# A Secure and Efficient Three-Factor Authentication Protocol in Global Mobility Networks
## 1 Introduction  
With the advances in wireless communication technology, the global mobility network (GLOMNET) [1; 2; 3] has become a popular means of communication. Users can access roaming services through mobile devices; therefore, people's access to knowledge has been improved significantly. In GLOMNET, each mobile user depends on a specific home agent (HA) where they are registered. If the mobile user is in the domain of a foreign agent (FA), the FA must ensure service after authenticating the mobile user. However, as a mobile device has limited resources available in terms of computing power, memory, and battery capacity [4; 5], it is not suitable to apply symmetric and asymmetric cryptosystems that generate high computational overheads. In this case, mobile users can face delays during processing and service availing. In addition, a malicious adversary may attemptvarious attacks using sensitive data transmitted via an insecure channel in GLOMONET. Therefore, secure and efficient mutual authentication has become an essential security requirement to provide secure roaming services for legitimate mobile users. The security requirements for GLOMONET are summarized as follows:  
* Secure and efficient authentication schemes are required to provide various services in GLOMONET.
* Authentication schemes must resist various attacks, including stolen mobile devices, masquerades, and trace attacks.
* Authentication schemes must consider the limitations of mobile devices relative to the computing power, memory, and battery capacity [4; 5].  
In the last few years, many authentication schemes have been presented for GLOMONET to ensure the security of users [6; 7; 8; 9]. In 2004, [PERSON] et al. [10] presented an efficient two-factor authentication scheme to provide the roaming facility. However, [PERSON] et al. [11] indicated that [PERSON] et al.'s [10] protocol did not resist impersonation attacks and also could not achieve user authentication. In 2006, [PERSON] et al. [11] presented an improved protocol for wireless environments to overcome the security flaws of [PERSON] et al.'s scheme. However, [PERSON] et al. [12] assessed that [PERSON] et al.'s [11] scheme did not withstand perfect backward secrecy and did not ensure user anonymity. In 2012, [PERSON] et al. [13] assessed that [PERSON] et al.'s [12] scheme could not withstand replay and masquerade attacks and also could not provide user anonymity.  
To overcome these security flaws, [PERSON] et al. [13] then proposed a novel user authentication scheme based smart-card to provide efficient high computational and communication overheads. However, [PERSON] et al. [14] demonstrated that [PERSON] et al.'s protocol [13] was sensitive to replay attacks and did not achieve proper user password updates in the password change processes. In 2015, [PERSON] and [PERSON] [15] presented a secure authentication protocol in GLOMONET. However, [PERSON] et al. [16] proved that their protocol could not withstand offline guessing, insider, stolen-verifier, denial of service, and forgery attacks.  
In 2018, [PERSON] et al. [16] presented a secure and efficient user authentication scheme for GLOMONET using a mobile device to resolve the security problems of [PERSON] and [PERSON]'s scheme. [PERSON] et al. claimed that their scheme could prevent replay and masquerade attacks and provide secure mutual authentication. Unfortunately, we analyzed that [PERSON] et al.'s scheme [16] could not prevent various security threats and could not provide secure mutual authentication. Moreover, [PERSON] et al.'s scheme [16] was unsuitable for resource-constrained mobile devices as it uses symmetric key encryption and modular multiplication, which generate high computational overheads. Thus, we proposed a secure and efficient three-factor user authentication scheme for roaming services in GLOMONET to resolve the security flaws of [PERSON] et al.'s scheme.