_i, h(PW_i∣∣BIO_i) > n₂, we apply the message-meaning rule to derive: U_i∣ ≡ S_j∣ ∼ (n₁, X_i, h(PW_i∣∣BIO_i))
a₁₁. By a₁₀ and p₁, we apply the fresh conjuncatennation rule and the nonce-verification rule to derive: U_i∣ ≡ S_j∣ ≡ (n₁, X_i, h(PW_i∣∣BIO_i))
g₃. By p₁, p₃, p₄, p₆, a₁₁ and SK_ji = h(n₁∣∣n₂∣∣K∣∣X_i), we apply the fresh conjuncatennation rule and the nonce-verification rule to derive: $U_{i} ∣ \equiv S_{j} ∣ \equiv U_{i} \overset{S K_{j i}}{\leftrightarrow} S_{j}$
g₄. By g₃ and p₁₂, we apply the jurisdiction rule to derive: $U_{i} ∣ \equiv U_{i} \overset{S K_{j i}}{\leftrightarrow} S_{j}$

Download:

Table 2. BAN logic notations.

https://doi.org/10.1371/journal.pone.0126323.t002

Informal security analysis

This subsection verifies whether the proposed scheme is secure against various kinds of known attacks. We assume that a malicious adversary 𝓐 has totally supervised the communication channel in login and session key establishment phases. In other words, 𝓐 has the capacity to intercept, insert, delete, refresh or update any information delivered between U_i and S_j [6].

Anonymity.

U_i’s identity ID_i is well protected by the shared secret parameter K as a substitute for real ones, 𝓐 can not get users’ real identities. In addition, the unauthorized server cannot get ID_i without knowing K since K is protected by the secret key PSK only known by the authorized server and is not exposed in the open channel. Thus, our scheme provides user anonymity, which can prevent the leakage of private user identities to malicious attackers.

Mutual authentication.

In order to authenticate U_i, S_j has to verify validity of the evidence Z_i = h(X_i∣∣n₁∣∣h(PW_i∣∣H(BIO_i))). The evidence is computed with the common secret parameter K only known U_i and S_j. In other words, (n₁, ID_i, h(PW_i∣∣H(BIO_i))) are derived from the valid login message {Z_i, M₁, M₂, M₃, T₁} through K, no one can counterfeit the evidence. In addition, to compute X_i, secret key x is needed but only known by S_j. Moreover, checking h(SK_ij∣∣ID_i∣∣n₂) to further assist S_j in authenticating U_i because the session key is only known by U_i and S_j. To authenticate S_j, U_i needs to verify whether $M_{5} \overset{?}{=} h (I D_{i} ∣ ∣ n_{1} ∣ ∣ n_{2} ∣ ∣ K)$ . Because ID_i and K are only known by U_i and S_j, no one can forge a valid {M₄, M₅, T₂} without them. Hence, mutual authentication between U_i and S_j is achieved.

Resist stolen smart card attack.

Even if 𝓐 has gathered [25] the information {X_i, Y_i, V_i, h(⋅)} stored in the smart card, 𝓐 cannot figure out the login request message {Z_i, M₁, M₂, M₃, T₁} without the secret key y. Moreover, 𝓐 cannot get the identity ID_i and PW_i since they are protected by hash functions with the U_i’s biometrics BIO_i. Hence, 𝓐 still cannot succeed if he steals the smart card.

Session key agreement.

We provide the session key SK = h(n₁∣∣n₂∣∣K∣∣X_i) to protect the message communication between U_i and S_j, where (n₁, n₂, K, X_i) are known to anybody but U_i and S_j. In addition, SK is different in each session, 𝓐 has obtained a known session key cannot be used to calculate the value of the next session key.

Resist replay attack.

Assume 𝓐 has intercepted all the communication message {Z_i, M₁, M₂, M₃, T₁, M₄, M₅, T₂, M₆, T₃,} and tried to replay them to U_i or S_j to obtain authentication. However, it is impossible to come true since all the authenticated messages imply the timesstamp which is also exposed in public channel. If 𝓐 resends the transmitted messages, the receiver will immediately detect the attack through the authenticated message. Hence, our scheme can withstand replay attack.

Resist stolen verifier and insider attacks.

In the registration phase, RC does not directly get the U_i’s password PW_i and biometrics information BIO_i. Hence, 𝓐 performs a stolen verifier attack or insider attack will be hard.

Resist off-line guessing attack.

In our proposed scheme, trying to launch an off-line passsword guessing attack with the information stored in the smart card and the eavesdropped messages is trying to solve the input from the given hash value. Since the identity ID_i and the random number N_i are required with the purposed of knowing PW_i, both the secrets are protected by the hash function and known by the user himself.

Formal security analysis of the proposed scheme

This subsection presents the formal security analysis of our scheme and shows that it is secure. For this, we first define the following hash function [26].

Definition 1. A secure one-way hash function h:{0, 1}* → {0, 1}ⁿ, which takes an input as an arbitrary length binary string x ∈ {0,1}* and outputs a binary string h(x) ∈ {0,1}ⁿ and satisfies the following requirements: a. Given y ∈ Y, it is computationally infeasible to find an x ∈ X such that y = h(x); b. Given x ∈ X, it is computationally infeasible to find another x′ ≠ x ∈ X, such that h(x′) = h(x); c. It is computationally infeasible to find a pair (x′, x) ∈ X′ × X, with x′ ≠ x, such that h(x′) = h(x).

Theorem 1. Under the assumption that the one-way hash function h(⋅) closely behaves like an oracle, then our scheme is provably secure against an attacker 𝓐 for protecting user’s personal information including identity ID_i, password PW_i and biometrics BIO_i, sever’s private key x and PSK.

Proof. The formal security proof of our scheme is similar to that as in [27–28]. Using the following oracle to construct 𝓐 who will have the ability to derive the user’s ID_i, password PW_i, biometrics BIO_i, sever’s private key x and PSK.

Reveal: This random oracle will unconditionally output the input x from the given hash value y = h(x).

𝓐 runs the experimental algorithm showed in Table 3, $E X P_{H A S H, 𝓐}^{B A K A S S C M S E}$ for our biometrics based authentication and key agreement scheme using smart cards for multi-server environments, say BAKASSCMSE.

Download:

Table 3. Algorithm

.

https://doi.org/10.1371/journal.pone.0126323.t003

Define the success probability for $E X P_{H A S H, 𝓐}^{B A K A S S C M S E}$ is $S u c c_{H A S H, 𝓐}^{B A K A S S C M S E} = ∣ P r [E X P_{H A S H, 𝓐}^{B A K A S S C M S E} = 1] - 1 ∣$ and the advantage function for this experiment then becomes $A d v_{H A S H, 𝓐}^{B A K A S S C M S E} (t, q_{R}) = m a x_{𝓐} \ S u c c_{H A S H, 𝓐}^{B A K A S S C M S E}$ , where the maximum is taken over all 𝓐 with execution time t and the number of queries q_R made to the Reveal oracle. Consider the experiment showed in Table 3 for 𝓐. If 𝓐 has the ability to solve the hash function problem provided in Definition 1, then he can directly derive U_i’s identity ID_i, password PW_i, biometrics BIO_i, and S_j’s private key x and PSK. In this case, 𝓐 will discover the complete connections between U_i and S_j. However, it is a computationally infeasible problem to invert the input from a given hash value, i.e., $A d v_{H A S H, 𝓐}^{B A K A S S C M S E} (t) \leq ϵ$ , ∀ϵ > 0. Hence, we have $A d v_{H A S H, 𝓐}^{B A K A S S C M S E} (t, q_{R}) \leq ϵ$ , since $A d v_{H A S H, 𝓐}^{B A K A S S C M S E} (t, q_{R})$ depends on $A d v_{H A S H, 𝓐}^{B A K A S S C M S E} (t)$ . As a result, there is no way for 𝓐 to discover the complete connections between U_i and S_j and our scheme is provably secure against an adversary for deriving (ID_i, PW_i, BIO_i, x, PSK).

Performance and functionality analysis

In this section, we compare our scheme with other existing multi-server authenticated schemes ([18–20], [22–23]) regarding security and performance. Table 4 lists the functionality comparisons of our proposed scheme with other related schemes. It can be seen that the proposed scheme achieves all security and functionality requirements and is more secure than other related schemes.

Download:

Table 4. Functionality comparison.

https://doi.org/10.1371/journal.pone.0126323.t004

For performance analysis, we compare the computational primitives involved in login and authentication phases of our scheme and other related schemes. To analyze the computational complexity of the schemes, we use hashing operation as the time complexity since XOR operations require very little computations. Fig 2 shows comparison regarding the performance. From this comparison, we can see that our proposed scheme has better efficiency in comparison with other schemes.

Download:

Fig 2. Performance comparison.

https://doi.org/10.1371/journal.pone.0126323.g002

Conclusion and future work

In this paper, we presented a cryptanalysis of a recently proposed Mishra et al.’scheme and showed that their scheme was susceptible to replay attack while failed to provide an efficient password change phase. An improved scheme is proposed that inherits the merits of Mishra et al.’s scheme and resists different possible attacks. The proposed scheme is practical and efficient compared with other related schemes. Comprehensive security analysis proves that the robustness of our scheme is more secure than other related schemes. Among the open problems to be faced in the near future we can mention the study of specific applications and practical limitations of our scheme for mutual authentication using smart cards based on biometrics and their large-scale implementation in real multi-sever environments.

Author Contributions

Conceived and designed the experiments: YRL LXL XY YXY. Performed the experiments: YRL LXL XY YXY. Analyzed the data: YRL LXL XY YXY. Contributed reagents/materials/analysis tools: YRL LXL XY YXY. Wrote the paper: YRL LXL XY YXY.

References

1. Liu C, Du WB, Wang WX. Particle Swarm Optimization with Scale-Free Interactions. PLoS One 9(5). 2014.
- View Article
- Google Scholar
2. Du WB, Wu ZX, Cai KQ. Effective usage of shortest paths promotes transportation efficiency on scale-free networks. Physica A. 2013; 392(17): 3505–3512.
- View Article
- Google Scholar
3. Wang Z, Perc M. Aspiring to the fittest and promotion of cooperation in the prisoner’s dilemma game. Physical Review E. 2010; 82(2), 021115.
- View Article
- Google Scholar
4. Boccaletti S, Bianconi G, Criado R, del Genio CI, Gómez-Gardeñes J, Romance M, et al. The structure and dynamics of multilayer networks. Physics Reports. 2014; 544(1): 1–122.
- View Article
- Google Scholar
5. Zhao DW, Peng HP, Li LX, Yang YX, Li SD. An efficient patch dissemination strategy for mobile networks. Mathematical Problems in Engineering. 2013; Article ID 896187, 13 pages., 2013.
6. Lamport L. Password authentication with insecure communication. ACM Communication. 1981; 24(11): 770–772.
- View Article
- Google Scholar
7. Sun DZ, Huai JP, Sun JZ, Li JX, Zhang JW, Feng ZY. Improvements of Juang’s password authenticated key agreement scheme using smart cards. IEEE Transactions on Industrial Electronics. 2009; 56(6): 2284–2291.
- View Article
- Google Scholar
8. Lu RX, Lin XD, Liang XH, Shen XM A dynamic privacy-preserving key management scheme for location-based services in vanets. IEEE Transactions on Intelligent Transportation Systems. 2012; 13(1): 127–139.
- View Article
- Google Scholar
9. Zhao DW, Peng HP, Li LX, Yang YX. A secure and effective anonymous authentication scheme for roaming service in global mobility networks. Wireless Personal Communications. 2013; 78: 247–269.
- View Article
- Google Scholar
10. Lu, YR, Li, LX, Yang, YX. Robust and efficient authentication scheme for session initiation protocol. Mathematical Problems in Engineering. 2015; 2015, Article ID 894549, 9 pages.
11. Lu YR, Li LX, Peng HP, Yang YX. An enhanced biometric-based authentication scheme for telecare medicine information systems using elliptic curve cryptosystem. Journal of Medical Systems. 2015; 39(3): 1–8.
- View Article
- Google Scholar
12. Lu YR, Li LX, Peng HP, Yang YX. Robust and efficient biometrics based password authentication scheme for telecare medicine information systems using extended chaotic maps. Journal of Medical Systems. 2015.
- View Article
- Google Scholar
13. Lu, YR, Li, LX, Peng, HP, Yang, YX. A biometrics and smart cards based authentication scheme for multi-server environments. Security and Communication Networks. 2015;
14. Tsai JL. Efficient multi-server authentication scheme based on one-way hash function without verification table. Computers & Security. 2008; 27(3–4): 115–121.
- View Article
- Google Scholar
15. Lu RX, Lin XD, Zhu HJ, Liang XH, Shen XM. BECAN: a bandwidth-efficient cooperative authentication scheme for filtering injected false data in wireless sensor networks. IEEE Transactions on Parallel and Distributed Systems. 2012; 23(1): 32–43.
- View Article
- Google Scholar
16. Liao YP, Wang SS. A secure dynamic ID based remote user authentication scheme for multi-server environment. Computer Standards & Interfaces. 2009; 31(1): 24–29.
- View Article
- Google Scholar
17. Lee CC, Lin TH, Chang RX. A secure dynamic ID based remote user authentication scheme for multi-server environment using smart cards. Expert Systems with Applications. 2011; 38(11): 13863–13870
- View Article
- Google Scholar
18. Li X, Ma J, Wang WD, Liu CL. A novel smart card and dynamic ID based remote user authentication scheme for multi-server environments. Mathematical and Computer Modelling. 2013; 58: 85–95.
- View Article
- Google Scholar
19. Xue KP, Hong PL, Ma CS. A lightweight dynamic pseudonym identity based authentication and key agreement protocol without verification tables for multi-server architecture. Journal of Computer and System Sciences. 2014; 80: 195–206.
- View Article
- Google Scholar
20. Lu YR, Li LX, Peng HP, Yang X, Yang YX. A lightweight ID based authentication and key agreement protocol for multi-server architecture. International Journal of Distributed Sensor Network. 2015, Article ID 635890, 9 pages.
- View Article
- Google Scholar
21. Li CT, Hwang MS. An efficient biometrics-based remote user authentication scheme using smart cards. Journal of Network and Computer Applications. 2010; 33(1): 1–5.
- View Article
- Google Scholar
22. Chuang MC, Chen MC. An anonymous multi-server authenticated key agreement scheme based on trust computing using smart cards and biometrics. Expert Systems with Applications. 2014; 41: 1411–1418.
- View Article
- Google Scholar
23. Mishra D, Das AK, Mukhopadhyay S. A secure user anonymity-preserving biometric-based multi-server authenticated key agreement scheme using smart cards. Expert Systems with Applications. 2014; 41(18): 8129–8143.
- View Article
- Google Scholar
24. Burrow M, Abadi M, Needham R. A logic of authentication, ACM Transactions on Computer System. 1990; 8(1): 18–36.
- View Article
- Google Scholar
25. Messerges TS, Dabbish EA, Sloan RH. Examining smart-card security under the threat of power analysis attacks. IEEE Transactions on Computers. 2002; 51(5): 541–552.
- View Article
- Google Scholar
26. Stallings W. Cryptography and Network Security: Principles and Practices, third ed. Prentice Hall. 2003.
27. Das AK. A secure and effective user authentication and privacy preserving protocol with smart cards for wireless communications. Networking Science. 2013; 2(1–2): 12–27.
- View Article
- Google Scholar
28. Das AK, Paul NR, Tripathy L. Cryptanalysis and improvement of an access control in user hierarchy based on elliptic curve cryptosystem. Information Sciences. 2012; 209: 80–92.
- View Article
- Google Scholar

[ref1] 1. Liu C, Du WB, Wang WX. Particle Swarm Optimization with Scale-Free Interactions. PLoS One 9(5). 2014.
View Article
Google Scholar

[2] View Article

[3] Google Scholar

[ref2] 2. Du WB, Wu ZX, Cai KQ. Effective usage of shortest paths promotes transportation efficiency on scale-free networks. Physica A. 2013; 392(17): 3505–3512.
View Article
Google Scholar

[5] View Article

[6] Google Scholar

[ref3] 3. Wang Z, Perc M. Aspiring to the fittest and promotion of cooperation in the prisoner’s dilemma game. Physical Review E. 2010; 82(2), 021115.
View Article
Google Scholar

[8] View Article

[9] Google Scholar

[ref4] 4. Boccaletti S, Bianconi G, Criado R, del Genio CI, Gómez-Gardeñes J, Romance M, et al. The structure and dynamics of multilayer networks. Physics Reports. 2014; 544(1): 1–122.
View Article
Google Scholar

[11] View Article

[12] Google Scholar

[ref5] 5. Zhao DW, Peng HP, Li LX, Yang YX, Li SD. An efficient patch dissemination strategy for mobile networks. Mathematical Problems in Engineering. 2013; Article ID 896187, 13 pages., 2013.

[ref6] 6. Lamport L. Password authentication with insecure communication. ACM Communication. 1981; 24(11): 770–772.
View Article
Google Scholar

[15] View Article

[16] Google Scholar

[ref7] 7. Sun DZ, Huai JP, Sun JZ, Li JX, Zhang JW, Feng ZY. Improvements of Juang’s password authenticated key agreement scheme using smart cards. IEEE Transactions on Industrial Electronics. 2009; 56(6): 2284–2291.
View Article
Google Scholar

[18] View Article

[19] Google Scholar

[ref8] 8. Lu RX, Lin XD, Liang XH, Shen XM A dynamic privacy-preserving key management scheme for location-based services in vanets. IEEE Transactions on Intelligent Transportation Systems. 2012; 13(1): 127–139.
View Article
Google Scholar

[21] View Article

[22] Google Scholar

[ref9] 9. Zhao DW, Peng HP, Li LX, Yang YX. A secure and effective anonymous authentication scheme for roaming service in global mobility networks. Wireless Personal Communications. 2013; 78: 247–269.
View Article
Google Scholar

[24] View Article

[25] Google Scholar

[ref10] 10. Lu, YR, Li, LX, Yang, YX. Robust and efficient authentication scheme for session initiation protocol. Mathematical Problems in Engineering. 2015; 2015, Article ID 894549, 9 pages.

[ref11] 11. Lu YR, Li LX, Peng HP, Yang YX. An enhanced biometric-based authentication scheme for telecare medicine information systems using elliptic curve cryptosystem. Journal of Medical Systems. 2015; 39(3): 1–8.
View Article
Google Scholar

[28] View Article

[29] Google Scholar

[ref12] 12. Lu YR, Li LX, Peng HP, Yang YX. Robust and efficient biometrics based password authentication scheme for telecare medicine information systems using extended chaotic maps. Journal of Medical Systems. 2015.
View Article
Google Scholar

[31] View Article

[32] Google Scholar

[ref13] 13. Lu, YR, Li, LX, Peng, HP, Yang, YX. A biometrics and smart cards based authentication scheme for multi-server environments. Security and Communication Networks. 2015;

[ref14] 14. Tsai JL. Efficient multi-server authentication scheme based on one-way hash function without verification table. Computers & Security. 2008; 27(3–4): 115–121.
View Article
Google Scholar

[35] View Article

[36] Google Scholar

[ref15] 15. Lu RX, Lin XD, Zhu HJ, Liang XH, Shen XM. BECAN: a bandwidth-efficient cooperative authentication scheme for filtering injected false data in wireless sensor networks. IEEE Transactions on Parallel and Distributed Systems. 2012; 23(1): 32–43.
View Article
Google Scholar

[38] View Article

[39] Google Scholar

[ref16] 16. Liao YP, Wang SS. A secure dynamic ID based remote user authentication scheme for multi-server environment. Computer Standards & Interfaces. 2009; 31(1): 24–29.
View Article
Google Scholar

[41] View Article

[42] Google Scholar

[ref17] 17. Lee CC, Lin TH, Chang RX. A secure dynamic ID based remote user authentication scheme for multi-server environment using smart cards. Expert Systems with Applications. 2011; 38(11): 13863–13870
View Article
Google Scholar

[44] View Article

[45] Google Scholar

[ref18] 18. Li X, Ma J, Wang WD, Liu CL. A novel smart card and dynamic ID based remote user authentication scheme for multi-server environments. Mathematical and Computer Modelling. 2013; 58: 85–95.
View Article
Google Scholar

[47] View Article

[48] Google Scholar

[ref19] 19. Xue KP, Hong PL, Ma CS. A lightweight dynamic pseudonym identity based authentication and key agreement protocol without verification tables for multi-server architecture. Journal of Computer and System Sciences. 2014; 80: 195–206.
View Article
Google Scholar

[50] View Article

[51] Google Scholar

[ref20] 20. Lu YR, Li LX, Peng HP, Yang X, Yang YX. A lightweight ID based authentication and key agreement protocol for multi-server architecture. International Journal of Distributed Sensor Network. 2015, Article ID 635890, 9 pages.
View Article
Google Scholar

[53] View Article

[54] Google Scholar

[ref21] 21. Li CT, Hwang MS. An efficient biometrics-based remote user authentication scheme using smart cards. Journal of Network and Computer Applications. 2010; 33(1): 1–5.
View Article
Google Scholar

[56] View Article

[57] Google Scholar

[ref22] 22. Chuang MC, Chen MC. An anonymous multi-server authenticated key agreement scheme based on trust computing using smart cards and biometrics. Expert Systems with Applications. 2014; 41: 1411–1418.
View Article
Google Scholar

[59] View Article

[60] Google Scholar

[ref23] 23. Mishra D, Das AK, Mukhopadhyay S. A secure user anonymity-preserving biometric-based multi-server authenticated key agreement scheme using smart cards. Expert Systems with Applications. 2014; 41(18): 8129–8143.
View Article
Google Scholar

[62] View Article

[63] Google Scholar

[ref24] 24. Burrow M, Abadi M, Needham R. A logic of authentication, ACM Transactions on Computer System. 1990; 8(1): 18–36.
View Article
Google Scholar

[65] View Article

[66] Google Scholar

[ref25] 25. Messerges TS, Dabbish EA, Sloan RH. Examining smart-card security under the threat of power analysis attacks. IEEE Transactions on Computers. 2002; 51(5): 541–552.
View Article
Google Scholar

[68] View Article

[69] Google Scholar

[ref26] 26. Stallings W. Cryptography and Network Security: Principles and Practices, third ed. Prentice Hall. 2003.

[ref27] 27. Das AK. A secure and effective user authentication and privacy preserving protocol with smart cards for wireless communications. Networking Science. 2013; 2(1–2): 12–27.
View Article
Google Scholar

[72] View Article

[73] Google Scholar

[ref28] 28. Das AK, Paul NR, Tripathy L. Cryptanalysis and improvement of an access control in user hierarchy based on elliptic curve cryptosystem. Information Sciences. 2012; 209: 80–92.
View Article
Google Scholar

[75] View Article

[76] Google Scholar

Figures

Abstract

Introduction

Review of Mishra et al.’s scheme

Registration

Server registration.

User registration.

Login and authentication

Password updating

Security analysis of Mishra et al.’s scheme

Not withstanding the replay attack

Incorrect password change phase

The proposed scheme

Registration

Login and authentication

Password updating

Security analysis of the proposed scheme

Verifying the proposed scheme with BAN logic

Informal security analysis

Anonymity.

Mutual authentication.

Resist stolen smart card attack.

Session key agreement.

Resist replay attack.

Resist stolen verifier and insider attacks.

Resist off-line guessing attack.

Formal security analysis of the proposed scheme

Performance and functionality analysis

Conclusion and future work

Author Contributions

References