Mitigating the desynchronisation attack in multiserver environment

IET CommunicationsVolume 14, Issue 13 p. 2210-2221 Research ArticleFree Access Mitigating the desynchronisation attack in multiserver environment Saeed Ullah Jan, Corresponding Author Saeed Ullah Jan saeedullah@uom.edu.pk orcid.org/0000-0003-1268-0325 Department of Computer Science & IT, University of Malakand, Chakdara, PakistanSearch for more papers by this authorFawad Qayum, Fawad Qayum Department of Computer Science & IT, University of Malakand, Chakdara, PakistanSearch for more papers by this author Saeed Ullah Jan, Corresponding Author Saeed Ullah Jan saeedullah@uom.edu.pk orcid.org/0000-0003-1268-0325 Department of Computer Science & IT, University of Malakand, Chakdara, PakistanSearch for more papers by this authorFawad Qayum, Fawad Qayum Department of Computer Science & IT, University of Malakand, Chakdara, PakistanSearch for more papers by this author First published: 01 August 2020 https://doi.org/10.1049/iet-com.2019.1069Citations: 1AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract Currently, every user outsources a huge amount of shared secrets remotely from different servers and utilises synchrony resources. To make all types of operations secure for the end-user, synchronous storage is vital and asynchronous storage might lead to the unavailability of successful services. Hence, a robust authentication scheme is mandatory for such purpose which not only confirms the synchrony of the distributed shared resources but also secure access to shared secrets. So far no one has offered an accurate and flawless secure mechanism despite serious attempts. For this purpose, the authors have designed an improved and robust authentication protocol to ensure the security, integrity, and confidentiality of information and synchrony of shared secrets up to a maximum level. The security of the proposed dynamic mechanism has been verified both formally using random Oracle model and verification toolkit ProVerif2.00 and informally using assumptions and theorems. A delicate balance between security and performance has been shown in the performance analysis section of the study. Nomenclature PWia user's password IDia user's identity Bia user's biometric G1 group of prime numbers q h(.) one way hash function P number generated from G1 || concatenation function s secrete integer number (private key) ⊕ XOR-operation SIDja registered server's identity 1 Introduction An environment where a single user avails the services of many servers without any flaw is termed as a multiserver environment. By using such an environment, the owner or web-hosting organisation constructs a resourceful environment by sharing all or some associated peripherals between two or many servers. Owing to this, the website load time becomes minimised but if in a single server environment (conventional access), the downtime reduces which in turn creates many hurdles for the end-user. The information technology (IT) infrastructure for supporting such an environment needs a robust security mechanism for the protection of shared resources and memory. As time passes, more servers are added for a single application, and the memory for such types of servers might create ambiguity for the end-user. To a greater extent, the authentication protocol establishes a joint connection with application software and associated peripherals to help users work securely by accessing multiple servers. However, the threat to security of sensitive information can't be ignored. It is of special concern for the technology developers since privacy needs to be kept intact [1]. In an information browsing environment, this aspect shall be more secure, proficient, and effective to avoid errors and unwanted access. Since, without observing the integrity of the input, security and privacy cannot be preserved. A single protocol mechanism cannot fulfil the desired requirements even if there is a level of authenticity. For this purpose, different mechanisms were designed to tackle the security laps. Besides this, other innovative techniques were also used to enhance the security of shared sensitive information for better performance. The present study is an attempt to bridge the gap and will be a helpful addition [2]. 1.1 Equality testing techniques The process of authentication is the preliminary operation in availing a multiserver advantage. In this regard, the random numbers exchanged among peers can be tested at both ends of a communicating party. Nevertheless, a myriad of techniques has been offered by different researchers in the literature. In the contemporary technological era, two of these methods are presented below: Method 1: Let us suppose SENDER 'a' (Alice) uses key for encryption and the RECEIVER 'b' (Bob) uses for decryption, then the working of these keys is shown in Fig. 1. Mike et al. [3] demonstrated that the technique presented in Fig. 1 is a two-party equality testing technique that is not secure and can easily be compromised. So, to overcome the major shortcoming, another method was recommended in which both parties (Alice a and Bob b) keep keys in a third-place. Recognising the keys, the third party should be acceptable to both of them. ElGamal [4] showed that by applying a computational Diffie–Hellman (CDH), secure hash algorithm-2 (SHA-2), and message disgist5 (MD5) methodologies, a better result can be achieved as discussed in Method 2. Method 2: In this method, a prime number p, a group of integers Zp*, g is a small group generated from Zp*, and y is a public key extracted also from Zp*. Another number called x can be eradicated from Zp* called the private key. Then using y = gx mod p for testing random numbers at both ends using an open network channel is shown in Fig. 2. Fig. 1Open in figure viewerPowerPoint Simple key exchange method Fig. 2Open in figure viewerPowerPoint Secure key exchange technique 1.2 System model A multiserver environment is the most important and dominant architecture for a remote user. This setting needs to be valuable and impressive for shared join peripherals and memory and all types of operations essential for the communication of confidential information. This architecture consists of three participants, the user, the registration centre (RC), and the server. In these three participants, the RC acts as a trusted third party that can direct all the associated servers to the remote users. The system that provides services to the end-user called server responsible for the overall management, supervision, monitoring, and controlling of information exchange in a secure manner for which a remote user demanded. For mutual authentication using a conventional system, a single user each time registered with each server individually by remembering his/her login credentials which are a time consuming and difficult job. While in the proposed system model, the servers first register with the RC and then the remote user availing the services from the registered servers as shown in Fig. 3. It is worth mentioning that formally the RC is a fully trusted entity. Its trust must be consistent since the trust deficit may detract reliability over the system. The proposed scheme is a guarantee that both user and remote servers could be fully trusted on RC, while remote centre alone may not be so complete. Fig. 3Open in figure viewerPowerPoint Registration phase 1.3 Threat model The idea of a threat model or adversarial model was first presented by [5] called the Dolev–Yao threat model. According to this model, when two parties communicated with each other, an adversary has full authority over the public network channel for initiating any type of attack. He/She can snoop, update, alter, or delete the internal secrets from the channel. Also, he/she can resend false information and might replay an old message using some other rules. These powers gained by him/her due to continuously monitoring the different sessions between two parties for a single user. As a result, he/she can forge the confidential information of a user. Moreover, in this study, the threat/adversarial model encompasses all possible presumptions, such as He/She has the freedom to refurbish, reshape, revise, or recap the actual message over the public network channel for a legitimate user. He/She can also extort the hidden personal sensitive credentials from the user's smart card (SC). He/she can be malignant intruders of the same system. He/she can cipher the identity by repeatedly supervise the different sessions for a single user. 1.4 Main contribution and motivation After an extensive study of the existing literature for the already designed authentication schemes, it motivates us to present a strong, serviceable, and dynamic protocol for a remote user in the multiserver environment over public network channels. Accordingly, the aims and objectives of such efforts are to construct an authentication scheme that resists all known attacks and shows a delightful balance between security and performance. The main contributions of the study are as follows: After the cryptanalysis of Park et al. protocol and proved that it has many drawbacks. The effort in this study presents a new mutual authentication and key agreement mechanism for the multiserver environment with privacy-preserving. During authentication of a legitimate user, the identity is secure and unknown to all servers except the RC, which provides unconditional anonymity. The shared memory which contains secrets and all the associated resources is much safe from any intruder which means we have preserved its synchrony. The shared secret key is computed without interacting with client/server which minimises computation and communication costs. We formally analysed the security of the proposed work using random Oracle model (ROM) and automated verification toolkit ProVerif2.00 for verifying that the effort resists all known attacks. Finally, we have evaluated that the performance of the proposed scheme is sophisticated compared with other protocols. Also, due to the usage of bilinear pairing (secret key escrowing properties) for key construction in the RC can intensify computation cost efficacy. 2 Related work The remote maintenance of integrity, confidentiality, and authentication of shared secrets is a pivotal task from the context of both security and performance. As these features are negating each other, the change in one conversely prevails the other. However, by endorsing an exclusive cryptographic technique, one can calmly balance it. Consequently, Mishra et al. [6] proposed a user anonymous SC and password-based authentication scheme that caters the computation complexity and communication cost and said that their scheme intransigence to known attacks notably spotting in Jiang et al. [7] scheme such as anonymity concern, insider attack, online/offline password prediction, and impersonation attack. They also claim that their scheme fulfilled all the known security attributes and appropriate for the real-world environment compared to other schemes. After the cryptanalysis of Wang [8] scheme, credentials leakage, user anonymity, offline password guessing, and stolen verifier attacks have been identified by Odelu et al. [9]. Also, they proposed a privacy-preserving elliptic-curve cryptographic (ECC)-based key agreement protocol that offered anonymity, untraceability of the user and resisted all known flaws of the scheme [8]. They also used advanced encryption standard (AES-128) and symmetric key encryption to make it secured against plain text attack. Lu et al. [10] proposed a scheme, which is a biometric-based authentication scheme, designed using the principles of ECC and advised that their scheme is secured against several threats. However, Goutham et al. [11], after the extensive investigation for each parameter, reached a goal that [10] is unattainable to provide bilateral intervention, mutual authentication, cross-verification, anonymity, and undergo through man-in-the-middle attack and has clock synchronisation problem. Accordingly, they proposed an improved three-factor authentication scheme for the multi-server environment to overcome all the defects pointed out in [10]. They proved the efficiency and robustness of the scheme using a software programming toolkit Security Protocol Animator + AVISPA and BAN logic of authentication and informally using assumptions and discussions too. Moreover, Das and Goswami [12] also presented a three-factor authentication protocol using SC for achieving adequate security and exceptional performance. They affirm that no one can forge the biometric-based key and hard for an adversary to reckon and scatter over a public network channel. Similarly, the biometric of an individual cannot be broken or traverse over others. Actually, Das and Goswami [12] revealed three major security defects in An's scheme [13]. The biometric verification tactics of [13] have not been properly tackled, the password verification operation is much penniless, and cannot resist insider attack. As we know that in the non-cognitive hashing method there is a chance for two extracted biometrics of a single person to have the same hash values and vice versa. So, Das and Goswami [12] used a fuzzy extractor practice for such a purpose, which has the potential of efficient biometric verification. So far, biometric-based remote user authentication schemes have gained much attention from the researchers because of their uniqueness, particularly for a multi-server environment. In this regard, Das [14] recommended another scheme that was consistent and suitable for a multiserver setting. His scheme does not need a database table in the server for password verification and has the capability for updating user's password freely and securely with a minimum computational workload. After identifying loopholes in Li et al. [15] scheme by Change et al. [16] and proved that their scheme was failed for mutual authentication, key agreement, and the user lacking right to update his/her password freely. Chang et al. suggested a scheme based on ElGamal public key infrastructure that consists of encryption and decryption functions. The key generation algorithm was public in their scheme and the private keys generated from two multiplicative groups. They used Epk = (x;r) = (y1, y2) = (gr mod p, x, Yr mod p) as encryption function and Dsk(y1, y2) = y2.(y1s)−1 mod p was decryption function. However, the scheme was very weak; it does not contain all the necessary functionalities required for security. Also, the security analysis presented in their scheme was vague. Overall they have not accurately presented the scheme. In 2013, a multiserver authentication and key agreement scheme was proposed by Chuang and Chen [17] using the phenomenon of trusted RC. They urged that their scheme is lightweight due to using nonce and hash function. In their scheme, also no verification table for password matching was present in the server which in turn guarantees for mutual authentication and resists forgery attack. However, later on, the said scheme was cryptanalysed by He and Wang [18] and proved that the password can easily be divulged from the data exchanging among peers. He and Wang [18] used ECC and fuzzy extractor approaches for designing a multiserver environment's authentication scheme that swamped all the drawbacks of [16, 17]. However, due to the possibility of an athletic adversary, impersonation and DoS attacks can easily be lofted in their scheme. Finally, if a reliable end-user wishes to avail appropriateness of the multiserver, he/she does not need to register for each server individually. This mechanism was advised by Chaudhry et al. [19] and favoured a biometric-based three-factor authentication scheme. Their scheme was very effective for an end-user that registers once and accounts for all the benefits of multiple servers. Wang et al. [20] presented an improved version of [19] and said that their scheme is suffering from the masquerade, replay, and DoS attacks. Also, it failed to deliver perfect forward secrecy. So, they presented an enhanced and innovative biometric-based authentication scheme in which the server sends a combined request message to the RC, relays a private key s to each server by using IKEV2.00 (A prominent key exchange protocol). In this way, each server becomes the authority for a secure exchange of the requested required information having key s. Owing to excellent efforts made by Wang et al. [20] and implementation of their scheme for the real-world environment, they recommended many electronic-based facilities for every single individual such as e-commerce, e-banking, e-gaming, and e-rail. However, the application programme that provided these facilities to a user was shaky. Canetti et al. [21] presented a robust ECC-based authentication scheme to maintain the legitimacy and authenticity of each user before reaching the internal secrets of any server. They proved the security of their scheme on different techniques using ROM. However, the authors of [22] found that the scheme proposed by Canetti et al. was vulnerable to several threats. 2.1 Review analysis of scheme proposed in [23] Very recently, Park et al. [23] proposed a biometric and ECC-based authentication scheme that has resolved the possibilities of a registered malicious server in a multiserver setting. In their scheme, RC means a registration centre and TS a trusted server. They expressed that only valid users can login to the trusted server and not to the RC. Their scheme consists of initialisation, registration login and authentication, and password change phases. Notations used are shown in Nomenclature. In the initialisation phase of the scheme proposed in [23], the RC first selects G1 of prime order, q selects P as a generator of G1. Then chooses a one-way hash function h(·), extracts a secret number s called a private key, and produces {G1, q, P, h(·)} public key parameters. In the registration phase of the scheme [23], first a server is registered. The server selects a unique identity SIDja, a private key sj and calculates the public key Pja = sjaP. Also, transmit a registration request {SIDja, Pja} over a secure channel towards RC. The RC stores SIDja, Pja in its database, and generates a secret key PSK∈Z∗p using arbitrary polynomial calculations i.e. . The RC after this calculation computes SIDja = h(SIDja), produces a secret key Kja = f(h(SIDja) and sends towards the server using a secure channel. Secondly, in the user registration stage, the user (Uia) selects identity (IDia), password (PWia) and produces his/her biometrics (Bia) passing through generation function, i.e. Gen(Bia) = (Ria, Pia). The user (Uia) then computes PWDia = h(PWia||Ria) and transmits {IDia, PWDia} towards RC via a secure channel. Upon receiving {IDia, PWDia} message from the user, the RC performs Via = h(IDia||PWDia), Wia = h(IDia||PSK)⊕PWDia and stores {Via, Wia, h(·)} in the memory of user's SC, SCi, while sends SCia towards user (Uia) through a secure channel. In the login and authentication phase of the scheme [23], if a legitimate user desires to login into the system, he/she must first provide his/her identity, password, and imprints biometric. The SC locally compute Ria* and PWDia*, and compare it with the previously computed stored values, Ria* = Rep(Bia, Pia), PWDia* = h(PWia||Ria), Via*=h(IDia||PWDia*), match Via*? = Via, if hold, further computation performs, else, the process becomes terminated. Next, the user defines a random number u∈Zp*, to calculate a public key, i.e. Dia = uP, and taking time interval T1. The user then performs calculations, i.e. AIDia = IDia⊕h(Dia||T1), Mia = h((Wia⊕PWDia)||SID||Dia), Cia = h(IDia||Dia||Mia||T1), and sends {AIDia, Dia, Cia, T1} message towards the server over an open network channel. Upon receiving the request {AIDia, Dia, Cia, T1} message, the server first verifies timestamp T′ − T1 ≤ T. If not found within the pre-defined time threshold, consider just a replay of an old message, else, server computes Dia, IDia, and Cia∗, and confirms its validity Mia = h(h(IDia||PSK)||SID||Dia), Dia = sjaDia, IDia = AIDia⊕h(Dia||T1), Cia* = h(IDia||Dia||Mia||T1) and compares Cia? = Cia*. The server also generates a random number v∈Zp*, time T2 and calculates Yia, Jia, and a session key SKija by performing these operations: Yia = vP, Jia = h(AIDia||Mia||T2), SKija = h(AIDia||Jia||Dia||vDia||T2), and sends {Jia, Yia, T2} message towards user over a public channel. The user Uia after receiving the message from the server first confirms time validity T′ − T2 ≤ T. If valid, Uia computes: Jia∗ = h(AIDia||Mia||T2), verifies Jia? = Jia∗ and calculates the session shared key SKija = h(AIDia||Jia∗||Dia||uYia||T2). User Uia chooses another time interval T3 calculates Qia = h(SKija||AIDia||T3) and relays {Qia, T3} towards server over a public channel. The server again repossesses T′ by comparing it with the user's time T/ − T3 ≤ T, if found within the pre-defined timespan, it confirms the legitimacy of Qia by matching it with h(SKija||AIDia||T3). The password change phase of the scheme [23] is accomplished without interact with RC. The user (Uia) introduces his/her SC in the terminal and enters his/her old credentials IDia, PWia, and imprints the already registered biometrics (Bia). The SC (SCia) and terminal collaboratively computes Ria* = Rep(Bia, Pia), PWDia* = h(PWia||Ria*), Via∗ = h(IDia||PWDia*) and compares Via* with Via. If pass, SCia allows Uia for inputting a new password PWianew, else, SCia generates a deny message on the user's screen. When a user provide a new/change password, some operations are performed, i.e. PWDianew = h(PWianew||Ria), Vianew = h(IDia||PWDianew), and Wianew = h(IDia||PSK)⊕PWDianew. The old values are replaced by a new one, i.e. Via, Wia with Vianew, Wianew. 2.2 Cryptanalysis of the scheme [23] The current research addresses the following flaws in the scheme [23]. 2.2.1 De-synchronisation attack An attacker can effortlessly barrage a de-synchronisation attack in which the shared secrets from synchronous storage might lead to the unavailability of service. He/She overpowering a fake message between server and remote user due to which scheme [23] could not communicate and no longer possible for it to ensure security. As the RC has already updated its credentials in time interval Tia and the user Uia still stored the previous credentials. When RC authenticates Uia, by using its fresh credentials it is not possible because Uia has eventually previous data resend the same old authentication request. At this point, the Uia and RC become desynchronise. In the scheme proposed in [23] it has not mentioned how to deal with a failed updated mechanism. Thus, the scheme proposed in [23] is suffering from a de-synchronisation attack. 2.2.2 Forward secrecy issue An adversary can break the forward key separation using a fake base station/registered server. The attacker put a fake request using a fake timestamp (TA), and the server understand that the said request was received from a legal user, deriving SK = h(AIDia||Jia||Dia||bDia||TA), because the root key SKija = h(AIDia||Jia∗||Dia||uYia||T2) in the scheme proposed in [23] is not updated dynamically. Also, it might create a hurdle for perfect forward secrecy. 2.2.3 Mutual authentication issue The scheme proposed in [23] also failed to deliver mutual authentication because the attacker can launch a DoS attack by sending false requests that result in disturbing the useful operations, performance of server(s) on one hand and security, authenticity, and integrity on the other. And, the algorithm based on ECC is difficult to implement for the real-world environment [24, 25], while in our scheme which is based on the bilinear pairing/map is a much easy and secure approach and can be practically implemented. 2.2.4 Traceability issue The adversary can attempt through repeated attributes applied by the legitimate user. This clever procedure may lead the adversary to the original user's location. This possesses a potential threat for finding the exact location of a user and thus lowers down the system's credibility. 2.3 Organisation of the paper The organisation of the paper: in Section 1, a concise introduction has been furnished concerning a multiserver environment, synchronisation attack, and key exchange procedures between server and user. Section 2 is focused purely on the previously accomplished work of various researchers. We also presented the review analysis of the scheme presented by Park et al. and pointed out major flaws in it. Section 3 confers the proposed scheme in five phases. In Section 4, the security analysis of the recommended scheme has been formally conveyed using a ROM, ProVerif2.00 programming toolkit and informally using hypotheses and investigation. While in Section 5 the performance of the offered scheme has been interpreted from different perspectives such as storage overhead analysis, communication, computation, and comparison analysis. Eventually, the work is concluded in Section 6. 3 Proposed solution Recently, the security and successful management of a multiserver environment is imperative, extrusive, and warm fields for research. For this purpose, we have attempted to design a scheme that caters to end-user interest for better utilisation and useful operations for secure information access. Since without a strong protocol, the goal of communicating shared secrets, memory, and secure usage of associated peripherals cannot accomplish smoothly. The proposed scheme consists of five phases including initialisation, registration, login & authentication, password change, and card revocation phases; each of which is described under the following sub-headings. 3.1 Initialisation phase Suppose G1 and G2 are two groups of prime order q, and P be a generator of G1 and |G1| = |G2|, then e: G1 × G1→G2 called bilinear pairing/map that satisfies: e(τP1, pP2) = (P1, P2)τp, e(P, P) ≠ 1. If P1 and P2∈G1 then there exists a successful algorithm to calculate e(P1, P2). The computational Diffie–Hellman (CDH) approach is applied for calculating the secret key to make it hard for the adversary to discover it at any stage during communication. Upon extorting security parameters and secret key s, the system apts to enumerate the public key. The RC arbitrarily chooses P from G1, and compute Ppub = sP, where s is the secret key, selects collision-free one-way hash function h:{0, 1}* sG1→Zq*, and generates different parameters, i.e. {Ppub, s, G1, h(.)}. 3.2 Registration phase Server registration: This phase of the scheme consists of the following steps: Step 1: The server selects identity SIDja, a private key sja and calculates the public key Pja = sjaP and relays a registration request {SIDja, Pja} over a secure channel. Step 2: RC stores SIDja, Pja in its database. Step 3: RC computes Kja = h(SIDja) and sends it to the server for registration through a secure channel, as shown in Fig. 4. User registration: Now in the second part of the registration phase, if a user (Uia) registers with RC for availing the useful operations securely. He/she must perform these steps: Step 1: The user first selects identity IDia, password PWia, and imprints biometrics Bia. Step 2: Uia computes Gen(Bia) = (Ria, Pia) and PWDia = h(PWia||Ria) and relays {IDia, PWDia} to RC through a private channel. Step 3: RC computes Via = h(IDia||PWDia) and Wia = h(IDia||s)⊕PWDia. Step 4: RC stores {Via, Wia, h(·)} in the memory of a smart card, SCia, and sends SCia towards user Uia through a private channel. Step 5: Uia stores {Via, Wia, Pia, h(·)} parameters in the memory of a SC, as also shown in Fig. 4. Fig. 4Open in figure viewerPowerPoint Login and authentication phase 3.3 Login, authentication, and key agreement phase This phase of the scheme is completed in the following steps: Step 1: The legitimate user provides identity (IDia), password (PWia) and biometric (Bia*), the SC locally compute Ria* = h(Bia*⊕Pia), and compare it with the previously computed stored values. If not verifies, the processes become terminated, else computes: PWDia* = h(PWia||Ria), Via* = h(IDia||PWDia*) and verify Via*? = Via. If not hold further computations terminated. Step 2: The user defines a random number u∈Zp* encrypt Nia = Epia(s⊕u), extracts timestamp T1, and compute: Dia = uP, AIDia = IDia⊕h(Dia||T1), Mia = h((Wia⊕PWDia)||SIDja||Dia), Cia = h(IDia||Dia||Mia||T1) and sends {AIDia, Nia, Dia, Cia, T1} towards server over a public network channel. Step 3: Upon receiving the request {AIDia, Nia, Dia, Cia, T1} message by the server, it first verifies time T ′− T1 ≤ T. If not found within the pre-defined time threshold, the server consider it a potential reply attack, discard the message and stop calculations. For valid communication, the server computes Dia, IDia, Cia∗, and justifies its value via these set of operations: Dia = sjaP, decrypts s⊕u = Ds(Nia) and calculate: IDia = AIDia⊕h(Dia||T1), Mia = h(h(IDia||s)||SIDja||Dia), Cia* = h(IDia||Dia||Mia||T1) and compares Cia? = Cia*. If confirmed, further computation is performed, else, the process termination performed. Step 4: The server also generates a random number v∈Zp*, extract timestamp T2, cal