# An Improved Authentication Scheme for Digital Rights Management System

Authors: Sajid Hussain; Yousaf Bin Zikria; Ghulam Ali Mallah; Chien-Ming Chen; Mohammad Dahman Alshehri; Farruh Ishmanov; Shehzad Ashraf Chaudhry
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

With the increasing number and popularity of digital content, the management of digital access rights has become an utmost important field. Through digital rights management systems (DRM-S), access to digital contents can be defined and for this, an efficient and secure authentication scheme is required. The DRM authentication schemes can be used to give access or restrict access to digital content. Very recently in 2020, Yu et al. proposed a symmetric hash and xor-based DRM and termed their system to achieve both security and performance efficiency. Contrarily, in this study, we argue that their scheme has several issues including nonresistance to privileged insider and impersonation attacks. Moreover, it is also to show in this study that their scheme has an incorrect authentication phase and due to this incorrectness, the scheme of Yu et al. lacks user scalability. An improved scheme is then proposed to counter the insecurities and incorrectness of the scheme of Yu et al. We prove the security of the proposed scheme using BAN logic. For a clear picture of the security properties, we also provide a textual discussion on the robustness of the proposed scheme. Moreover, due to the usage of symmetric key-based hash functions, the proposed scheme has a comparable performance efficiency.


---

## Body

## 1. Introduction

The rapid expansion of computer technology and media of various types such as software, music services, videos, photos, documents, and e-books is combined and manipulated as digital contents. With the invention of the low power devices, the distribution of such digital content along the globe is increased rapidly [1]. This rapid distribution demands an efficient digital rights management system to be utilized to preserve the digital rights associated with the content. A serious concern is the downloading of the contents by unauthorized users, which is a big problem and deprivation for the copyright owners. Thus, the protection of the digital contents is the major issue, and authentication is a very necessary security requirement for the prevention of unauthorized access and making the availability of the digital contents to the only legitimate users. Digital right management (DRM) systems are specifically designed environments that include some access control mechanism for the use of the digital content [2, 3]. The main purpose of the DRM system is to provide protection to the digital contents and to make sure these are only accessible to valid users. Digital content services that include important data are conveyed through the public channels, which are fully accessible to malicious users. Hence, for the sake of secure transmission of the digital contents to the valid user through the public channel, strong authentication and key agreement schemes are needed [4–6].In the immediate past, various authentication schemes have been proposed to make sure the privacy of the digital content and user. In 2008, Chen [7] proposed a biometric-based authentication scheme based on biometric for DRM environment. Later on, Chang et al. [8] pointed weaknesses such as attackers can steal keys and can access digital content without any permission and proposed an improved system. Later on, Chang et al. [9] pointed that [8] is insecure against stolen device attacks and proposed an improved scheme for DRM. Mishra et al. [10] proved that the scheme of Zhang et al. [11] was vulnerable to password guessing attacks and insider attacks and proposed an improved biometric-based scheme for DRM. In 2015, Jung et al. [12] proposed an ECC-based authentication scheme for DRM. In 2017, Jung et al. [12] presented a biometric-based authentication scheme for the DRM system. Later in 2018, Lee et al. [13] proved that the protocol of [10] is suspected to the secret key disclosure which leads to anonymity violation. Yu et al. [14] claimed that the method presented in [13] is insecure against user impersonation and device theft attack and proposed an improved scheme to overcome the flaws of [13].


### 1.1. Adversarial Model

The main purpose of authentication schemes for DRM systems is to provide a scalable solution for remote user successful authentication. However, the authentication protocols should oppose many active/passive attacks [15–17]. The analysis of attacks is based on the CK adversarial model [18], which is an extension of the DY model [19] with the following features:
(1)
A valid user can possess the login credentials, namely, identity, password, biometric, etc. The server keeps the master key [20, 21](2)
A public communication channel is in full control of the adversary(3)
A legal user can be dishonest [22, 23](4)
Any malicious user can extract saved credentials in the smart card by applying a stolen attack


### 1.2. System Model of DRM

DRM system is a verification and access control method to access digital content. Figure1 shows the DRMS common architecture comprising of four major entities: (1) the content writer/owner, (2) content server, (3) the user, and (4) license sever.
(1)
The user who wants to obtain digital content transmits an authentication ask to the content and license servers. As soon as mutual authentication with the license server is successfully completed, reach to the encrypted digital content is issued with the help of a secret key(2)
The content server saves the encrypted digital content in its database receive by the digital content creator and after that abstract of the content is accessible to the users on the internet(3)
The content generator/provider provides content generation services. The digital content is generated and encrypted by the secret key. This key is transmitted to the license server using the public channel, and also encrypted digital content is also sent to the content server using a tunneled channel(4)
The license server receives the secret key and stores it in its database. When a user requires the secret key of the encrypted digital content, the license server first authenticates that user and then sends the secret key of the contentFigure 1
DRM-system-architecture.


## 1.1. Adversarial Model

The main purpose of authentication schemes for DRM systems is to provide a scalable solution for remote user successful authentication. However, the authentication protocols should oppose many active/passive attacks [15–17]. The analysis of attacks is based on the CK adversarial model [18], which is an extension of the DY model [19] with the following features:
(1)
A valid user can possess the login credentials, namely, identity, password, biometric, etc. The server keeps the master key [20, 21](2)
A public communication channel is in full control of the adversary(3)
A legal user can be dishonest [22, 23](4)
Any malicious user can extract saved credentials in the smart card by applying a stolen attack


## 1.2. System Model of DRM

DRM system is a verification and access control method to access digital content. Figure1 shows the DRMS common architecture comprising of four major entities: (1) the content writer/owner, (2) content server, (3) the user, and (4) license sever.
(1)
The user who wants to obtain digital content transmits an authentication ask to the content and license servers. As soon as mutual authentication with the license server is successfully completed, reach to the encrypted digital content is issued with the help of a secret key(2)
The content server saves the encrypted digital content in its database receive by the digital content creator and after that abstract of the content is accessible to the users on the internet(3)
The content generator/provider provides content generation services. The digital content is generated and encrypted by the secret key. This key is transmitted to the license server using the public channel, and also encrypted digital content is also sent to the content server using a tunneled channel(4)
The license server receives the secret key and stores it in its database. When a user requires the secret key of the encrypted digital content, the license server first authenticates that user and then sends the secret key of the contentFigure 1
DRM-system-architecture.


## 2. The Scheme of Yu et al.: A Review

The scheme of Yu et al. [14] is reviewed and briefly explained in this section and the notation guide which is used in this paper is depicted in Table 1.Table 1
Symbol guide.
SymbolsExplanationsUm, LSjMobile user, license serverIDm, IDcIdentities ofUm, LSjPWm, BIOmPassword and biometric ofUmXLS, KCSecret keysLSj, IDch., H.Hash and biohash functionsR1, R2Random noncesPIDmUnique random nonce for each userTm, TcsCurrent timestampsKEYDCSecret key of digital contentXLSMaster key of license serverΔTAllowed transmission delay||,⊕Concatenation and XOR operations


### 2.1. User Registration Phase

The process to register a userUm with the license server LSj is depicted in Figure 2 and explained through the following steps:
(RG1)
userUm chooses his/her identity IDm, password PWm, and marks biometrics BIOm. After that Um calculates GenBIOm=Rm,Pm, and RPWm=hPWmRm and dispatches IDm,RPWm to LSj-license server via private channel(RG2)
license serverLSj on receiving request containing IDm,RPWm by Um calculates Xm=hIDmXLS, dm=Xm⊕hIDmRPWm, and fm=hRPWmXm. LSj saves IDm and Xm within its database and replies the registration request message dm,fmtoUm via private channel(RG3)
Um receives the message from LSj saves dm,fm in its mobile device memoryFigure 2
Yu et al.’s user registration.


### 2.2. Login and Authentication Phase

A registered userUm who wants to utilize the digital content DC initiates a mutual authentication request with LSj with an aim to attain mutual authentication and obtain the secret key KC of the DC. The steps involved in the login and authentication procedure are detailed in Figure 3 and explained as follows:
(LAA 1)
Um enters his/her IDm,PWm apir and submits BIOm. After that, Um calculates Rm=RepBIOm,Pm, RPWm=hPWmRm, Xm=dm⊕hIDmRPWm, and fm∗=hRPWmXm and compare if fm∗=?fm. If the condition is true, Um creates R1 randomly and calculates Z1=Xm⊕R1, Z2=IDm⊕R1, Z3=IDc⊕R1, and ZUS=hIDmIDcXmR1. Then, the user Um initiates the request message Z1,Z2,Z3,ZUS through public channel to LSj(LAA 2)
LSj receives the request message sent by Um and calculates R1=Z1⊕Xm, IDm=Z2⊕R1, IDc=Z3⊕R1, and MUS∗=hIDIDcXmR1 and verifies if MUS∗=?ZUS. If the condition is true, LSj picks relevant KC, creates random nonce R2, and calculates Z4=R2⊕Xm, Z5=KC⊕Xm and ZSU=hIDmXmKCR2. At the end, LSj sends the message Z4,Z5,ZSU to user Um directly through public channel(LAA 3)
Um receives the response message from LSj and calculates R2=Z4⊕Xm, KC=Z5⊕Xm, and MSU∗=hIDmXmKCR2. At the end user, Um verifies if MSU∗=?ZSU and saves KDC in the deviceFigure 3
Yu et al.’s login and authentication scheme.


## 2.1. User Registration Phase

The process to register a userUm with the license server LSj is depicted in Figure 2 and explained through the following steps:
(RG1)
userUm chooses his/her identity IDm, password PWm, and marks biometrics BIOm. After that Um calculates GenBIOm=Rm,Pm, and RPWm=hPWmRm and dispatches IDm,RPWm to LSj-license server via private channel(RG2)
license serverLSj on receiving request containing IDm,RPWm by Um calculates Xm=hIDmXLS, dm=Xm⊕hIDmRPWm, and fm=hRPWmXm. LSj saves IDm and Xm within its database and replies the registration request message dm,fmtoUm via private channel(RG3)
Um receives the message from LSj saves dm,fm in its mobile device memoryFigure 2
Yu et al.’s user registration.


## 2.2. Login and Authentication Phase

A registered userUm who wants to utilize the digital content DC initiates a mutual authentication request with LSj with an aim to attain mutual authentication and obtain the secret key KC of the DC. The steps involved in the login and authentication procedure are detailed in Figure 3 and explained as follows:
(LAA 1)
Um enters his/her IDm,PWm apir and submits BIOm. After that, Um calculates Rm=RepBIOm,Pm, RPWm=hPWmRm, Xm=dm⊕hIDmRPWm, and fm∗=hRPWmXm and compare if fm∗=?fm. If the condition is true, Um creates R1 randomly and calculates Z1=Xm⊕R1, Z2=IDm⊕R1, Z3=IDc⊕R1, and ZUS=hIDmIDcXmR1. Then, the user Um initiates the request message Z1,Z2,Z3,ZUS through public channel to LSj(LAA 2)
LSj receives the request message sent by Um and calculates R1=Z1⊕Xm, IDm=Z2⊕R1, IDc=Z3⊕R1, and MUS∗=hIDIDcXmR1 and verifies if MUS∗=?ZUS. If the condition is true, LSj picks relevant KC, creates random nonce R2, and calculates Z4=R2⊕Xm, Z5=KC⊕Xm and ZSU=hIDmXmKCR2. At the end, LSj sends the message Z4,Z5,ZSU to user Um directly through public channel(LAA 3)
Um receives the response message from LSj and calculates R2=Z4⊕Xm, KC=Z5⊕Xm, and MSU∗=hIDmXmKCR2. At the end user, Um verifies if MSU∗=?ZSU and saves KDC in the deviceFigure 3
Yu et al.’s login and authentication scheme.


## 3. Cryptanalysis of Yu et al.’s Scheme

In this section, through the informal analysis of Yu et al.’s scheme [14], it is affirmed that their scheme is secure against well-known attacks. However, the following subsections demonstrate that the scheme presented in [14] is having correctness issues, is weak against ephemeral secret leakage attacks, and does not provide anonymity.


### 3.1. Incorrectness

The authentication phase of Yu et al.’s scheme cannot end normally, and the license server and user may be unable to share any key at all. The user in the Yu et al. scheme after initiating an authentication message to the license server may never receive an acknowledgment, and the license server may never create a session key. Hence, their scheme lacks the property of authentication and key agreement. The depiction of incorrectness case is as follows:(Inc 1)
userUm sends a login request by entering password, identity, and biometric, and transmits Z1,Z2,Z3,ZUS to LSj (the license server)(Inc 2)
license serverLSj receives the request message and computes(1)R1=Z1⊕Xm.The computation of the above equation requires theXm corresponding requesting user identity IDm, which the license server does not know. Also, the request message sent by the user Um does not include the identity of the requesting user. The license server computes the request without the information of any designated user. In the same way, the license server sends the acknowledgment message without knowing to whom this message is to be sent.The only case in which Yu et al.’s scheme can achieve the authentication and key agreement in the view is if the system has only one registered user. Hence, systems with a single registered user are not preferable in the real world. Therefore, Yu et al.’s scheme for facilitating digital rights management systems is incorrect, and this incorrectness shows that their system is not preferable for real-world deployments.


### 3.2. Privileged Insider Attack

Yu et al.’s scheme stores the sensitive information in the database of the license server. Due to which it is susceptible to user impersonation, server impersonation attacks, and secret key leakage attacks. The attacks can be simulated in the following methods.


#### 3.2.1. User Impersonation Attack

The internal adversaryA gets ISm and Xm from the database of the license server. Now the adversary A can impersonate as Um by adopting the following steps:
(IUA 1)
A picks a random number RUA(IUA 2)
computesZ1=Xm⊕RUA, Z2=IDm⊕RUA, Z3=IDc⊕UA, and ZAUS=hIDmIDcXmUA(IUA 3)
transmits the messageZ1,Z2,Z3,ZAUS to license server LSj(IUA 4)
license serverLSj accepts the message Z1,Z2,Z3,ZAUS and verifies the message legitimacy and verification will be successful as user verification on license server LSj is not taking place(IUA 5)
LSj will fetch relevant KC and computes Z4=R2⊕Xm, Z5=KC⊕Xm and ZSU=hIDmXmKCR2. LSj sends the message Z4,Z5,ZSU to A(IUA 6)
A receives the message sent by LSj and computes R2=Z4⊕Xm, KC=Z5⊕Xm, and MSU∗=hIDmXmKCR2. Adversary gets successfully the secret key KC


#### 3.2.2. License Server Impersonation Attack

The privileged adversarySA steals the IDm,Xm from the database of the LSj. When Um sends the the message Z1,Z2,Z3,ZAUS to LSj through public channel; then, SA will intercept the message and and impersonate as a valid license server in the following ways.
(ISA 1)
SA will compute R1 = Z1⊕Xm, IDm = Z2⊕R1, IDc = Z3⊕R1, and MUS∗ = hIDIDcXmR1(ISA 2)
verify ifMUS∗=?ZUS. If the condition is true, LSj picks relevant KC and creates random nonce RUS(ISA 3)
calculateZ4 = RUS⊕Xm, Z5 = KEYADC⊕Xm, and ZASU = hIDmXmKEYADCRUS.(ISA 4)
SA sends the message Z4,Z5,ZASU to user Um(ISA 5)
Um will verify the message and verification will be successful and as a result, get secret key KEYADC which is in real a forged key and will not work


#### 3.2.3. No Secret Key Secrecy

Only those users who have the secret key can access the digital content in the digital rights management system. But, as shown in Section3.2.1, an adversary A can acquire the secret key by impersonating as a valid user Um. Hence, Yu et al.’s scheme does not ensure the security of the secret key.


## 3.1. Incorrectness

The authentication phase of Yu et al.’s scheme cannot end normally, and the license server and user may be unable to share any key at all. The user in the Yu et al. scheme after initiating an authentication message to the license server may never receive an acknowledgment, and the license server may never create a session key. Hence, their scheme lacks the property of authentication and key agreement. The depiction of incorrectness case is as follows:(Inc 1)
userUm sends a login request by entering password, identity, and biometric, and transmits Z1,Z2,Z3,ZUS to LSj (the license server)(Inc 2)
license serverLSj receives the request message and computes(1)R1=Z1⊕Xm.The computation of the above equation requires theXm corresponding requesting user identity IDm, which the license server does not know. Also, the request message sent by the user Um does not include the identity of the requesting user. The license server computes the request without the information of any designated user. In the same way, the license server sends the acknowledgment message without knowing to whom this message is to be sent.The only case in which Yu et al.’s scheme can achieve the authentication and key agreement in the view is if the system has only one registered user. Hence, systems with a single registered user are not preferable in the real world. Therefore, Yu et al.’s scheme for facilitating digital rights management systems is incorrect, and this incorrectness shows that their system is not preferable for real-world deployments.


## 3.2. Privileged Insider Attack

Yu et al.’s scheme stores the sensitive information in the database of the license server. Due to which it is susceptible to user impersonation, server impersonation attacks, and secret key leakage attacks. The attacks can be simulated in the following methods.


### 3.2.1. User Impersonation Attack

The internal adversaryA gets ISm and Xm from the database of the license server. Now the adversary A can impersonate as Um by adopting the following steps:
(IUA 1)
A picks a random number RUA(IUA 2)
computesZ1=Xm⊕RUA, Z2=IDm⊕RUA, Z3=IDc⊕UA, and ZAUS=hIDmIDcXmUA(IUA 3)
transmits the messageZ1,Z2,Z3,ZAUS to license server LSj(IUA 4)
license serverLSj accepts the message Z1,Z2,Z3,ZAUS and verifies the message legitimacy and verification will be successful as user verification on license server LSj is not taking place(IUA 5)
LSj will fetch relevant KC and computes Z4=R2⊕Xm, Z5=KC⊕Xm and ZSU=hIDmXmKCR2. LSj sends the message Z4,Z5,ZSU to A(IUA 6)
A receives the message sent by LSj and computes R2=Z4⊕Xm, KC=Z5⊕Xm, and MSU∗=hIDmXmKCR2. Adversary gets successfully the secret key KC


### 3.2.2. License Server Impersonation Attack

The privileged adversarySA steals the IDm,Xm from the database of the LSj. When Um sends the the message Z1,Z2,Z3,ZAUS to LSj through public channel; then, SA will intercept the message and and impersonate as a valid license server in the following ways.
(ISA 1)
SA will compute R1 = Z1⊕Xm, IDm = Z2⊕R1, IDc = Z3⊕R1, and MUS∗ = hIDIDcXmR1(ISA 2)
verify ifMUS∗=?ZUS. If the condition is true, LSj picks relevant KC and creates random nonce RUS(ISA 3)
calculateZ4 = RUS⊕Xm, Z5 = KEYADC⊕Xm, and ZASU = hIDmXmKEYADCRUS.(ISA 4)
SA sends the message Z4,Z5,ZASU to user Um(ISA 5)
Um will verify the message and verification will be successful and as a result, get secret key KEYADC which is in real a forged key and will not work


### 3.2.3. No Secret Key Secrecy

Only those users who have the secret key can access the digital content in the digital rights management system. But, as shown in Section3.2.1, an adversary A can acquire the secret key by impersonating as a valid user Um. Hence, Yu et al.’s scheme does not ensure the security of the secret key.


## 3.2.1. User Impersonation Attack

The internal adversaryA gets ISm and Xm from the database of the license server. Now the adversary A can impersonate as Um by adopting the following steps:
(IUA 1)
A picks a random number RUA(IUA 2)
computesZ1=Xm⊕RUA, Z2=IDm⊕RUA, Z3=IDc⊕UA, and ZAUS=hIDmIDcXmUA(IUA 3)
transmits the messageZ1,Z2,Z3,ZAUS to license server LSj(IUA 4)
license serverLSj accepts the message Z1,Z2,Z3,ZAUS and verifies the message legitimacy and verification will be successful as user verification on license server LSj is not taking place(IUA 5)
LSj will fetch relevant KC and computes Z4=R2⊕Xm, Z5=KC⊕Xm and ZSU=hIDmXmKCR2. LSj sends the message Z4,Z5,ZSU to A(IUA 6)
A receives the message sent by LSj and computes R2=Z4⊕Xm, KC=Z5⊕Xm, and MSU∗=hIDmXmKCR2. Adversary gets successfully the secret key KC


## 3.2.2. License Server Impersonation Attack

The privileged adversarySA steals the IDm,Xm from the database of the LSj. When Um sends the the message Z1,Z2,Z3,ZAUS to LSj through public channel; then, SA will intercept the message and and impersonate as a valid license server in the following ways.
(ISA 1)
SA will compute R1 = Z1⊕Xm, IDm = Z2⊕R1, IDc = Z3⊕R1, and MUS∗ = hIDIDcXmR1(ISA 2)
verify ifMUS∗=?ZUS. If the condition is true, LSj picks relevant KC and creates random nonce RUS(ISA 3)
calculateZ4 = RUS⊕Xm, Z5 = KEYADC⊕Xm, and ZASU = hIDmXmKEYADCRUS.(ISA 4)
SA sends the message Z4,Z5,ZASU to user Um(ISA 5)
Um will verify the message and verification will be successful and as a result, get secret key KEYADC which is in real a forged key and will not work


## 3.2.3. No Secret Key Secrecy

Only those users who have the secret key can access the digital content in the digital rights management system. But, as shown in Section3.2.1, an adversary A can acquire the secret key by impersonating as a valid user Um. Hence, Yu et al.’s scheme does not ensure the security of the secret key.


## 4. Proposed Scheme

To ensure privacy, security, and to remove the incorrectness in the scheme of Yu et al. [14], a new scheme is proposed in this section. The proposed scheme comprises three main phases, which are further divided into subphases. The detail of the scheme is given in the following subsections.


### 4.1. Registration Phase

To get access to the digital contents, a user must register himself/herself to be a legitimate user. Following are the steps as mentioned in Figure4 to be followed:Figure 4
Proposed user registration.RGD 3: the userUm picks the pair IDm,PWm and engraves BIOm. Now Um computes GenBIOm=Rm,Pm, and RPWm=hPWmRm and dispatches IDm,RPWm to license server LSj by using secure channelRGD 3: license serverLSj receiving the registration request by Um computes Xm=hIDmXLS, dm=Xm⊕hIDmRPWm, and saves IDm and PIDm in its database and reply the registration request message XmtoPIDm by using channelRGD 3:Um receives the message from LSj and computes PIDm′=PIDm⊕hPWmRm, Xm′=Xm⊕hPWmRm, Zm=hIDmPWmRm and stores Xm′,PID′m,Zm in the mobile device memory


### 4.2. Login and Authentication

Following steps as mentioned in Figure5 are executed to furnish login and authentication phase of the proposed scheme:
(LAuth 1)
Um inputs IDm, password PWm, imprints biometric BIOm, calculates Rm=RepBIOm,Pm, and checks if Zm=?hIDmPWmRm, and if the condition is true, then, select R1 and Tm and compute Xm=Xm′⊕hRmPWm, Z1=IDm⊕R1⊕hXm⊕Tm, Z2=IDc⊕R1⊕hXm⊕Tm, ZUS=hIDmIDchXmTmR1Tm and send the message containing Z1,Z2,ZUS,PIDm,Tm to the LSj(LAuth 2)
after receiving the messageLSj verifies if Tm−Tc<ΔT?, if the condition is true then fetch IDm corresponding to PIDm and compute Xm∗=hIDmXLS, R1=Z1⊕IDm⊕hXm∗Tm, IDc=Z2⊕R1⊕IDm⊕hXm∗Tm, MUS∗=hIDmIDchXm∗TmR1Tm and check if MUS∗=?ZUS is true. If true pick R2, TCS, and PIDmnew, fetches KC and calculate TEMP1=hIDm⊕R1, Z3=R2⊕hXm∗Tcs⊕TEMP1, Z4=PIDmnew⊕hXm∗Tcs⊕TEMP1, Z5=KC⊕hXm∗Tcs⊕R2⊕TEMP1, ZSU=hIDmhXm∗TcsKCR2R2,TEMP1Tcs. Replace PIDm with PIDmnew, and send the message containing Z3,Z4,Z5,ZSU,Tcs to Um(LAuth 3)
after receiving the message fromLSj, Um check if Tcs−Tc<ΔT? the condition is true then calculates TEMP2=hIDm⊕R1, R2=Z3⊕hXmTcs⊕TEMP2, PIDmnew=Z4⊕hXmTcs⊕TEMP2, KC=Z5⊕hXmTcs⊕R2⊕TEMP2, MSU∗=hIDmhXmTcsKCR2TEMP2Tcs. Then, check if MSU∗=?ZSU, if the condition is true, then, calculate KEYDC∗=KC⊕hPWmRm and save KEYDC∗Figure 5
Proposed login and authentication scheme.


### 4.3. Password Change

If a valid user has lost/forgot his/her password then can change password by adopting the following steps:(PWD 1)
userUm enters new pair IDm∗,PWm∗ and engraves BIOm∗. Now, Um computes GenBIOm∗=Rm∗,Pm∗, and RPWm∗=hPWm∗Rm∗ and dispatches IDm∗,RPWm∗ to the mobile device(PWD 2)
upon receipt of the message mobile check ifZm∗=?hIDm∗PWm∗Rm∗, if true, it sends confirmation to the user Um(PWD 3)
Um chooses new password PWmnew and biometric BIOmnew and compute GenBIOmnew=Rmnew,Pmnew, and RPWmnew=hPWmnewRmnew(PWD 4)
Receiving the message mobile device calculatesXm=hIDmXLS and dmnew=Xm∗⊕hIDmRPWmnew and send Xm and PIDmnew(PWD 5)
Um computes PIDmnew′=PIDmnew⊕hPWmnewRmnew, Xmnew′=Xm⊕hPWmnewRmnew, Zm=hIDmPWmnewRmnew and update Xmnew′,PIDmnew′,Zm.


## 4.1. Registration Phase

To get access to the digital contents, a user must register himself/herself to be a legitimate user. Following are the steps as mentioned in Figure4 to be followed:Figure 4
Proposed user registration.RGD 3: the userUm picks the pair IDm,PWm and engraves BIOm. Now Um computes GenBIOm=Rm,Pm, and RPWm=hPWmRm and dispatches IDm,RPWm to license server LSj by using secure channelRGD 3: license serverLSj receiving the registration request by Um computes Xm=hIDmXLS, dm=Xm⊕hIDmRPWm, and saves IDm and PIDm in its database and reply the registration request message XmtoPIDm by using channelRGD 3:Um receives the message from LSj and computes PIDm′=PIDm⊕hPWmRm, Xm′=Xm⊕hPWmRm, Zm=hIDmPWmRm and stores Xm′,PID′m,Zm in the mobile device memory


## 4.2. Login and Authentication

Following steps as mentioned in Figure5 are executed to furnish login and authentication phase of the proposed scheme:
(LAuth 1)
Um inputs IDm, password PWm, imprints biometric BIOm, calculates Rm=RepBIOm,Pm, and checks if Zm=?hIDmPWmRm, and if the condition is true, then, select R1 and Tm and compute Xm=Xm′⊕hRmPWm, Z1=IDm⊕R1⊕hXm⊕Tm, Z2=IDc⊕R1⊕hXm⊕Tm, ZUS=hIDmIDchXmTmR1Tm and send the message containing Z1,Z2,ZUS,PIDm,Tm to the LSj(LAuth 2)
after receiving the messageLSj verifies if Tm−Tc<ΔT?, if the condition is true then fetch IDm corresponding to PIDm and compute Xm∗=hIDmXLS, R1=Z1⊕IDm⊕hXm∗Tm, IDc=Z2⊕R1⊕IDm⊕hXm∗Tm, MUS∗=hIDmIDchXm∗TmR1Tm and check if MUS∗=?ZUS is true. If true pick R2, TCS, and PIDmnew, fetches KC and calculate TEMP1=hIDm⊕R1, Z3=R2⊕hXm∗Tcs⊕TEMP1, Z4=PIDmnew⊕hXm∗Tcs⊕TEMP1, Z5=KC⊕hXm∗Tcs⊕R2⊕TEMP1, ZSU=hIDmhXm∗TcsKCR2R2,TEMP1Tcs. Replace PIDm with PIDmnew, and send the message containing Z3,Z4,Z5,ZSU,Tcs to Um(LAuth 3)
after receiving the message fromLSj, Um check if Tcs−Tc<ΔT? the condition is true then calculates TEMP2=hIDm⊕R1, R2=Z3⊕hXmTcs⊕TEMP2, PIDmnew=Z4⊕hXmTcs⊕TEMP2, KC=Z5⊕hXmTcs⊕R2⊕TEMP2, MSU∗=hIDmhXmTcsKCR2TEMP2Tcs. Then, check if MSU∗=?ZSU, if the condition is true, then, calculate KEYDC∗=KC⊕hPWmRm and save KEYDC∗Figure 5
Proposed login and authentication scheme.


## 4.3. Password Change

If a valid user has lost/forgot his/her password then can change password by adopting the following steps:(PWD 1)
userUm enters new pair IDm∗,PWm∗ and engraves BIOm∗. Now, Um computes GenBIOm∗=Rm∗,Pm∗, and RPWm∗=hPWm∗Rm∗ and dispatches IDm∗,RPWm∗ to the mobile device(PWD 2)
upon receipt of the message mobile check ifZm∗=?hIDm∗PWm∗Rm∗, if true, it sends confirmation to the user Um(PWD 3)
Um chooses new password PWmnew and biometric BIOmnew and compute GenBIOmnew=Rmnew,Pmnew, and RPWmnew=hPWmnewRmnew(PWD 4)
Receiving the message mobile device calculatesXm=hIDmXLS and dmnew=Xm∗⊕hIDmRPWmnew and send Xm and PIDmnew(PWD 5)
Um computes PIDmnew′=PIDmnew⊕hPWmnewRmnew, Xmnew′=Xm⊕hPWmnewRmnew, Zm=hIDmPWmnewRmnew and update Xmnew′,PIDmnew′,Zm.


## 5. The Security Analysis

To describe the security of the proposed scheme, we have scrutinized the scheme through formal and informal security analysis in the following subsections.


### 5.1. Authentication Proof Based on the Burrows–Abadi–Needham Logic (BAN Logic)

The security of the proposed scheme is formally analyzed in the standard model using the widely accepted Burrows–Abadi–Needham logic [24].


#### 5.1.1. Postulates for BAN Logic

Some of the logical postulates of BAN logic and the meaning related to the postulates are given below in Table2.Table 2
Postulates for BAN logic.
A∣≡A⟷KY,A⊲<B>K/A∣≡Y∣~KMessage-meaning ruleA∣≡#B,A∣≡Y∣~B/A∣≡Y∣~KNonce-verification ruleA∣≡B,A∣≡C/A∣≡B,CBelief ruleA∣≡#B,A∣≡C/A∣≡#B,CFresh conjuncatenation ruleA∣≡Y⟹B,A∣≡Y∣~B/A∣≡BJurisdiction rule


#### 5.1.2. Security Goal Establishment

Established security goals and logical notations of the BAN logic are given below in Table3.Table 3
BAN logic notations.
A∣≡BA believes a statement BA⟷KYShare a keyK between A and Y#BB is freshA⊲BA sees BA~BA said BB,CKB,C is hashed by key KBKB is hashed with key K<B>KB is encrypted with key KG1: LSj≡R1G2: LSj≡Um≡R1G3: Um≡R2G4: Um≡LSj≡R2


#### 5.1.3. Proposed Schemes Idealized Form

(M1)
Um⟶LSj: IDm,IDc,R1Xm(M2)
LSj⟶Um: IDm,IDc,KC,R2Xm


#### 5.1.4. Assumptions

(A1)
LSj≡#R1(A2)
Um≡#R2(A3)
LSj≡LSj⟷XmUm(A4)
Um≡LSj⟷XmUm(A5)
LSj≡Um⟹R1(A6)
Um≡LSj⟶R2Step 1.
According to message 1:(2)P1:LSj⊲IDm,IDc,R1Xm.Step 2.
From the message meaning rule according to P1 and A3:(3)P2:LSj≡Um.Step 3.
According to the freshness rule with A1, we get(4)P3:LSj≡Um≡#IDm,IDc,R1Xm.Step 4.
From the nonce verification rule with P2 and P3, we get(5)P4:LSj≡Um≡IDm,IDc,R1Xm.Step 5.
According to the belief rule with P4, we get(6)P5:LSj≡Um≡R1Goal−X2.Step 6.
From the jurisdiction rule with P5 and A5, we get(7)P6:LSj≡R1Goal−X1.Step 7.
According to M2, we obtain(8)P7:Um⊲IDm,IDc,KCR2Xm.Step 8.
From the message meaning rule with P7 and A4, we get(9)P8:Um≡LSj≡IDm,IDc,KCR2Xm.Step 9.
According to the freshness rule with A2, we get(10)P9:Um≡LSj≡#IDm,IDc,KCR2Xm.Step 10.
From the nonce verification rule with P9 and P10, we get(11)P10:Um≡LSj≡IDm,IDc,KCR2Xm.Step 11.
According to the belief rule with P10, we get(12)P11:Um≡LSj≡R2Goal−X4.Step 12.
From the jurisdiction rule with P11 and A6, we get(13)P12:Um≡R2Goal−X3.According toGoal−X1 to Goal−X4, we proved that our scheme attains secure mutual authentication among Um and LSj.


### 5.2. Informal Security Analysis

To assess the security of the introduced scheme, also we have inspected the scheme through informal security analysis procedures.


#### 5.2.1. Mutual Authentication

Our proposed scheme provides mutual authentication by making verification on both sides of participating entities. License serverLSj receives the login request messages Msg1=Z1,Z2,ZUS,PIDm,Tm from Um, license server LSj verifies the authenticity of the user by verifying the M′US=?ZUS. If the condition is true, LSj authenticates Um and sends Z3,Z4,M5,ZSU,Tcs to Um. Um receives the response messages from LSj, Um verifies whether MSU′?=ZSU. If the condition is true, then, Um authenticates Sj; otherwise, terminates the request. Hence, the proposed scheme successfully achieves mutual authentication property.


#### 5.2.2. Replay Attack

Suppose thatA hijacks the messages Msg1=Z1,Z2,ZUS,PIDm,Tm and Msg2=Z3,Z4,Z5,ZUS,Tcs in a selective session and tries to replay these hijacked messages after a while. As it is evident that the all message contains current timestamps Tm and Tcs, the acceptance of the timeliness Tm and Tcs will be declined at the Um and LSj. Furthermore, ΔT value is fixed very small and due to which it will be very difficult for the attacker A to replay the hijacked messages within limit of the ΔT. Hence, the proposed scheme is stealth against the replay attack.


#### 5.2.3. Stolen Mobile Device Attack

Suppose thatA has stolen mobile device [25, 26] of user Um or Um has lost the mobile device due to some reason. Then, A can extract the credentials Xm′,PIDm′,Zm from mobile device memory using the power analysis attacks. After getting all these parameters, the attacker A will not be able to get useful parameters IDm and PWm, as these are protected through a collision-resistant hash function. Therefore, if any mobile device will be lost/stolen will not affect the proposed authentication mechanism.


#### 5.2.4. Anonymity and Untraceability

In the proposed scheme, all the messagesMsg1=Z1,Z2,ZUS,PIDm,Tm and Msg2=Z3,Z4,Z5,ZUS,Tcs in each session are explicit and nonrepeated, also all the message includes current timestamps Tm and Tcs, and random nonces R1 and R2. Hence, A will not be able to trace Um and LSj. Moreover, even any single message does not contain identities IDm and IDc. Hence, the anonymity [27, 28] is guaranteed in the proposed scheme.


#### 5.2.5. Denial-of-Service Attack

In the login and authentication phase, when a valid userUm inputs his/her identity IDm, password PWm, and imprints biometric BIOm into the mobile device. Mobile device retrieves the saved secret biometric key corresponding to BIOm as Rm=RepBIOm,Pm. Further mobile device computes Zm=hIDmPWmRm and checks if Zm values are the same or not. If the condition is not met, the session is terminated immediately, and in case of success, the session proceeds normally. Therefore, in case of denial-of-service attack [29, 30], the proposed scheme will resist it.


#### 5.2.6. Man-in-the-Middle Attack

In this type of attack,A grabs the messages being exchanged when the communication is taking place and tries to alter those messages to make other valid messages, to deceive the recipient from guessing the altered messages, and he/she considered these altered messages as normal as other original messages. Suppose A grabs the messages Msg1 and Msg2. Due to lack of the some parameters knowledge such as IDm, IDc,Xm, and KC, the attacker A will be unable to forge these messages Msg1 and Msg2. Hence, the proposed scheme opposes man-in-the-middle attack [31].


#### 5.2.7. User Impersonation Attack

Assume an attackerA tries to impersonate a message on behalf of a user Um to license server LSj. A gets/Xm′,PIDm′,Zm,h./ from mobile device and /Z1,Z2,ZUS,PIDm,Tm/ during the communication. At the moment, if A tries to construct message, but it will not possible as he/she does not know these parameters IDc,IDm, and Xm, due to which it will be hard to produce these for attacker.


#### 5.2.8. License Server Impersonation Attack

Assume an attackerA tries to impersonate a message on behalf of a license server LSj to user Um. A gets /Xm′,PIDm′,Zm,h./ from mobile device and /Z3,Z4,Z5,ZUS,Tcs/ during the communication. At the moment, if A tries to construct a reply message on the behalf of the license server LSj, but it will not possible as he/she does not know these parameters KC,IDm, and Xm, due to which it will be hard to produce these for an attacker. Hence, the proposed scheme is secure against impersonation attacks.


### 5.3. Automated Security Verification through ProVerif

The ProVerif is an automated security verification tool utilized to visualize the key agreement scheme to check mutual authentication and confidentiality of the session key among the participant entities of the authentication scheme [32–34]. To verify the security of the proposed scheme, we have simulated and verified it through ProVerif. For the sake of the experiment, we have used two events Ui and LSj to check the authentication codes of each entity, respectively. The participant Um uses two events, which are beginUi(bitstring) and endUi(bitstring) to authenticate the license server LSj. Similarly, the beginSj(bitstring) and endSj(bitstring) events are used by the license server to authenticate the user Um. The outcomes of the queries executed show that both participants are successfully communicating with each other. The simulation results are shown in Figure 6, which exhibits that the mutual authentication is successful and communication between the valid participants is secure from the reach of any potential attacker A.Figure 6
ProVerif simulations.


## 5.1. Authentication Proof Based on the Burrows–Abadi–Needham Logic (BAN Logic)

The security of the proposed scheme is formally analyzed in the standard model using the widely accepted Burrows–Abadi–Needham logic [24].


### 5.1.1. Postulates for BAN Logic

Some of the logical postulates of BAN logic and the meaning related to the postulates are given below in Table2.Table 2
Postulates for BAN logic.
A∣≡A⟷KY,A⊲<B>K/A∣≡Y∣~KMessage-meaning ruleA∣≡#B,A∣≡Y∣~B/A∣≡Y∣~KNonce-verification ruleA∣≡B,A∣≡C/A∣≡B,CBelief ruleA∣≡#B,A∣≡C/A∣≡#B,CFresh conjuncatenation ruleA∣≡Y⟹B,A∣≡Y∣~B/A∣≡BJurisdiction rule


### 5.1.2. Security Goal Establishment

Established security goals and logical notations of the BAN logic are given below in Table3.Table 3
BAN logic notations.
A∣≡BA believes a statement BA⟷KYShare a keyK between A and Y#BB is freshA⊲BA sees BA~BA said BB,CKB,C is hashed by key KBKB is hashed with key K<B>KB is encrypted with key KG1: LSj≡R1G2: LSj≡Um≡R1G3: Um≡R2G4: Um≡LSj≡R2


### 5.1.3. Proposed Schemes Idealized Form

(M1)
Um⟶LSj: IDm,IDc,R1Xm(M2)
LSj⟶Um: IDm,IDc,KC,R2Xm


### 5.1.4. Assumptions

(A1)
LSj≡#R1(A2)
Um≡#R2(A3)
LSj≡LSj⟷XmUm(A4)
Um≡LSj⟷XmUm(A5)
LSj≡Um⟹R1(A6)
Um≡LSj⟶R2Step 1.
According to message 1:(2)P1:LSj⊲IDm,IDc,R1Xm.Step 2.
From the message meaning rule according to P1 and A3:(3)P2:LSj≡Um.Step 3.
According to the freshness rule with A1, we get(4)P3:LSj≡Um≡#IDm,IDc,R1Xm.Step 4.
From the nonce verification rule with P2 and P3, we get(5)P4:LSj≡Um≡IDm,IDc,R1Xm.Step 5.
According to the belief rule with P4, we get(6)P5:LSj≡Um≡R1Goal−X2.Step 6.
From the jurisdiction rule with P5 and A5, we get(7)P6:LSj≡R1Goal−X1.Step 7.
According to M2, we obtain(8)P7:Um⊲IDm,IDc,KCR2Xm.Step 8.
From the message meaning rule with P7 and A4, we get(9)P8:Um≡LSj≡IDm,IDc,KCR2Xm.Step 9.
According to the freshness rule with A2, we get(10)P9:Um≡LSj≡#IDm,IDc,KCR2Xm.Step 10.
From the nonce verification rule with P9 and P10, we get(11)P10:Um≡LSj≡IDm,IDc,KCR2Xm.Step 11.
According to the belief rule with P10, we get(12)P11:Um≡LSj≡R2Goal−X4.Step 12.
From the jurisdiction rule with P11 and A6, we get(13)P12:Um≡R2Goal−X3.According toGoal−X1 to Goal−X4, we proved that our scheme attains secure mutual authentication among Um and LSj.


## 5.1.1. Postulates for BAN Logic

Some of the logical postulates of BAN logic and the meaning related to the postulates are given below in Table2.Table 2
Postulates for BAN logic.
A∣≡A⟷KY,A⊲<B>K/A∣≡Y∣~KMessage-meaning ruleA∣≡#B,A∣≡Y∣~B/A∣≡Y∣~KNonce-verification ruleA∣≡B,A∣≡C/A∣≡B,CBelief ruleA∣≡#B,A∣≡C/A∣≡#B,CFresh conjuncatenation ruleA∣≡Y⟹B,A∣≡Y∣~B/A∣≡BJurisdiction rule


## 5.1.2. Security Goal Establishment

Established security goals and logical notations of the BAN logic are given below in Table3.Table 3
BAN logic notations.
A∣≡BA believes a statement BA⟷KYShare a keyK between A and Y#BB is freshA⊲BA sees BA~BA said BB,CKB,C is hashed by key KBKB is hashed with key K<B>KB is encrypted with key KG1: LSj≡R1G2: LSj≡Um≡R1G3: Um≡R2G4: Um≡LSj≡R2


## 5.1.3. Proposed Schemes Idealized Form

(M1)
Um⟶LSj: IDm,IDc,R1Xm(M2)
LSj⟶Um: IDm,IDc,KC,R2Xm


## 5.1.4. Assumptions

(A1)
LSj≡#R1(A2)
Um≡#R2(A3)
LSj≡LSj⟷XmUm(A4)
Um≡LSj⟷XmUm(A5)
LSj≡Um⟹R1(A6)
Um≡LSj⟶R2Step 1.
According to message 1:(2)P1:LSj⊲IDm,IDc,R1Xm.Step 2.
From the message meaning rule according to P1 and A3:(3)P2:LSj≡Um.Step 3.
According to the freshness rule with A1, we get(4)P3:LSj≡Um≡#IDm,IDc,R1Xm.Step 4.
From the nonce verification rule with P2 and P3, we get(5)P4:LSj≡Um≡IDm,IDc,R1Xm.Step 5.
According to the belief rule with P4, we get(6)P5:LSj≡Um≡R1Goal−X2.Step 6.
From the jurisdiction rule with P5 and A5, we get(7)P6:LSj≡R1Goal−X1.Step 7.
According to M2, we obtain(8)P7:Um⊲IDm,IDc,KCR2Xm.Step 8.
From the message meaning rule with P7 and A4, we get(9)P8:Um≡LSj≡IDm,IDc,KCR2Xm.Step 9.
According to the freshness rule with A2, we get(10)P9:Um≡LSj≡#IDm,IDc,KCR2Xm.Step 10.
From the nonce verification rule with P9 and P10, we get(11)P10:Um≡LSj≡IDm,IDc,KCR2Xm.Step 11.
According to the belief rule with P10, we get(12)P11:Um≡LSj≡R2Goal−X4.Step 12.
From the jurisdiction rule with P11 and A6, we get(13)P12:Um≡R2Goal−X3.According toGoal−X1 to Goal−X4, we proved that our scheme attains secure mutual authentication among Um and LSj.


## 5.2. Informal Security Analysis

To assess the security of the introduced scheme, also we have inspected the scheme through informal security analysis procedures.


### 5.2.1. Mutual Authentication

Our proposed scheme provides mutual authentication by making verification on both sides of participating entities. License serverLSj receives the login request messages Msg1=Z1,Z2,ZUS,PIDm,Tm from Um, license server LSj verifies the authenticity of the user by verifying the M′US=?ZUS. If the condition is true, LSj authenticates Um and sends Z3,Z4,M5,ZSU,Tcs to Um. Um receives the response messages from LSj, Um verifies whether MSU′?=ZSU. If the condition is true, then, Um authenticates Sj; otherwise, terminates the request. Hence, the proposed scheme successfully achieves mutual authentication property.


### 5.2.2. Replay Attack

Suppose thatA hijacks the messages Msg1=Z1,Z2,ZUS,PIDm,Tm and Msg2=Z3,Z4,Z5,ZUS,Tcs in a selective session and tries to replay these hijacked messages after a while. As it is evident that the all message contains current timestamps Tm and Tcs, the acceptance of the timeliness Tm and Tcs will be declined at the Um and LSj. Furthermore, ΔT value is fixed very small and due to which it will be very difficult for the attacker A to replay the hijacked messages within limit of the ΔT. Hence, the proposed scheme is stealth against the replay attack.


### 5.2.3. Stolen Mobile Device Attack

Suppose thatA has stolen mobile device [25, 26] of user Um or Um has lost the mobile device due to some reason. Then, A can extract the credentials Xm′,PIDm′,Zm from mobile device memory using the power analysis attacks. After getting all these parameters, the attacker A will not be able to get useful parameters IDm and PWm, as these are protected through a collision-resistant hash function. Therefore, if any mobile device will be lost/stolen will not affect the proposed authentication mechanism.


### 5.2.4. Anonymity and Untraceability

In the proposed scheme, all the messagesMsg1=Z1,Z2,ZUS,PIDm,Tm and Msg2=Z3,Z4,Z5,ZUS,Tcs in each session are explicit and nonrepeated, also all the message includes current timestamps Tm and Tcs, and random nonces R1 and R2. Hence, A will not be able to trace Um and LSj. Moreover, even any single message does not contain identities IDm and IDc. Hence, the anonymity [27, 28] is guaranteed in the proposed scheme.


### 5.2.5. Denial-of-Service Attack

In the login and authentication phase, when a valid userUm inputs his/her identity IDm, password PWm, and imprints biometric BIOm into the mobile device. Mobile device retrieves the saved secret biometric key corresponding to BIOm as Rm=RepBIOm,Pm. Further mobile device computes Zm=hIDmPWmRm and checks if Zm values are the same or not. If the condition is not met, the session is terminated immediately, and in case of success, the session proceeds normally. Therefore, in case of denial-of-service attack [29, 30], the proposed scheme will resist it.


### 5.2.6. Man-in-the-Middle Attack

In this type of attack,A grabs the messages being exchanged when the communication is taking place and tries to alter those messages to make other valid messages, to deceive the recipient from guessing the altered messages, and he/she considered these altered messages as normal as other original messages. Suppose A grabs the messages Msg1 and Msg2. Due to lack of the some parameters knowledge such as IDm, IDc,Xm, and KC, the attacker A will be unable to forge these messages Msg1 and Msg2. Hence, the proposed scheme opposes man-in-the-middle attack [31].


### 5.2.7. User Impersonation Attack

Assume an attackerA tries to impersonate a message on behalf of a user Um to license server LSj. A gets/Xm′,PIDm′,Zm,h./ from mobile device and /Z1,Z2,ZUS,PIDm,Tm/ during the communication. At the moment, if A tries to construct message, but it will not possible as he/she does not know these parameters IDc,IDm, and Xm, due to which it will be hard to produce these for attacker.


### 5.2.8. License Server Impersonation Attack

Assume an attackerA tries to impersonate a message on behalf of a license server LSj to user Um. A gets /Xm′,PIDm′,Zm,h./ from mobile device and /Z3,Z4,Z5,ZUS,Tcs/ during the communication. At the moment, if A tries to construct a reply message on the behalf of the license server LSj, but it will not possible as he/she does not know these parameters KC,IDm, and Xm, due to which it will be hard to produce these for an attacker. Hence, the proposed scheme is secure against impersonation attacks.


## 5.2.1. Mutual Authentication

Our proposed scheme provides mutual authentication by making verification on both sides of participating entities. License serverLSj receives the login request messages Msg1=Z1,Z2,ZUS,PIDm,Tm from Um, license server LSj verifies the authenticity of the user by verifying the M′US=?ZUS. If the condition is true, LSj authenticates Um and sends Z3,Z4,M5,ZSU,Tcs to Um. Um receives the response messages from LSj, Um verifies whether MSU′?=ZSU. If the condition is true, then, Um authenticates Sj; otherwise, terminates the request. Hence, the proposed scheme successfully achieves mutual authentication property.


## 5.2.2. Replay Attack

Suppose thatA hijacks the messages Msg1=Z1,Z2,ZUS,PIDm,Tm and Msg2=Z3,Z4,Z5,ZUS,Tcs in a selective session and tries to replay these hijacked messages after a while. As it is evident that the all message contains current timestamps Tm and Tcs, the acceptance of the timeliness Tm and Tcs will be declined at the Um and LSj. Furthermore, ΔT value is fixed very small and due to which it will be very difficult for the attacker A to replay the hijacked messages within limit of the ΔT. Hence, the proposed scheme is stealth against the replay attack.


## 5.2.3. Stolen Mobile Device Attack

Suppose thatA has stolen mobile device [25, 26] of user Um or Um has lost the mobile device due to some reason. Then, A can extract the credentials Xm′,PIDm′,Zm from mobile device memory using the power analysis attacks. After getting all these parameters, the attacker A will not be able to get useful parameters IDm and PWm, as these are protected through a collision-resistant hash function. Therefore, if any mobile device will be lost/stolen will not affect the proposed authentication mechanism.


## 5.2.4. Anonymity and Untraceability

In the proposed scheme, all the messagesMsg1=Z1,Z2,ZUS,PIDm,Tm and Msg2=Z3,Z4,Z5,ZUS,Tcs in each session are explicit and nonrepeated, also all the message includes current timestamps Tm and Tcs, and random nonces R1 and R2. Hence, A will not be able to trace Um and LSj. Moreover, even any single message does not contain identities IDm and IDc. Hence, the anonymity [27, 28] is guaranteed in the proposed scheme.


## 5.2.5. Denial-of-Service Attack

In the login and authentication phase, when a valid userUm inputs his/her identity IDm, password PWm, and imprints biometric BIOm into the mobile device. Mobile device retrieves the saved secret biometric key corresponding to BIOm as Rm=RepBIOm,Pm. Further mobile device computes Zm=hIDmPWmRm and checks if Zm values are the same or not. If the condition is not met, the session is terminated immediately, and in case of success, the session proceeds normally. Therefore, in case of denial-of-service attack [29, 30], the proposed scheme will resist it.


## 5.2.6. Man-in-the-Middle Attack

In this type of attack,A grabs the messages being exchanged when the communication is taking place and tries to alter those messages to make other valid messages, to deceive the recipient from guessing the altered messages, and he/she considered these altered messages as normal as other original messages. Suppose A grabs the messages Msg1 and Msg2. Due to lack of the some parameters knowledge such as IDm, IDc,Xm, and KC, the attacker A will be unable to forge these messages Msg1 and Msg2. Hence, the proposed scheme opposes man-in-the-middle attack [31].


## 5.2.7. User Impersonation Attack

Assume an attackerA tries to impersonate a message on behalf of a user Um to license server LSj. A gets/Xm′,PIDm′,Zm,h./ from mobile device and /Z1,Z2,ZUS,PIDm,Tm/ during the communication. At the moment, if A tries to construct message, but it will not possible as he/she does not know these parameters IDc,IDm, and Xm, due to which it will be hard to produce these for attacker.


## 5.2.8. License Server Impersonation Attack

Assume an attackerA tries to impersonate a message on behalf of a license server LSj to user Um. A gets /Xm′,PIDm′,Zm,h./ from mobile device and /Z3,Z4,Z5,ZUS,Tcs/ during the communication. At the moment, if A tries to construct a reply message on the behalf of the license server LSj, but it will not possible as he/she does not know these parameters KC,IDm, and Xm, due to which it will be hard to produce these for an attacker. Hence, the proposed scheme is secure against impersonation attacks.


## 5.3. Automated Security Verification through ProVerif

The ProVerif is an automated security verification tool utilized to visualize the key agreement scheme to check mutual authentication and confidentiality of the session key among the participant entities of the authentication scheme [32–34]. To verify the security of the proposed scheme, we have simulated and verified it through ProVerif. For the sake of the experiment, we have used two events Ui and LSj to check the authentication codes of each entity, respectively. The participant Um uses two events, which are beginUi(bitstring) and endUi(bitstring) to authenticate the license server LSj. Similarly, the beginSj(bitstring) and endSj(bitstring) events are used by the license server to authenticate the user Um. The outcomes of the queries executed show that both participants are successfully communicating with each other. The simulation results are shown in Figure 6, which exhibits that the mutual authentication is successful and communication between the valid participants is secure from the reach of any potential attacker A.Figure 6
ProVerif simulations.


## 6. The Comparisons

This section provides security attributes and performance comparisons among proposed and relevant schemes [10, 13, 14], in the corresponding subsections produced below.


### 6.1. Security Attributes

This subsection provides the security attribute comparisons of the proposed with relevant schemes presented in [10, 13, 14]. The comparisons of the proposed with recent, related, and compered schemes [10, 13, 14] are depicted in Table 4. Referring to Table 4, all the compared proposals [10, 13, 14] are deficient of at least one security attribute. As per Table 4, the scheme of Mishra et al. [10] is already argued in [14] that it does not provide mutual authentication and resistance to impersonation. Moreover, the scheme of [10] is prone to theft/stolen mobile device attacks. The scheme of Yu et al. [14] does not provide anonymity of the mobile/user. Similarly, in this paper, we proved that the scheme of Yu et al. [14] has incorrect login and authentication phase, which can work with only one user, and it has weaknesses against privileged insider and impersonation attacks and due to these crucial issues, it cannot extend mutual authentication among a user and a license server.Table 4
Security features.
Schemes⟶↓attributesOur[13][10]PMA✓✗✓✗PUA✓✓✗✓PUS✓✗✓✓RRA✓✓✓✓RSD✓✓✓✗RIA✓✗✓✗RMA✓✓✓✓PPF✓✓✓✓ROP✓✓✓✓RPI✓✗✓✓Note: PMA: provides mutual authentication; PUA: provides user anonymity/untrability; PSU: provides user scalability; RRA: resists replay attack; RSD: resists stolen mobile device; RIA: resists impersonation attack; RMA: resists man in middle attack; PPF: provides perfect forward secrecy; ROP: resists offline password guessing; RPI: resists privileged insider attack; ✓: provides; ✗: not provides.


### 6.2. Computation Cost

For computation cost, we consider the experiment executed through the MIRACL library over a mobile phone Redmo-Note-v8 with 4 GB RAM and octa-coreμ processor with 2.01 GHz. The operating system underlying Redmo-Note-v8 is v-9-Andriod-MIUI-V:11.0.7. Moreover, to simulate a license server, we consider the running time computed over an HP:Elite-Book: P-8460 μ processor with 2.7 GHz Intel-R-Core TM with 4 GB RAM and over LTS-16 Ubuntu-OS. Here, we denote Th for the execution time of a hash operation and Tbh for computation of a biohash/fuzzy extraction operation. The Th≈0.009 for mobile device and Th≈0.004 for license server. Likewise, Tf≈0.16 over the mobile device. To complete a round of authentication in the proposed DRM scheme, the user Um executes 9Th+1Tf operations, the server LSj executes 6Th, and the whole process completes in ≈0.265 ms. The scheme of Yu et al. [14] completes the same in ≈0.213 ms. Likewise, in the scheme of Lee et al. [13], the Um and LSj compute execution of a round in ≈0.216 ms, and the scheme of Mishra et al. [10] completes the process in ≈0.243 ms. The proposed scheme has a slightly higher computation cost. However, only the proposed scheme provides the required security features.


### 6.3. Communication Cost

The proposed and the relevant scheme are mainly based on hash functions in addition to an exclusive-or. We adopted SHA-1 whose length is 160 bits, all other parameters including identities, pseudoidentities, timestamps, and passwords are fixed at 32 bit-size. In proposed, the user initiates the request by sendingZ1,Z2,ZUS,PIDm,Tm, and the size of request message is 160+160+160+32+32=544 bits. The response message sent by server Z3,Z4,Z5,ZUS,Tcs has the size 160+160+160+160+32=672. Therefore, the total communication cost of the proposed scheme is 1216 bits. The communication costs of the schemes of Yu et al. [14], Lee et al. [13], and Mishra et al. [10] are 1120 bits, 1120 bits, and 832 bits, respectively. The computation and communication costs along with running times of each of the proposed and schemes of Yu et al., Lee et al., and Mishra et al. are also depicted in Table 5.Table 5
Performance comparisons.
ProtocolUmLSjRT-msB.EMishra et al. [10]7Th+1Tf5Th≈0.243832Lee et al. [13]4Th+1Tf5Th≈0.2161120Yu et al. [14]5Th+1Tf2Th≈0.2131120Proposed9Th+1Tf6Th≈0.2651216Note: RT: running time in milliseconds; B.E: bit exchanges.


## 6.1. Security Attributes

This subsection provides the security attribute comparisons of the proposed with relevant schemes presented in [10, 13, 14]. The comparisons of the proposed with recent, related, and compered schemes [10, 13, 14] are depicted in Table 4. Referring to Table 4, all the compared proposals [10, 13, 14] are deficient of at least one security attribute. As per Table 4, the scheme of Mishra et al. [10] is already argued in [14] that it does not provide mutual authentication and resistance to impersonation. Moreover, the scheme of [10] is prone to theft/stolen mobile device attacks. The scheme of Yu et al. [14] does not provide anonymity of the mobile/user. Similarly, in this paper, we proved that the scheme of Yu et al. [14] has incorrect login and authentication phase, which can work with only one user, and it has weaknesses against privileged insider and impersonation attacks and due to these crucial issues, it cannot extend mutual authentication among a user and a license server.Table 4
Security features.
Schemes⟶↓attributesOur[13][10]PMA✓✗✓✗PUA✓✓✗✓PUS✓✗✓✓RRA✓✓✓✓RSD✓✓✓✗RIA✓✗✓✗RMA✓✓✓✓PPF✓✓✓✓ROP✓✓✓✓RPI✓✗✓✓Note: PMA: provides mutual authentication; PUA: provides user anonymity/untrability; PSU: provides user scalability; RRA: resists replay attack; RSD: resists stolen mobile device; RIA: resists impersonation attack; RMA: resists man in middle attack; PPF: provides perfect forward secrecy; ROP: resists offline password guessing; RPI: resists privileged insider attack; ✓: provides; ✗: not provides.


## 6.2. Computation Cost

For computation cost, we consider the experiment executed through the MIRACL library over a mobile phone Redmo-Note-v8 with 4 GB RAM and octa-coreμ processor with 2.01 GHz. The operating system underlying Redmo-Note-v8 is v-9-Andriod-MIUI-V:11.0.7. Moreover, to simulate a license server, we consider the running time computed over an HP:Elite-Book: P-8460 μ processor with 2.7 GHz Intel-R-Core TM with 4 GB RAM and over LTS-16 Ubuntu-OS. Here, we denote Th for the execution time of a hash operation and Tbh for computation of a biohash/fuzzy extraction operation. The Th≈0.009 for mobile device and Th≈0.004 for license server. Likewise, Tf≈0.16 over the mobile device. To complete a round of authentication in the proposed DRM scheme, the user Um executes 9Th+1Tf operations, the server LSj executes 6Th, and the whole process completes in ≈0.265 ms. The scheme of Yu et al. [14] completes the same in ≈0.213 ms. Likewise, in the scheme of Lee et al. [13], the Um and LSj compute execution of a round in ≈0.216 ms, and the scheme of Mishra et al. [10] completes the process in ≈0.243 ms. The proposed scheme has a slightly higher computation cost. However, only the proposed scheme provides the required security features.


## 6.3. Communication Cost

The proposed and the relevant scheme are mainly based on hash functions in addition to an exclusive-or. We adopted SHA-1 whose length is 160 bits, all other parameters including identities, pseudoidentities, timestamps, and passwords are fixed at 32 bit-size. In proposed, the user initiates the request by sendingZ1,Z2,ZUS,PIDm,Tm, and the size of request message is 160+160+160+32+32=544 bits. The response message sent by server Z3,Z4,Z5,ZUS,Tcs has the size 160+160+160+160+32=672. Therefore, the total communication cost of the proposed scheme is 1216 bits. The communication costs of the schemes of Yu et al. [14], Lee et al. [13], and Mishra et al. [10] are 1120 bits, 1120 bits, and 832 bits, respectively. The computation and communication costs along with running times of each of the proposed and schemes of Yu et al., Lee et al., and Mishra et al. are also depicted in Table 5.Table 5
Performance comparisons.
ProtocolUmLSjRT-msB.EMishra et al. [10]7Th+1Tf5Th≈0.243832Lee et al. [13]4Th+1Tf5Th≈0.2161120Yu et al. [14]5Th+1Tf2Th≈0.2131120Proposed9Th+1Tf6Th≈0.2651216Note: RT: running time in milliseconds; B.E: bit exchanges.


## 7. Conclusion

In this paper, we first reviewed and then cryptanalyzed a recent authentication scheme presented by Yu et al. for digital rights management systems (DRM-S). We have proven that the scheme of Yu et al. lacks scalability due to faulty design and is prone to privileged insiders and impersonation attacks. Based on the only symmetric hash function and xor, an improved scheme of DRM-S is then proposed. The proposed scheme can cope with the changing security requirements of the DRM-S, which is proved through formal BAN and informal textual explanations. The proposed DRM-S authentication scheme completes the process of authentication among a user and a license server in0.265 ms and by exchanging 1216 bits among a user and a license server.



---

*Source: 1041880-2022-01-27.xml*