# Improving an Anonymous and Provably Secure Authentication Protocol for a Mobile User

Authors: Jongho Moon; Youngsook Lee; Jiye Kim; Dongho Won
Journal: Security and Communication Networks
 (2017)

---

## Abstract

Recently many authentication protocols using an extended chaotic map were suggested for a mobile user. Many researchers demonstrated that authentication protocol needs to provide key agreement, mutual authentication, and user anonymity between mobile user and server and resilience to many possible attacks. In this paper, we cautiously analyzed chaotic-map-based authentication scheme and proved that it is still insecure to off-line identity guessing, user and server impersonation, and on-line identity guessing attacks. To address these vulnerabilities, we proposed an improved protocol based on an extended chaotic map and a fuzzy extractor. We proved the security of the proposed protocol using a random oracle and AVISPA (Automated Validation of Internet Security Protocols and Applications) tool. Furthermore, we present an informal security analysis to make sure that the improved protocol is invulnerable to possible attacks. The proposed protocol is also computationally efficient when compared to other previous protocols.


---

## Body

## 1. Introduction

Given recent developments in mobile telecommunications and the rapid spread of mobile devices, there is a growing importance of wireless and wired networking services that utilize bygone and current positional information from users carrying mobile devices with location tracking capabilities [1]. Remote user authentication schemes typically verify registered credentials using stored databases. Since Lamport [2] presented the first authentication scheme based on passwords in 1981, various remote user authentication schemes [3, 4] based on passwords have been proposed. However, since a server under a password-based remote user authentication protocol needs to store a verification table, which stores the password to determine the credentials of a remote user, the server arranges for extra storage for the verification table. Furthermore, several studies have shown that password-based remote user authentication protocols are insecure against some attacks, including off-line password guessing or stolen smart card attacks [5–7]. The problem with password-based authentication scheme is that it can be easily stolen or lost and making it difficult to remember on a regular basis. For these reasons, many researchers have presented new remote user authentication protocols that use biometrics. A major characteristic of biometrics is it uniqueness. Other advantage is that it cannot be guessed or stolen. Biological characteristics have been used in numerous remote user authentication schemes [8–13].To design a secure authentication scheme, some cryptographic algorithms are also used, such as an RSA cryptosystem [14, 15], elliptic curve cryptography [16, 17], hash function [18, 19], and chaos-based cryptography [20–22].Recently, many chaos-based authentication protocols have been suggested. Xiao et al. [23] first presented a user authentication protocol using a chaotic map and claimed that their protocol is useful and suitable for serviceable implementations. Unfortunately, many attacks were demonstrated by Han [31]. To overcome these vulnerabilities in [23], Han et al. [24] presented an enhanced user authentication protocol using chaos and asserted that their protocol resists all possible attacks. After that, Niu and Wang [32] proved that Han et al.’s protocol is vulnerable against an insider attack. Furthermore, Yoon [33] demonstrated that Niu and Wang’s protocol does not resist a denial-of-service (DoS) attack. After that, Xue and Hong [34] proposed an improved authentication and key agreement protocol using a chaotic map to improve the security to some possible attacks. Unfortunately, Tan [35] found that Xue and Hong’s protocol does not resist a man-in-the-middle attack. Lee et al. [25] presented an improved chaotic map-based authentication protocol, and He et al. [29] proved that Lee et al.’s protocol does not resist DoS and insider attacks. To enhance the functionality and security, Lin [26] proposed a new authentication and key agreement protocol using a chaotic map and dynamic identity. Unfortunately, Islam et al. [27] found that Lin’s protocol cannot resist well-known attacks, and proposed an enhanced authentication protocol. However, we found that Islam et al.’s protocol is still insecure against off-line identity guessing, impersonation, and on-line identity guessing attacks.The remainder of this paper is organized as follows. We briefly introduce the Chebyshev chaotic maps, threat assumptions, and fuzzy extractor that we adopt in the proposed protocol in Section2. In Sections 3 and 4, we, respectively, review and cryptanalyze Islam et al.’s protocol. In Section 5, we propose an improved authentication and key agreement protocol for a mobile user. In Section 6, we present a security analysis of the proposed protocol. Section 7 explains the functionality and performance analyses comparing the proposed protocol to previous protocols. The conclusions are presented in Section 8.


### 1.1. Our Contribution

To address the security vulnerabilities in Islam et al.’s authentication protocol and obtain the required performance, we propose a security-improved scheme. The primary contribution of this paper are described below.(i)
First, we prove that Islam et al.’s protocol is still vulnerable to some attacks, and we show how an adversary can impersonate a legitimate user or server.(ii)
Second, we suggest an improved biometrics-based authentication and key agreement protocol on Islam et al.’s protocol. The improved protocol is designed to be secure to well-known attacks.(iii)
Third, we analyze that the proposed protocol has better robustness and a lower computational cost with a performance analysis.


## 1.1. Our Contribution

To address the security vulnerabilities in Islam et al.’s authentication protocol and obtain the required performance, we propose a security-improved scheme. The primary contribution of this paper are described below.(i)
First, we prove that Islam et al.’s protocol is still vulnerable to some attacks, and we show how an adversary can impersonate a legitimate user or server.(ii)
Second, we suggest an improved biometrics-based authentication and key agreement protocol on Islam et al.’s protocol. The improved protocol is designed to be secure to well-known attacks.(iii)
Third, we analyze that the proposed protocol has better robustness and a lower computational cost with a performance analysis.


## 2. Preliminaries

We briefly introduce the Chebyshev chaotic maps [28, 36], threat assumptions, and fuzzy extractor.


### 2.1. Chebyshev Chaotic Maps

The Chebyshev polynomialTk(v) is a v polynomial of degree k.Definition 1.
Letk be a whole number and w be a real number from the round [-1, 1]; the Chebyshev polynomial of degree k is then defined as Tk(v)=cos⁡(k·arccos⁡(v)).Definition 2 (CMDLP).
Given the two parametersv, w∈Zn∗, the Chaotic Maps Discrete Logarithm Problem is whether integer k can be found such that w=Tk(v). The probability of E being able to address the CMDLP is defined as Pr[E(v,w)=k:k∈Zn∗,w=Tkvmod⁡n].Definition 3 (CMDHP).
Given the three elementsv, Tj(v), and Tk(v), the Chaotic Maps Diffie-Hellman Problem is whether Tjk(v) can be computed such that Tjk(v)=Tj(Tk(v))=Tk(Tj(v)).


### 2.2. Threat Assumptions

We introduce some threat model [37, 38] and consider constructing the threat assumptions described as follows:(i)
AdversaryE can be both a user or server. Any registered mobile user can act as an adversary.(ii)
E can intercept all messages in a public channel, thereby capturing any message exchanged between a user or server.(iii)
E has the ability to modify, reroute, or delete the captured message.(iv)
Stored parameters can be extracted from the mobile device.


### 2.3. Fuzzy Extractor

In this subsection, we describe the basis for a biometric-based fuzzy extractor that converts biometric information data into a random value. Based on [39–41], the fuzzy extractor is operated through two procedures (Gen, Rep), demonstrated as(i)
Gen(BIO)→α,β,(ii)
Rep(BIO∗, β)=α if BIO∗ is reasonably close to BIO.G
e
n is a probabilistic generation function for which the biometrics BIO returns an “extracted” string α∈0,1k and auxiliary string β∈0,1∗, and Rep is a deterministic reproduction function that enables the recovery of α from β and any vector BIO∗ close to BIO. Detailed information of the fuzzy extractor can be found in [42].


## 2.1. Chebyshev Chaotic Maps

The Chebyshev polynomialTk(v) is a v polynomial of degree k.Definition 1.
Letk be a whole number and w be a real number from the round [-1, 1]; the Chebyshev polynomial of degree k is then defined as Tk(v)=cos⁡(k·arccos⁡(v)).Definition 2 (CMDLP).
Given the two parametersv, w∈Zn∗, the Chaotic Maps Discrete Logarithm Problem is whether integer k can be found such that w=Tk(v). The probability of E being able to address the CMDLP is defined as Pr[E(v,w)=k:k∈Zn∗,w=Tkvmod⁡n].Definition 3 (CMDHP).
Given the three elementsv, Tj(v), and Tk(v), the Chaotic Maps Diffie-Hellman Problem is whether Tjk(v) can be computed such that Tjk(v)=Tj(Tk(v))=Tk(Tj(v)).


## 2.2. Threat Assumptions

We introduce some threat model [37, 38] and consider constructing the threat assumptions described as follows:(i)
AdversaryE can be both a user or server. Any registered mobile user can act as an adversary.(ii)
E can intercept all messages in a public channel, thereby capturing any message exchanged between a user or server.(iii)
E has the ability to modify, reroute, or delete the captured message.(iv)
Stored parameters can be extracted from the mobile device.


## 2.3. Fuzzy Extractor

In this subsection, we describe the basis for a biometric-based fuzzy extractor that converts biometric information data into a random value. Based on [39–41], the fuzzy extractor is operated through two procedures (Gen, Rep), demonstrated as(i)
Gen(BIO)→α,β,(ii)
Rep(BIO∗, β)=α if BIO∗ is reasonably close to BIO.G
e
n is a probabilistic generation function for which the biometrics BIO returns an “extracted” string α∈0,1k and auxiliary string β∈0,1∗, and Rep is a deterministic reproduction function that enables the recovery of α from β and any vector BIO∗ close to BIO. Detailed information of the fuzzy extractor can be found in [42].


## 3. Review of Islam et al.’s Protocol

We review Islam et al.’s protocol. Their protocol consists of registration, login, verification, and password change phases and uses an extended chaotic maps. The termTk(a) is the chaotic map computation that is calculated with respect to “mod⁡n” and a∈(-∞,+∞). The notations of this paper are illustrated in the Notations.


### 3.1. Registration Phase

(i)
UserUi selects the identity IDi and password PWi and inputs these values into the mobile devices MDi. MDi then chooses a random number t, calculates Wi=PWi⊕t, and sends IDi,Wi to server S over an insecure channel.
(ii)
Upon receivingIDi,Wi, server S computes Hi=h(s,IDi) and ni=h(Wi,IDi)⊕(Hi,Ts(Hi)) and sends ni to user Ui by using a secure channel.
(iii)
Upon receivingni, MDi retrieves Ni=ni⊕h(Wi,IDi)⊕h(IDi,PWi), (Hi,Ts(Hi))=Ni⊕h(IDi,PWi), and Xi=h(h(IDi,PWi)∥(Hi∥Ts(Hi)) and stores Ni,Xi into MDi.


### 3.2. Login Phase

(i)
UserUi enters IDi and PWi into MDi.
(ii)
M
D
i computes (Hi∥Ts(Hi))=Ni⊕h(IDi,PWi) and Xi′=h(h(IDi,PWi)∥(Hi∥Ts(Hi)). MDi then checks whether Xi′ is equal to Xi. If this holds, MDi executes the following stage; otherwise, MDi rejects the login request.
(iii)
M
D
i chooses a random number k and then computes Zi=Tk(Ts(Hi)) and CIDi=IDi⊕(Hi∥T1∥Zi), where Ci=Tk(Hi), Ri=Hi⊕Zi, Vi=h(CIDi,Zi,Hi,Ri,T1), and T1 is the current timestamp. MDi sends CIDi,Ci,Vi,Ri,T1 to server S by using a public channel.


### 3.3. Verification Phase

(i)
When receiving the request messageCIDi,Ci,Vi,Ri,T1 from user Ui, server S verifies freshness of timestamp T1 and terminates the session if (T2-T1)≤ΔT is false; otherwise, server S continues the next stage.
(ii)
S computes Zi=Ts(Ci), Hi=Ri⊕Zi, IDi=CIDi⊕(Hi∥T1∥Zi), and Vi′=h(CIDi,Zi,Hi,Ri,T1). S then rejects the session if Vi′≠Vi; otherwise, server S continues the following stage.
(iii)
S randomly chooses a number l and computes the session key λ=h(Hi,T1,T2,Tl(Ci)), and Vs=h(λ,Hi,T1,T2). S then sends the response messages Vs,T2,TlHi over an insecure channel.
(iv)
After receiving the response messageVs,T2,TlHi from server S at time T3, MDi checks the freshness of T2 and terminates the session if (T3-T2)≤ΔT is false; otherwise, MDie then computes λ=h(Hi,T1,T2,Tk(Tl(Hi))), and Vs′=h(λ,Hi,T1,T2). MDi next checks whether Vs′≟Vs. If this holds, MDi accepts λ as the session key and authenticates server S; otherwise, MDi rejects the session.


### 3.4. Password Change Phase

(i)
UserUi inputs IDi and PWi into the mobile device MDi.
(ii)
M
D
i computes (Hi∥Ts(Hi))=Ni⊕h(IDi,PWi) and Xi′=hhIDi,PWi∥Hi∥TsHi. MDi then checks whether Xi′ is the same to Xi. If this holds, the mobile device asks the new identity and password to Ui; otherwise, MDi rejects the password change request.
(iii)
U
i inputs a new IDi∗ and PWi∗ into MDi. MDi then computes Ni∗=Ni⊕h(IDi,PWi)⊕h(IDi∗,PWi∗) and Xi∗=hhIDi∗,PWi∗∥Hi∥TsHi and replaces Ni,Xi by Ni∗,Xi∗ into MDi.


## 3.1. Registration Phase

(i)
UserUi selects the identity IDi and password PWi and inputs these values into the mobile devices MDi. MDi then chooses a random number t, calculates Wi=PWi⊕t, and sends IDi,Wi to server S over an insecure channel.
(ii)
Upon receivingIDi,Wi, server S computes Hi=h(s,IDi) and ni=h(Wi,IDi)⊕(Hi,Ts(Hi)) and sends ni to user Ui by using a secure channel.
(iii)
Upon receivingni, MDi retrieves Ni=ni⊕h(Wi,IDi)⊕h(IDi,PWi), (Hi,Ts(Hi))=Ni⊕h(IDi,PWi), and Xi=h(h(IDi,PWi)∥(Hi∥Ts(Hi)) and stores Ni,Xi into MDi.


## 3.2. Login Phase

(i)
UserUi enters IDi and PWi into MDi.
(ii)
M
D
i computes (Hi∥Ts(Hi))=Ni⊕h(IDi,PWi) and Xi′=h(h(IDi,PWi)∥(Hi∥Ts(Hi)). MDi then checks whether Xi′ is equal to Xi. If this holds, MDi executes the following stage; otherwise, MDi rejects the login request.
(iii)
M
D
i chooses a random number k and then computes Zi=Tk(Ts(Hi)) and CIDi=IDi⊕(Hi∥T1∥Zi), where Ci=Tk(Hi), Ri=Hi⊕Zi, Vi=h(CIDi,Zi,Hi,Ri,T1), and T1 is the current timestamp. MDi sends CIDi,Ci,Vi,Ri,T1 to server S by using a public channel.


## 3.3. Verification Phase

(i)
When receiving the request messageCIDi,Ci,Vi,Ri,T1 from user Ui, server S verifies freshness of timestamp T1 and terminates the session if (T2-T1)≤ΔT is false; otherwise, server S continues the next stage.
(ii)
S computes Zi=Ts(Ci), Hi=Ri⊕Zi, IDi=CIDi⊕(Hi∥T1∥Zi), and Vi′=h(CIDi,Zi,Hi,Ri,T1). S then rejects the session if Vi′≠Vi; otherwise, server S continues the following stage.
(iii)
S randomly chooses a number l and computes the session key λ=h(Hi,T1,T2,Tl(Ci)), and Vs=h(λ,Hi,T1,T2). S then sends the response messages Vs,T2,TlHi over an insecure channel.
(iv)
After receiving the response messageVs,T2,TlHi from server S at time T3, MDi checks the freshness of T2 and terminates the session if (T3-T2)≤ΔT is false; otherwise, MDie then computes λ=h(Hi,T1,T2,Tk(Tl(Hi))), and Vs′=h(λ,Hi,T1,T2). MDi next checks whether Vs′≟Vs. If this holds, MDi accepts λ as the session key and authenticates server S; otherwise, MDi rejects the session.


## 3.4. Password Change Phase

(i)
UserUi inputs IDi and PWi into the mobile device MDi.
(ii)
M
D
i computes (Hi∥Ts(Hi))=Ni⊕h(IDi,PWi) and Xi′=hhIDi,PWi∥Hi∥TsHi. MDi then checks whether Xi′ is the same to Xi. If this holds, the mobile device asks the new identity and password to Ui; otherwise, MDi rejects the password change request.
(iii)
U
i inputs a new IDi∗ and PWi∗ into MDi. MDi then computes Ni∗=Ni⊕h(IDi,PWi)⊕h(IDi∗,PWi∗) and Xi∗=hhIDi∗,PWi∗∥Hi∥TsHi and replaces Ni,Xi by Ni∗,Xi∗ into MDi.


## 4. Cryptanalysis of Islam et al.’s Protocol

We cryptanalyze the security problems in Islam et al.’s protocol [27]. Islam et al. analyzed the protocol by Lin et al. and improved it to support an improved security functionality. However, we found that Islam et al.’s protocol was vulnerable to some possible attacks. These attacks are based on the threat assumptions that an adversary E was entirely monitored through the public channel connecting Ui and S in the login and verification phases and that E obtained the mobile device. Therefore, E can insert, modify, eavesdrop on, or delete any message transmitted over a public network. We now reveal further details of these problems.


### 4.1. Violation of the Identity

LetE be an active adversary who is a legitimate user and owns a mobile device to extract information NE,XE and suppose that an adversary E eavesdrops on the communication messages CIDi,Ci,Vi,Ri,T1,Vs,T2,TlHi between user Ui and server S. E can then easily obtain the identity of user Ui. The details are described as follows:(i)
AdversaryE calculates (HE∥Ts(HE))=NE⊕h(IDE,PWE).(ii)
Using [43], the adversary computes s′=arccos⁡(Ts(HE))+2k′π/arccos⁡(HE), ∀k∈Z.(iii)
E can then compute Zi′=Ts′(Ci), Hi′=Ri⊕Zi, and IDi=CIDi⊕(Hi′∥T1∥Zi′).


### 4.2. On-Line Identity Guessing and User Impersonation Attack

LetE be an active adversary who is a legitimate user and owns a mobile device to extract information NE,XE. E can then easily guess the identity of any user Ui and impersonate Ui as follows.(i)
AdversaryE computes (HE∥Ts(HE))=NE⊕h(IDE,PWE).(ii)
E generates a random number k, computes ZE=Tk(Ts(HE)), guesses any identity IDi, and then computes CIDi=IDi⊕(HE∥T1∥ZE), where CE=Tk(HE), RE=HE⊕ZE, Vi=h(CIDi,ZE,HE,RE,T1), and T1 is the current time stamp. MDi sends CIDi,CE,Vi,RE,T1 to server S over an insecure network.(iii)
Upon receiving the login request messageCIDi,CE,Vi,RE,T1 from the adversary E, server S verifies the freshness of the timestamp T1 and terminates the session if (T2-T1)≤ΔT is false; otherwise, server S continues the next stage.(iv)
S computes ZE=Ts(CE), HE=RE⊕ZE, IDi=CIDi⊕(HE∥T1∥ZE), and Vi′=h(CIDi,ZE,HE,RE,T1). S then rejects the session if Vi′≠Vi; otherwise, server S continues the following stage.(v)
S randomly chooses a number l and computes the session key λ=h(HE,T1,T2,Tl(C)), and Vs=h(λ,HE,T1,T2). S then sends the response messages Vs,T2,TlHE over an insecure channel.(vi)
After receiving the response messagesVs,T2,TlHE from server S at time T3, the mobile device checks the freshness of T2 and terminates the session if (T3-T2)≤ΔT is false; otherwise, MDi then computes λ=h(HE,T1,T2,Tk(Tl(HE))). Finally, E and S “successfully” conclude on the session key λ. However, server S faultily decides that he/she is communicating with user Ui.


### 4.3. Server Impersonation Attack

LetE be an active adversary who is a legitimate user and owns a mobile device to extract information NE,XE. E can then easily impersonate S as follows.(i)
AdversaryE computes (HE∥Ts(HE))=NE⊕h(IDE,PWE).(ii)
Using [43], the adversary computes s′=arccos⁡(Ts(HE))+2k′π/arccos⁡(HE), ∀k∈Z.(iii)
When receiving the login request messageCIDi,Ci,Vi,Ri,T1 from user Ui, E computes Zi′=Ts′(Ci) and Hi=Ri⊕Zi′.(iv)
AdversaryE randomly chooses a number l and computes the session key λ=h(Hi,T1,T2,Tl(Ci)), and Vs=h(λ,Hi,T1,T2). The E then sends the response messages Vs,T2,TlHi to user Ui over an insecure channel.(v)
After receiving the response messageVs,T2,TlHi from adversary E at time T3, the mobile device checks the freshness of T2 and terminates the session if (T3-T2)≤ΔT is false; otherwise, MDi then computes λ=h(Hi,T1,T2,Tk(Tl(Hi))), and Vs′=h(λ,Hi,T1,T2). The mobile device next checks whether Vs′=Vs. If this holds, the mobile device accepts λ as the session key. However, server S faultily decides that he/she is communicating with Ui.


### 4.4. Violation of the Session Key

Assume that any adversaryE eavesdrops on the communication messages CIDi,Ci,Vi,Ri,T1,Vs,T2,TlHi between user Ui and server S. E can then easily calculate the session key between Ui and S.(i)
E calculates (HE∥Ts(HE))=NE⊕h(IDE,PWE).(ii)
Using [43], the adversary computes s′=arccos⁡(Ts(HE))+2k′π/arccos⁡(HE), ∀k∈Z.(iii)
E can compute Zi′=Ts′(Ci) and Hi=Ri⊕Zi′.(iv)
Using [43], the adversary computes k′=arccos⁡(Ci)+2k′π/arccos⁡(Hi), ∀k∈Z.(v)
E can then compute the session key λ=h(Hi,T1,T2,Tk′(Tl(Hi))).


## 4.1. Violation of the Identity

LetE be an active adversary who is a legitimate user and owns a mobile device to extract information NE,XE and suppose that an adversary E eavesdrops on the communication messages CIDi,Ci,Vi,Ri,T1,Vs,T2,TlHi between user Ui and server S. E can then easily obtain the identity of user Ui. The details are described as follows:(i)
AdversaryE calculates (HE∥Ts(HE))=NE⊕h(IDE,PWE).(ii)
Using [43], the adversary computes s′=arccos⁡(Ts(HE))+2k′π/arccos⁡(HE), ∀k∈Z.(iii)
E can then compute Zi′=Ts′(Ci), Hi′=Ri⊕Zi, and IDi=CIDi⊕(Hi′∥T1∥Zi′).


## 4.2. On-Line Identity Guessing and User Impersonation Attack

LetE be an active adversary who is a legitimate user and owns a mobile device to extract information NE,XE. E can then easily guess the identity of any user Ui and impersonate Ui as follows.(i)
AdversaryE computes (HE∥Ts(HE))=NE⊕h(IDE,PWE).(ii)
E generates a random number k, computes ZE=Tk(Ts(HE)), guesses any identity IDi, and then computes CIDi=IDi⊕(HE∥T1∥ZE), where CE=Tk(HE), RE=HE⊕ZE, Vi=h(CIDi,ZE,HE,RE,T1), and T1 is the current time stamp. MDi sends CIDi,CE,Vi,RE,T1 to server S over an insecure network.(iii)
Upon receiving the login request messageCIDi,CE,Vi,RE,T1 from the adversary E, server S verifies the freshness of the timestamp T1 and terminates the session if (T2-T1)≤ΔT is false; otherwise, server S continues the next stage.(iv)
S computes ZE=Ts(CE), HE=RE⊕ZE, IDi=CIDi⊕(HE∥T1∥ZE), and Vi′=h(CIDi,ZE,HE,RE,T1). S then rejects the session if Vi′≠Vi; otherwise, server S continues the following stage.(v)
S randomly chooses a number l and computes the session key λ=h(HE,T1,T2,Tl(C)), and Vs=h(λ,HE,T1,T2). S then sends the response messages Vs,T2,TlHE over an insecure channel.(vi)
After receiving the response messagesVs,T2,TlHE from server S at time T3, the mobile device checks the freshness of T2 and terminates the session if (T3-T2)≤ΔT is false; otherwise, MDi then computes λ=h(HE,T1,T2,Tk(Tl(HE))). Finally, E and S “successfully” conclude on the session key λ. However, server S faultily decides that he/she is communicating with user Ui.


## 4.3. Server Impersonation Attack

LetE be an active adversary who is a legitimate user and owns a mobile device to extract information NE,XE. E can then easily impersonate S as follows.(i)
AdversaryE computes (HE∥Ts(HE))=NE⊕h(IDE,PWE).(ii)
Using [43], the adversary computes s′=arccos⁡(Ts(HE))+2k′π/arccos⁡(HE), ∀k∈Z.(iii)
When receiving the login request messageCIDi,Ci,Vi,Ri,T1 from user Ui, E computes Zi′=Ts′(Ci) and Hi=Ri⊕Zi′.(iv)
AdversaryE randomly chooses a number l and computes the session key λ=h(Hi,T1,T2,Tl(Ci)), and Vs=h(λ,Hi,T1,T2). The E then sends the response messages Vs,T2,TlHi to user Ui over an insecure channel.(v)
After receiving the response messageVs,T2,TlHi from adversary E at time T3, the mobile device checks the freshness of T2 and terminates the session if (T3-T2)≤ΔT is false; otherwise, MDi then computes λ=h(Hi,T1,T2,Tk(Tl(Hi))), and Vs′=h(λ,Hi,T1,T2). The mobile device next checks whether Vs′=Vs. If this holds, the mobile device accepts λ as the session key. However, server S faultily decides that he/she is communicating with Ui.


## 4.4. Violation of the Session Key

Assume that any adversaryE eavesdrops on the communication messages CIDi,Ci,Vi,Ri,T1,Vs,T2,TlHi between user Ui and server S. E can then easily calculate the session key between Ui and S.(i)
E calculates (HE∥Ts(HE))=NE⊕h(IDE,PWE).(ii)
Using [43], the adversary computes s′=arccos⁡(Ts(HE))+2k′π/arccos⁡(HE), ∀k∈Z.(iii)
E can compute Zi′=Ts′(Ci) and Hi=Ri⊕Zi′.(iv)
Using [43], the adversary computes k′=arccos⁡(Ci)+2k′π/arccos⁡(Hi), ∀k∈Z.(v)
E can then compute the session key λ=h(Hi,T1,T2,Tk′(Tl(Hi))).


## 5. The Proposed Protocol

We will propose an improved biometric-based authentication protocol using the fuzzy extractor. The proposed protocol is also two members, userUi and server S, and consists of four phases such as registration, login, verification, and password change. Figures 1 and 2 are the registration and login and verification phases of the proposed scheme.Figure 1
Registration phase of the proposed scheme.Figure 2
Login and verification phases of the proposed protocol.


### 5.1. Registration Phase

(i)
U
i gives one’s biometrics BIOi at the mobile device MDi. The MDi then scans BIOi, pulls out two random strings (αi,βi) from the computation Gen(BIOi)→(αi,βi), and stores βi in storage. Ui enters the identity IDi and password PWi, and MDi then calculates RPWi=h(PWi∥αi). Finally, MDi generates a random number t, stores t in the storage, and sends user registration request message IDi,DPWi=RPWi⊕t to server S by using a secure communication channel.
(ii)
Upon receiving the request message for registration,S randomly chooses a number yi and calculates Hi=h(s∥IDi), vi=h(IDi∥DPWi)⊕Tr(Hi), and Xi=(yi∥h(yi∥s))⊕DPWi, where r is a fixed random positive integer and s is the master key of server S.
(iii)
S sends vi,Xi to the MDi.
(iv)
After receiving the registration response messagevi,Xi, MDi computes Tr(Hi)=vi⊕h(IDi∥DPWi), Vi=h(IDi∥RPWi)⊕Tr(Hi), Wi=h(h(IDi∥RPWi)∥Tr(Hi)), and Xi′=Xi⊕t=(yi∥h(yi∥s))⊕RPWi and stores Vi,Wi,Xi′ into storage after deleting t, vi, and Xi.


### 5.2. Login Phase

(i)
U
i enters IDi and PWi and gives BIOi∗ into the mobile device MDi.
(ii)
M
D
i scans BIOi∗ and recovers αi from the computation Rep(BIOi∗,βi)→αi.
(iii)
M
D
i then computes RPWi=h(PWi∥αi), Tr(Hi)=Vi⊕h(IDi∥RPWi), and Wi′=h(h(IDi∥RPWi)∥Tr(Hi)), and checks whether Wi′ is the same to the stored Wi. If this holds, MDi performs the next stage; otherwise, MDi rejects the login request.
(iv)
M
D
i calculates (yi∥h(yi∥s))=Xi⊕RPWi, CIDi=IDi⊕h(yi∥s), and Zi=h(IDi∥Tr(Hi)∥yi∥T1), where T1 is the current timestamp.
(v)
Finally,MDi sends the request message CIDi,yi,Zi,T1 for login to server S.


### 5.3. Verification Phase

(i)
When receiving the request messageCIDi,yi,Zi,T1 from MDi, server S checks whether T2-T1≤ΔT is valid, where ΔT is the minimum acceptable time interval and T2 is the actual arrival time of login request. If this holds, S continues to proceed to the next stage; otherwise, S rejects the request.
(ii)
S then calculates IDi=CIDi⊕h(yi∥s), Hi=h(s∥IDi), and Zi′=h(IDi∥Tr(Hi)∥yi∥T1) and checks whether Zi′ is the same to the received Zi. If this holds, the S continues to proceed to the next stage; otherwise, S terminates this session.
(iii)
S randomly chooses a number yi′ and calculates the session key λ=h(IDi∥Tr(Hi)∥h(yi′∥s)∥T1∥T3), Ys=(yi′∥h(yi′∥s))⊕Tr(Hi), and Zs=h(λ∥Tr(Hi)∥T1∥T3). S then sends the login response message Ys,Zs,T3 where T3 is the current timestamp.
(iv)
After receiving the response messageYs,Zs,T3 from server S, MDi checks whether T4-T3≤ΔT is valid, where ΔT is the minimum acceptable time interval and T4 is the actual arrival time of response message. If this holds, MDi continues to the next stage; otherwise, MDi terminates this session.
(v)
M
D
i computes yi′∥h(yi′∥s)=Ys⊕Tr(Hi) and the session key λ=h(IDi∥Tr(Hi)∥h(yi′∥s)∥T1∥T3) and Zs′=h(λ∥Tr(Hi)∥T1∥T3) and verifies whether Zs′ is the same to the received Zs. If this holds, MDi continues to the next stage; otherwise, MDi terminates current session.
(vi)
Finally,MDi replaces Xi by yi′∥hyi′∥s⊕RPWi into storage.


### 5.4. Password Change Phase

(i)
UserUi inputs IDi and PWi and gives BIOi∗ into the mobile device MDi.
(ii)
M
D
i scans BIOi∗ and recovers αi from the computation Rep(BIOi∗,βi)→αi.
(iii)
M
D
i then computes RPWi=h(PWi∥αi), Tr(Hi)=Vi⊕h(IDi∥RPWi), and Wi′=h(h(IDi∥RPWi)∥Tr(Hi)) and checks whether Wi′ is the same to the stored Wi. If this holds, MDi performs the next stage; otherwise, MDi rejects the password change request.
(iv)
U
i inputs a new password PWi∗ into MDi. MDi then computes RPWi∗=h(PWi∗∥αi), Vi∗=h(IDi∥RPWi∗)⊕Tr(Hi), Wi∗=h(h(IDi∥RPWi∗)∥Tr(Hi)), and Xi∗=Xi⊕RPWi⊕RPWi∗.
(v)
Finally,MDi replaces Vi,Wi,Xi by Vi∗,Wi∗,Xi∗ into storage.


## 5.1. Registration Phase

(i)
U
i gives one’s biometrics BIOi at the mobile device MDi. The MDi then scans BIOi, pulls out two random strings (αi,βi) from the computation Gen(BIOi)→(αi,βi), and stores βi in storage. Ui enters the identity IDi and password PWi, and MDi then calculates RPWi=h(PWi∥αi). Finally, MDi generates a random number t, stores t in the storage, and sends user registration request message IDi,DPWi=RPWi⊕t to server S by using a secure communication channel.
(ii)
Upon receiving the request message for registration,S randomly chooses a number yi and calculates Hi=h(s∥IDi), vi=h(IDi∥DPWi)⊕Tr(Hi), and Xi=(yi∥h(yi∥s))⊕DPWi, where r is a fixed random positive integer and s is the master key of server S.
(iii)
S sends vi,Xi to the MDi.
(iv)
After receiving the registration response messagevi,Xi, MDi computes Tr(Hi)=vi⊕h(IDi∥DPWi), Vi=h(IDi∥RPWi)⊕Tr(Hi), Wi=h(h(IDi∥RPWi)∥Tr(Hi)), and Xi′=Xi⊕t=(yi∥h(yi∥s))⊕RPWi and stores Vi,Wi,Xi′ into storage after deleting t, vi, and Xi.


## 5.2. Login Phase

(i)
U
i enters IDi and PWi and gives BIOi∗ into the mobile device MDi.
(ii)
M
D
i scans BIOi∗ and recovers αi from the computation Rep(BIOi∗,βi)→αi.
(iii)
M
D
i then computes RPWi=h(PWi∥αi), Tr(Hi)=Vi⊕h(IDi∥RPWi), and Wi′=h(h(IDi∥RPWi)∥Tr(Hi)), and checks whether Wi′ is the same to the stored Wi. If this holds, MDi performs the next stage; otherwise, MDi rejects the login request.
(iv)
M
D
i calculates (yi∥h(yi∥s))=Xi⊕RPWi, CIDi=IDi⊕h(yi∥s), and Zi=h(IDi∥Tr(Hi)∥yi∥T1), where T1 is the current timestamp.
(v)
Finally,MDi sends the request message CIDi,yi,Zi,T1 for login to server S.


## 5.3. Verification Phase

(i)
When receiving the request messageCIDi,yi,Zi,T1 from MDi, server S checks whether T2-T1≤ΔT is valid, where ΔT is the minimum acceptable time interval and T2 is the actual arrival time of login request. If this holds, S continues to proceed to the next stage; otherwise, S rejects the request.
(ii)
S then calculates IDi=CIDi⊕h(yi∥s), Hi=h(s∥IDi), and Zi′=h(IDi∥Tr(Hi)∥yi∥T1) and checks whether Zi′ is the same to the received Zi. If this holds, the S continues to proceed to the next stage; otherwise, S terminates this session.
(iii)
S randomly chooses a number yi′ and calculates the session key λ=h(IDi∥Tr(Hi)∥h(yi′∥s)∥T1∥T3), Ys=(yi′∥h(yi′∥s))⊕Tr(Hi), and Zs=h(λ∥Tr(Hi)∥T1∥T3). S then sends the login response message Ys,Zs,T3 where T3 is the current timestamp.
(iv)
After receiving the response messageYs,Zs,T3 from server S, MDi checks whether T4-T3≤ΔT is valid, where ΔT is the minimum acceptable time interval and T4 is the actual arrival time of response message. If this holds, MDi continues to the next stage; otherwise, MDi terminates this session.
(v)
M
D
i computes yi′∥h(yi′∥s)=Ys⊕Tr(Hi) and the session key λ=h(IDi∥Tr(Hi)∥h(yi′∥s)∥T1∥T3) and Zs′=h(λ∥Tr(Hi)∥T1∥T3) and verifies whether Zs′ is the same to the received Zs. If this holds, MDi continues to the next stage; otherwise, MDi terminates current session.
(vi)
Finally,MDi replaces Xi by yi′∥hyi′∥s⊕RPWi into storage.


## 5.4. Password Change Phase

(i)
UserUi inputs IDi and PWi and gives BIOi∗ into the mobile device MDi.
(ii)
M
D
i scans BIOi∗ and recovers αi from the computation Rep(BIOi∗,βi)→αi.
(iii)
M
D
i then computes RPWi=h(PWi∥αi), Tr(Hi)=Vi⊕h(IDi∥RPWi), and Wi′=h(h(IDi∥RPWi)∥Tr(Hi)) and checks whether Wi′ is the same to the stored Wi. If this holds, MDi performs the next stage; otherwise, MDi rejects the password change request.
(iv)
U
i inputs a new password PWi∗ into MDi. MDi then computes RPWi∗=h(PWi∗∥αi), Vi∗=h(IDi∥RPWi∗)⊕Tr(Hi), Wi∗=h(h(IDi∥RPWi∗)∥Tr(Hi)), and Xi∗=Xi⊕RPWi⊕RPWi∗.
(v)
Finally,MDi replaces Vi,Wi,Xi by Vi∗,Wi∗,Xi∗ into storage.


## 6. Security Analysis of the Improved Protocol

The proposed protocol, which retains the advantages of Islam et al.’s protocol, is demonstrated, and it can resist some possible attacks and supports all security properties. The analysis of the improved protocol was organized with the threat assumptions made in Preliminaries.


### 6.1. Formal Security Analysis

A random oracle-based formal analysis is demonstrated here, and its security is shown. First, the following hash function is defined [44]:Definition 4.
A collision-resistance and one-way hash functionh:0,1∗→0,1k receives an input as a binary string of arbitrary length v∈0,1∗, returns a binary string of fixed length h(v)∈0,1k, and gratifies the following conditions:(i)
Givenw∈W, it is computationally impracticable to find a v∈V such that w=h(v).(ii)
Givenv∈V, it is computationally impracticable to find another v′≠v∈V, such that h(v′)=h(v).(iii)
It is computationally impracticable to find a pair(v′,v)∈V′×V, with v′≠v, such that h(v′)=h(v).Theorem 5.
According to the assumptions if hash functionh(·) similarly acts like an random oracle, then the improved protocol is clearly secure to an adversary E to protect sensitive information, including identity IDi, semigroup property Tr(Hi), common session key λ, and master secret key s.Proof.
Formal proof of the proposed protocol is similar in [40, 45], and it uses the oracle to construct E, which will have the ability to extract IDi, Tr(Hi), λ, and s.Reveal. Random oracle can extract input value a from hash value n=h(a) without failing. Adversary E now executes the experimental algorithm shown in Algorithm 1,   EXPHASH,ABBSMK for the proposed scheme as BBSMK, for example. Let us then define the probability of success for EXPHASH,ABBSMK as SuccessHASH,ABBSMK=PrEXPHASH,ABBSMK=1-1, where Pr(·) means the probability of EXPHASH,ABBSMK. The advantage function for this algorithm then defines AdvHASH,ABBSMK(t,qR)=maxSuccess, where t and qR are the execution time and number of queries. We then discuss the algorithm in Algorithm 1 for E. If E has the capability to address the problem of hash function given in Definition 4, then he/she can immediately retrieve IDi, Tr(Hi), λ, and s. In that case, E will detect the complete connections between Ui and S; however, the inversion of the input from a given hash result is not possible computationally; that is, AdvHASH,ABBSMK(t)≤ϵ, for all ϵ>0. Thus, AdvHASH,ABBSMK(t,qR)≤ϵ, since AdvHASH,ABBSMK(t,qR) depends on AdvHASH,ABBSMK(t). In conclusion, there is no method for E to detect the complete connections between Ui and S, and the proposed protocol is distinctly invulnerable to an adversary E to retrieve IDi,TrHi,λ,s.Algorithm 1:Algorithm EXPHASH,ABBSMK.
(1) Eavesdrop the login request message{CIDi,yi,Zi,T1}
(2) Call the Reveal oracle. LetID1′,TrHi′←Reveal(Zi)
(3) Eavesdrop the authentication response messageYs,Zs,T3
(4) Use the Reveal oracle. Let〈λ′,TrHi′′〉←Reveal(Zs)
(5)if  (TrHi′=TrHi′′)  then
(6)   Computeyi′∥h(yi′∥s)=Ys⊕TrHi′
(7)   Call the Reveal oracle. LetIDi′′←Reveal(λ′)
(8)if   (IDi′==IDi′′)  then
(9)     Computeh(yi∥s)=CIDi⊕IDi′
(10)     Call the Reveal oracle. Lets′←Reveal(M1=h(yi∥s))
(11)     Call the Reveal oracle. Lets′′←Reveal(M2=h(yi′∥s))
(12)if  (s′==s′′)  then
(13)       AcceptIDi′, TrHi′, λ′, s′ as the correct IDi, Tr(Hi), λ, s, respectively.
(14)return  0 (Success)
(15)else
(16)return  0 (Failure)
(17)else
(18)return  0 (Failure)
(19)else
(20)return  0 (Failure)
(21)end if


### 6.2. Simulation Result Using AVISPA

We perform to simulate the improved protocol for formal analysis using the widely accepted AVISPA. The main contribution of the simulation is to prove that the improved protocol is invulnerable to man-in-the-middle and replay attacks. AVISPA tool consists of four back-ends: (1) On-the-Fly Model Checker (OFMC); (2) Constraint-Logic-Based Attack Searcher; (3) SAT-Based Model Checker; and (4) Tree Automata Based on Automatic Approximations for the Analysis of Security Protocols. In the AVISPA, the protocol is implemented in High-Level Protocol Specification Language (HLPSL) [44], which is based on the roles: the basic roles for representing each entity role and composition roles for representing the scenarios of the basic roles. The fundamental types available in the HLPSL are [46] as follows:(i)
agent: it means a primary name. The intruder always has the special identifieri.(ii)
symmetric_key: it is the key using the symmetric-key cryptosystem.(iii)
text: the text values are applied for messages. They are often used as nonces.(iv)
nat: the nat is used for meaning the natural numbers in nonmessage contexts.(v)
const: it is the type for representing constants.(vi)
hash_func: the basic type hash_func expresses collision-resistance secure one-way hash functions.The role of the initiator, userUi, is shown in Algorithm 2. Ui first receives the signal for starting and modifies its state variable from 0 to 1. This state variable is retained by the variablestate. Similar to user, the roles of server S are implemented and shown in Algorithm 3. The specifications in HLPSL for the roles of environment, session, and goal are described in Algorithm 4. The result for the formal security verification of the improved protocol using OMFC is provided in Algorithm 5. It is clear that the improved protocol is invulnerable to passive and active attacks including the two attacks.Algorithm 2:Role specification for user Ui.
role user (Ui, AS: agent,
SKuas: symmetric_key,
H, F: function,
SND, RCV: channel (dy))
played_by Ui def=
local State: nat,
IDi, PWi, BIOi, RPWi, DPWi, T, Ai: text,
Hi, Vi, VVi, R, S, Xi, Yi, Wi: text,
CIDi, Zi, T1, T3, SK, Y2, Ys, Zs: text
const as_ui_y2,
sc1, sc2, sc3, sc4: protocol_id
init State ≔ 0
transition
(1) State = 0 ∧ RCV(start) =|>
State’ ≔ 1 ∧ T’ ≔ new()
∧ RPWi’ ≔ H(PWi.Ai)
∧ DPWi’ ≔ xor(RPWi’,T’)
∧ secret({PWi.Ai}, sc1, Ui)
∧ secret(IDi, sc2,{Ui,AS})
∧ SND({IDi.DPWi’}_SKuas)
(2) State = 2 ∧ RCV(xor(H(IDi.xor(H(PWi.Ai),T’)),F(R.H(S.IDi))).xor((Yi’.H(Yi’.S)),
xor(H(PWi.Ai),T’)) _SKuas) =|>
State’ ≔ 4 ∧ secret(R, S, sc3, AS)
∧ secret(F(R.H(S.IDi)), sc4, Ui, AS)
∧ VVi’ ≔ xor(H(IDi.H(PWi.Ai)), F(R.H(S.IDi)))
∧ Wi’ ≔ H(H(IDi.H(PWi.Ai)).F(R.H(S.IDi)))
∧ Xi’ ≔ xor((Yi’.H(Yi’.S)),H(PWi.Ai))
∧ CIDi’ ≔ xor(IDi, H(Yi’.S))
∧ T1’ ≔ new()
∧ Zi’ ≔ H(IDi.F(R.H(S.IDi)).Yi’.T1’)
∧ SND(CIDi’.Yi’.Zi’.T1’)
(3) State = 6 ∧ RCV(xor((Y2’.H(Y2’.S)),F(R.H(S.IDi))).H(SK.F(R.H(S.IDi)).T1’.T3’).T3’) =|>
State’ ≔ 8 ∧ SK’ ≔ H(IDi.F(R.H(S.IDi)).H(Y2’.S).T1’.T3’)
∧ Xi’ ≔ xor((Y2’.H(Y2’.S)),H(PWi.Ai))
∧ request(Ui, AS, as_ui_y2, Y2’)
end roleAlgorithm 3:Role specification for application server AS.
role applicationserver (Ui, AS: agent,
SKuas: symmetric_key,
H, F: function,
SND, RCV: channel(dy))
played_by AS def=
local State: nat,
IDi, PWi, BIOi, RPWi, DPWi, T, Ai: text,
Hi, Vi, VVi, R, S, Xi, Yi, Wi: text,
CIDi, Zi, T1, T3, SK, Y2, Ys, Zs: text
const as_ui_y2,
sc1, sc2, sc3, sc4: protocol_id
init State:= 1
transition
(1) State = 1 ∧ RCV(IDi.xor(H(PWi.Ai),T’)) =|>
State’ ≔ 3 ∧ Hi’ ≔ H(S.IDi)
∧ Vi’ ≔ xor(H(IDi.xor(H(PWi.Ai),T’)),F(R.H(S.IDi)))
∧ Yi’ ≔ new()
∧ Xi’ ≔ xor((Yi’.H(Yi’.S)),xor(H(PWi.Ai),T’))
∧ secret(F(R.H(S.IDi)), sc4,{Ui, AS})
∧ SND({Vi’.Xi’}_SKuas)
(2) State = 5 ∧ RCV(xor(IDi,H(Yi’.S).Yi’.H(IDi.F(R.H(S.IDi).Yi’.T1’)).T1’)) =|>
State’ ≔ 7 ∧ Hi’ ≔ H(S.IDi)
∧ Y2’ ≔ new()
∧ T3’ ≔ new()
∧ SK’ ≔ H(IDi.F(R.H(S.IDi)).H(Y2’.S).T1’.T3’)
∧ Ys’ ≔ xor((Y2’.H(Y2’.S)),F(R.H(S.IDi)))
∧ Zs’ ≔ H(SK’.F(R.H(S.IDi)).T1’.T3’)
∧ SND(Ys’.Zs’.T3’)
∧ witness(AS, Ui, as_ui_y2, Y2’)
end roleAlgorithm 4:Role specification for session, goal, and environment.
role session (Ui, AS: agent,
SKuas: symmetric_key,
H, F: function)
def=
local H1, H2, R1, R2: channel (dy)
composition
user (Ui, AS, SKuas, H, F, H1, R1)
∧ applicationserver (Ui, AS, SKuas, H, F, H2, R2)
end role
role environment() def=
const ui, as: agent,
skuas: symmetric_key,
h, f: function,
cidi, yi, zi, t1, ys, zs, t3: text,
as_ui_y2,
sc1, sc2, sc3, sc4: protocol_id
intruder_knowledge = ui, as, h, f, cidi, yi, zi, t1, ys, zs, t3
composition
session(ui, as, skuas, h, f)
∧ session(i, as, skuas, h, f)
∧ session(ui, i, skuas, h, f)
end role
goal
secrecy_of sc1, sc2, sc3, sc4
authentication_on as_ui_y2
end goal
environment()Algorithm 5:The result of simulation using OFMC backends.
% OFMC
% Version of 2006/02/13
SUMMARY
SAFE
DETAILS
BOUNDED_NUMBER_OF_SESSIONS
PROTOCOL
/home/span/span/testsuite/results/testrv3.if
GOAL
as_specified
BACKEND
OFMC
COMMENTS
STATISTICS
parseTime: 0.00 s
searchTime: 0.03 s
visiteNodes: 4 nodes
depth: 2 piles


### 6.3. Informal Security Analysis

#### 6.3.1. Mutual Authentication

Not only does the proposed scheme guarantee security as the other biometric-based schemes, but alsoUi and S authenticate each other. S authenticates Ui by checking whether Zi is valid or not, because only a legitimate user can compute a valid h(IDi∥Tr(Hi)∥yi∥T1) using a chaotic map. Ui then authenticates S by checking Zs, which only S can compute using the long-term key s and timestamp T3.


#### 6.3.2. User Anonymity

To compromise the anonymity of userUi, adversary E must be able to compute h(yi∥s). The value s is the master secret key of server S, and the random value yi changes every session. Thus, the login request message changes every session. Even if adversary E eavesdrops on the login request message of a user Ui, E does not know IDi. The proposed protocol provides user anonymity.


#### 6.3.3. User Impersonation Attack

Suppose that an adversaryE steals the mobile device MDi of user Ui and extracts the parameters Vi,Wi,yi,βi,Xi from MDi. To make the login request message CIDi,yi,Zi,T1, where CIDi=IDi⊕h(yi∥s) and Zi=h(IDi∥Tr(Hi)∥yi∥T1), the server’s master key s is needed. Without the master secret key s from server S, E cannot compute Zi. The proposed protocol can therefore resist a user impersonation attack.


#### 6.3.4. Privileged Insider Attack

In the proposed protocol, userUi sends the login request message IDi,DPWi=RPWi⊕t. Even if the privileged insider adversary E obtains these values IDi,DPWi=RPWi⊕t, E does not know RPWi and cannot impersonate user Ui. The proposed protocol can therefore resist a privileged insider attack.


#### 6.3.5. Lost Mobile Device Attack

Suppose that userUi’s mobile device MDi has been stolen or lost and any adversary E obtains it. E then tries to login to server S using MDi; however, E does not know the correct password PWi. To login to S, the biometrics BIOi is also needed. The proposed protocol can therefore resist a lost mobile device attack.


#### 6.3.6. Replay Attack

One of the best solutions to prevent replay attack is to use a timestamp technique. The proposed protocol also uses timestamps. Even if any adversaryE eavesdrops on any user’s login request message and sends it to the server S, the server S checks the freshness of the timestamp and rejects the request. Furthermore, an adversary E cannot compute Zi without IDi and yi. The proposed protocol can therefore resist a replay attack.


#### 6.3.7. Off-Line Password Guessing Attack

To obtain a password of userUi, the biometrics BIOi is needed. Biometrics is uniquene and it cannot be guessed or stolen. The proposed protocol can therefore resist an off-line password guessing attack.


#### 6.3.8. Stolen Verifier Attack

In the proposed protocol, a serverS does not store any information related to the user’s identity or password. The proposed protocol can therefore resist a stolen verifier attack.


#### 6.3.9. Session Key Forward Security

One important objective of any user authentication protocols is to constitute a session key between userUi and server S. The forward secrecy can protect previous and future session keys from adversary E if the master secret key of S is exposed. Suppose that the master secret key s of S is known to E. However, E does not know Tr(Hi). Thus, the session key λ=h(IDi∥Tr(Hi)∥h(yi′∥s)∥T1∥T3) of the improved protocol is still undiscovered to E. Therefore, forward secrecy is retained in the proposed protocol.


## 6.1. Formal Security Analysis

A random oracle-based formal analysis is demonstrated here, and its security is shown. First, the following hash function is defined [44]:Definition 4.
A collision-resistance and one-way hash functionh:0,1∗→0,1k receives an input as a binary string of arbitrary length v∈0,1∗, returns a binary string of fixed length h(v)∈0,1k, and gratifies the following conditions:(i)
Givenw∈W, it is computationally impracticable to find a v∈V such that w=h(v).(ii)
Givenv∈V, it is computationally impracticable to find another v′≠v∈V, such that h(v′)=h(v).(iii)
It is computationally impracticable to find a pair(v′,v)∈V′×V, with v′≠v, such that h(v′)=h(v).Theorem 5.
According to the assumptions if hash functionh(·) similarly acts like an random oracle, then the improved protocol is clearly secure to an adversary E to protect sensitive information, including identity IDi, semigroup property Tr(Hi), common session key λ, and master secret key s.Proof.
Formal proof of the proposed protocol is similar in [40, 45], and it uses the oracle to construct E, which will have the ability to extract IDi, Tr(Hi), λ, and s.Reveal. Random oracle can extract input value a from hash value n=h(a) without failing. Adversary E now executes the experimental algorithm shown in Algorithm 1,   EXPHASH,ABBSMK for the proposed scheme as BBSMK, for example. Let us then define the probability of success for EXPHASH,ABBSMK as SuccessHASH,ABBSMK=PrEXPHASH,ABBSMK=1-1, where Pr(·) means the probability of EXPHASH,ABBSMK. The advantage function for this algorithm then defines AdvHASH,ABBSMK(t,qR)=maxSuccess, where t and qR are the execution time and number of queries. We then discuss the algorithm in Algorithm 1 for E. If E has the capability to address the problem of hash function given in Definition 4, then he/she can immediately retrieve IDi, Tr(Hi), λ, and s. In that case, E will detect the complete connections between Ui and S; however, the inversion of the input from a given hash result is not possible computationally; that is, AdvHASH,ABBSMK(t)≤ϵ, for all ϵ>0. Thus, AdvHASH,ABBSMK(t,qR)≤ϵ, since AdvHASH,ABBSMK(t,qR) depends on AdvHASH,ABBSMK(t). In conclusion, there is no method for E to detect the complete connections between Ui and S, and the proposed protocol is distinctly invulnerable to an adversary E to retrieve IDi,TrHi,λ,s.Algorithm 1:Algorithm EXPHASH,ABBSMK.
(1) Eavesdrop the login request message{CIDi,yi,Zi,T1}
(2) Call the Reveal oracle. LetID1′,TrHi′←Reveal(Zi)
(3) Eavesdrop the authentication response messageYs,Zs,T3
(4) Use the Reveal oracle. Let〈λ′,TrHi′′〉←Reveal(Zs)
(5)if  (TrHi′=TrHi′′)  then
(6)   Computeyi′∥h(yi′∥s)=Ys⊕TrHi′
(7)   Call the Reveal oracle. LetIDi′′←Reveal(λ′)
(8)if   (IDi′==IDi′′)  then
(9)     Computeh(yi∥s)=CIDi⊕IDi′
(10)     Call the Reveal oracle. Lets′←Reveal(M1=h(yi∥s))
(11)     Call the Reveal oracle. Lets′′←Reveal(M2=h(yi′∥s))
(12)if  (s′==s′′)  then
(13)       AcceptIDi′, TrHi′, λ′, s′ as the correct IDi, Tr(Hi), λ, s, respectively.
(14)return  0 (Success)
(15)else
(16)return  0 (Failure)
(17)else
(18)return  0 (Failure)
(19)else
(20)return  0 (Failure)
(21)end if


## 6.2. Simulation Result Using AVISPA

We perform to simulate the improved protocol for formal analysis using the widely accepted AVISPA. The main contribution of the simulation is to prove that the improved protocol is invulnerable to man-in-the-middle and replay attacks. AVISPA tool consists of four back-ends: (1) On-the-Fly Model Checker (OFMC); (2) Constraint-Logic-Based Attack Searcher; (3) SAT-Based Model Checker; and (4) Tree Automata Based on Automatic Approximations for the Analysis of Security Protocols. In the AVISPA, the protocol is implemented in High-Level Protocol Specification Language (HLPSL) [44], which is based on the roles: the basic roles for representing each entity role and composition roles for representing the scenarios of the basic roles. The fundamental types available in the HLPSL are [46] as follows:(i)
agent: it means a primary name. The intruder always has the special identifieri.(ii)
symmetric_key: it is the key using the symmetric-key cryptosystem.(iii)
text: the text values are applied for messages. They are often used as nonces.(iv)
nat: the nat is used for meaning the natural numbers in nonmessage contexts.(v)
const: it is the type for representing constants.(vi)
hash_func: the basic type hash_func expresses collision-resistance secure one-way hash functions.The role of the initiator, userUi, is shown in Algorithm 2. Ui first receives the signal for starting and modifies its state variable from 0 to 1. This state variable is retained by the variablestate. Similar to user, the roles of server S are implemented and shown in Algorithm 3. The specifications in HLPSL for the roles of environment, session, and goal are described in Algorithm 4. The result for the formal security verification of the improved protocol using OMFC is provided in Algorithm 5. It is clear that the improved protocol is invulnerable to passive and active attacks including the two attacks.Algorithm 2:Role specification for user Ui.
role user (Ui, AS: agent,
SKuas: symmetric_key,
H, F: function,
SND, RCV: channel (dy))
played_by Ui def=
local State: nat,
IDi, PWi, BIOi, RPWi, DPWi, T, Ai: text,
Hi, Vi, VVi, R, S, Xi, Yi, Wi: text,
CIDi, Zi, T1, T3, SK, Y2, Ys, Zs: text
const as_ui_y2,
sc1, sc2, sc3, sc4: protocol_id
init State ≔ 0
transition
(1) State = 0 ∧ RCV(start) =|>
State’ ≔ 1 ∧ T’ ≔ new()
∧ RPWi’ ≔ H(PWi.Ai)
∧ DPWi’ ≔ xor(RPWi’,T’)
∧ secret({PWi.Ai}, sc1, Ui)
∧ secret(IDi, sc2,{Ui,AS})
∧ SND({IDi.DPWi’}_SKuas)
(2) State = 2 ∧ RCV(xor(H(IDi.xor(H(PWi.Ai),T’)),F(R.H(S.IDi))).xor((Yi’.H(Yi’.S)),
xor(H(PWi.Ai),T’)) _SKuas) =|>
State’ ≔ 4 ∧ secret(R, S, sc3, AS)
∧ secret(F(R.H(S.IDi)), sc4, Ui, AS)
∧ VVi’ ≔ xor(H(IDi.H(PWi.Ai)), F(R.H(S.IDi)))
∧ Wi’ ≔ H(H(IDi.H(PWi.Ai)).F(R.H(S.IDi)))
∧ Xi’ ≔ xor((Yi’.H(Yi’.S)),H(PWi.Ai))
∧ CIDi’ ≔ xor(IDi, H(Yi’.S))
∧ T1’ ≔ new()
∧ Zi’ ≔ H(IDi.F(R.H(S.IDi)).Yi’.T1’)
∧ SND(CIDi’.Yi’.Zi’.T1’)
(3) State = 6 ∧ RCV(xor((Y2’.H(Y2’.S)),F(R.H(S.IDi))).H(SK.F(R.H(S.IDi)).T1’.T3’).T3’) =|>
State’ ≔ 8 ∧ SK’ ≔ H(IDi.F(R.H(S.IDi)).H(Y2’.S).T1’.T3’)
∧ Xi’ ≔ xor((Y2’.H(Y2’.S)),H(PWi.Ai))
∧ request(Ui, AS, as_ui_y2, Y2’)
end roleAlgorithm 3:Role specification for application server AS.
role applicationserver (Ui, AS: agent,
SKuas: symmetric_key,
H, F: function,
SND, RCV: channel(dy))
played_by AS def=
local State: nat,
IDi, PWi, BIOi, RPWi, DPWi, T, Ai: text,
Hi, Vi, VVi, R, S, Xi, Yi, Wi: text,
CIDi, Zi, T1, T3, SK, Y2, Ys, Zs: text
const as_ui_y2,
sc1, sc2, sc3, sc4: protocol_id
init State:= 1
transition
(1) State = 1 ∧ RCV(IDi.xor(H(PWi.Ai),T’)) =|>
State’ ≔ 3 ∧ Hi’ ≔ H(S.IDi)
∧ Vi’ ≔ xor(H(IDi.xor(H(PWi.Ai),T’)),F(R.H(S.IDi)))
∧ Yi’ ≔ new()
∧ Xi’ ≔ xor((Yi’.H(Yi’.S)),xor(H(PWi.Ai),T’))
∧ secret(F(R.H(S.IDi)), sc4,{Ui, AS})
∧ SND({Vi’.Xi’}_SKuas)
(2) State = 5 ∧ RCV(xor(IDi,H(Yi’.S).Yi’.H(IDi.F(R.H(S.IDi).Yi’.T1’)).T1’)) =|>
State’ ≔ 7 ∧ Hi’ ≔ H(S.IDi)
∧ Y2’ ≔ new()
∧ T3’ ≔ new()
∧ SK’ ≔ H(IDi.F(R.H(S.IDi)).H(Y2’.S).T1’.T3’)
∧ Ys’ ≔ xor((Y2’.H(Y2’.S)),F(R.H(S.IDi)))
∧ Zs’ ≔ H(SK’.F(R.H(S.IDi)).T1’.T3’)
∧ SND(Ys’.Zs’.T3’)
∧ witness(AS, Ui, as_ui_y2, Y2’)
end roleAlgorithm 4:Role specification for session, goal, and environment.
role session (Ui, AS: agent,
SKuas: symmetric_key,
H, F: function)
def=
local H1, H2, R1, R2: channel (dy)
composition
user (Ui, AS, SKuas, H, F, H1, R1)
∧ applicationserver (Ui, AS, SKuas, H, F, H2, R2)
end role
role environment() def=
const ui, as: agent,
skuas: symmetric_key,
h, f: function,
cidi, yi, zi, t1, ys, zs, t3: text,
as_ui_y2,
sc1, sc2, sc3, sc4: protocol_id
intruder_knowledge = ui, as, h, f, cidi, yi, zi, t1, ys, zs, t3
composition
session(ui, as, skuas, h, f)
∧ session(i, as, skuas, h, f)
∧ session(ui, i, skuas, h, f)
end role
goal
secrecy_of sc1, sc2, sc3, sc4
authentication_on as_ui_y2
end goal
environment()Algorithm 5:The result of simulation using OFMC backends.
% OFMC
% Version of 2006/02/13
SUMMARY
SAFE
DETAILS
BOUNDED_NUMBER_OF_SESSIONS
PROTOCOL
/home/span/span/testsuite/results/testrv3.if
GOAL
as_specified
BACKEND
OFMC
COMMENTS
STATISTICS
parseTime: 0.00 s
searchTime: 0.03 s
visiteNodes: 4 nodes
depth: 2 piles


## 6.3. Informal Security Analysis

### 6.3.1. Mutual Authentication

Not only does the proposed scheme guarantee security as the other biometric-based schemes, but alsoUi and S authenticate each other. S authenticates Ui by checking whether Zi is valid or not, because only a legitimate user can compute a valid h(IDi∥Tr(Hi)∥yi∥T1) using a chaotic map. Ui then authenticates S by checking Zs, which only S can compute using the long-term key s and timestamp T3.


### 6.3.2. User Anonymity

To compromise the anonymity of userUi, adversary E must be able to compute h(yi∥s). The value s is the master secret key of server S, and the random value yi changes every session. Thus, the login request message changes every session. Even if adversary E eavesdrops on the login request message of a user Ui, E does not know IDi. The proposed protocol provides user anonymity.


### 6.3.3. User Impersonation Attack

Suppose that an adversaryE steals the mobile device MDi of user Ui and extracts the parameters Vi,Wi,yi,βi,Xi from MDi. To make the login request message CIDi,yi,Zi,T1, where CIDi=IDi⊕h(yi∥s) and Zi=h(IDi∥Tr(Hi)∥yi∥T1), the server’s master key s is needed. Without the master secret key s from server S, E cannot compute Zi. The proposed protocol can therefore resist a user impersonation attack.


### 6.3.4. Privileged Insider Attack

In the proposed protocol, userUi sends the login request message IDi,DPWi=RPWi⊕t. Even if the privileged insider adversary E obtains these values IDi,DPWi=RPWi⊕t, E does not know RPWi and cannot impersonate user Ui. The proposed protocol can therefore resist a privileged insider attack.


### 6.3.5. Lost Mobile Device Attack

Suppose that userUi’s mobile device MDi has been stolen or lost and any adversary E obtains it. E then tries to login to server S using MDi; however, E does not know the correct password PWi. To login to S, the biometrics BIOi is also needed. The proposed protocol can therefore resist a lost mobile device attack.


### 6.3.6. Replay Attack

One of the best solutions to prevent replay attack is to use a timestamp technique. The proposed protocol also uses timestamps. Even if any adversaryE eavesdrops on any user’s login request message and sends it to the server S, the server S checks the freshness of the timestamp and rejects the request. Furthermore, an adversary E cannot compute Zi without IDi and yi. The proposed protocol can therefore resist a replay attack.


### 6.3.7. Off-Line Password Guessing Attack

To obtain a password of userUi, the biometrics BIOi is needed. Biometrics is uniquene and it cannot be guessed or stolen. The proposed protocol can therefore resist an off-line password guessing attack.


### 6.3.8. Stolen Verifier Attack

In the proposed protocol, a serverS does not store any information related to the user’s identity or password. The proposed protocol can therefore resist a stolen verifier attack.


### 6.3.9. Session Key Forward Security

One important objective of any user authentication protocols is to constitute a session key between userUi and server S. The forward secrecy can protect previous and future session keys from adversary E if the master secret key of S is exposed. Suppose that the master secret key s of S is known to E. However, E does not know Tr(Hi). Thus, the session key λ=h(IDi∥Tr(Hi)∥h(yi′∥s)∥T1∥T3) of the improved protocol is still undiscovered to E. Therefore, forward secrecy is retained in the proposed protocol.


## 6.3.1. Mutual Authentication

Not only does the proposed scheme guarantee security as the other biometric-based schemes, but alsoUi and S authenticate each other. S authenticates Ui by checking whether Zi is valid or not, because only a legitimate user can compute a valid h(IDi∥Tr(Hi)∥yi∥T1) using a chaotic map. Ui then authenticates S by checking Zs, which only S can compute using the long-term key s and timestamp T3.


## 6.3.2. User Anonymity

To compromise the anonymity of userUi, adversary E must be able to compute h(yi∥s). The value s is the master secret key of server S, and the random value yi changes every session. Thus, the login request message changes every session. Even if adversary E eavesdrops on the login request message of a user Ui, E does not know IDi. The proposed protocol provides user anonymity.


## 6.3.3. User Impersonation Attack

Suppose that an adversaryE steals the mobile device MDi of user Ui and extracts the parameters Vi,Wi,yi,βi,Xi from MDi. To make the login request message CIDi,yi,Zi,T1, where CIDi=IDi⊕h(yi∥s) and Zi=h(IDi∥Tr(Hi)∥yi∥T1), the server’s master key s is needed. Without the master secret key s from server S, E cannot compute Zi. The proposed protocol can therefore resist a user impersonation attack.


## 6.3.4. Privileged Insider Attack

In the proposed protocol, userUi sends the login request message IDi,DPWi=RPWi⊕t. Even if the privileged insider adversary E obtains these values IDi,DPWi=RPWi⊕t, E does not know RPWi and cannot impersonate user Ui. The proposed protocol can therefore resist a privileged insider attack.


## 6.3.5. Lost Mobile Device Attack

Suppose that userUi’s mobile device MDi has been stolen or lost and any adversary E obtains it. E then tries to login to server S using MDi; however, E does not know the correct password PWi. To login to S, the biometrics BIOi is also needed. The proposed protocol can therefore resist a lost mobile device attack.


## 6.3.6. Replay Attack

One of the best solutions to prevent replay attack is to use a timestamp technique. The proposed protocol also uses timestamps. Even if any adversaryE eavesdrops on any user’s login request message and sends it to the server S, the server S checks the freshness of the timestamp and rejects the request. Furthermore, an adversary E cannot compute Zi without IDi and yi. The proposed protocol can therefore resist a replay attack.


## 6.3.7. Off-Line Password Guessing Attack

To obtain a password of userUi, the biometrics BIOi is needed. Biometrics is uniquene and it cannot be guessed or stolen. The proposed protocol can therefore resist an off-line password guessing attack.


## 6.3.8. Stolen Verifier Attack

In the proposed protocol, a serverS does not store any information related to the user’s identity or password. The proposed protocol can therefore resist a stolen verifier attack.


## 6.3.9. Session Key Forward Security

One important objective of any user authentication protocols is to constitute a session key between userUi and server S. The forward secrecy can protect previous and future session keys from adversary E if the master secret key of S is exposed. Suppose that the master secret key s of S is known to E. However, E does not know Tr(Hi). Thus, the session key λ=h(IDi∥Tr(Hi)∥h(yi′∥s)∥T1∥T3) of the improved protocol is still undiscovered to E. Therefore, forward secrecy is retained in the proposed protocol.


## 7. Comparison of Functionality and Performance

This section presents comparisons of the functionality between the improved protocol and related protocols [23–28], and the computational spending between the improved protocol and the other protocols [25–30] is also compared here.


### 7.1. Functionality Analysis

Table1 compares the security features provided by the proposed protocol with previous protocols. The results indicate that the proposed protocol is distinctly invulnerable and achieves all of the avoidance requirements.Table 1
Functionality comparison of the improved protocol with others.
Property
[23]
[24]
[25]
[26]
[27]
[28]
The proposed
Mutual authentication
×
×
×
×
√
×
√
User anonymity
×
×
×
×
√
√
√
Impersonation attack
×
×
×
×
×
×
√
Insider attack
×
×
√
√
√
×
√
DoS attack
√
√
×
√
√
√
√
Replay attack
×
√
×
√
√
√
√
Off-line password guessing attack
×
√
×
×
√
×
√
Stolen verifier attack
×
√
√
√
√
√
√
Session key attack
×
×
×
×
×
×
√
Provable security
×
×
×
×
√
×
√


### 7.2. Performance Analysis

We demonstrated the computational cost of the improved protocol against previous protocols in terms of the computational cost. According to the simulations obtained in [34], we found that Tc≈32.40 ms and Th≈0.20 ms, respectively, with a system using Pentium IV 3.2 G (CPU) with a 3.0 GB (RAM). According to [47], the computational cost of the fuzzy extractor technique Tf is nearly identical to ECC multiplication. Kilinc and Yanik [48] has gauged the execution time of some cryptographic algorithms by using the Pairing-Based Cryptography Library (version 0.5.12) [49] in the OS: 32-bit Ubuntu 12.04.1, 2.2 G (CPU), and 2.0 G (RAM). They demonstrated that the cost to perform an elliptic curve point multiplication Te is nearly 2.226 ms. In addition, they proved that the cost of a bitwise XOR operation is negligible. In Table 2, we presented the computational cost of the improved protocol for each phase and execution time (millisecond) with the related schemes. Compared to Islam et al.’s protocol, the improved protocol performs seven further hash functions and two fuzzy-extract operations. However, we reduce four extended chaotic operations. The improved protocol therefore is more effective than Islam et al.’s protocol.Table 2
Performance comparison of the improved protocol with others.
[25]
[29]
[26]
[27]
[28]
[30]
The proposed
Registration
3
T
h
4
T
h
4
T
h
+
T
c
6
T
h
+
T
c
4
T
h
3
T
h
+
T
c
7
T
h
+
T
c
+
T
f
Login
5
T
h
+
T
c
3
T
h
+
2
T
c
2
T
h
+
2
T
c
3
T
h
+
2
T
c
5
T
h
+
2
T
c
2
T
h
+
3
T
c
3
T
h
+
T
f
Verification
6
T
h
+
5
T
c
6
T
h
+
4
T
c
6
T
h
+
T
c
6
T
h
+
T
c
7
T
h
+
4
T
c
6
T
h
+
2
T
c
8
T
h
+
1
T
c
Total
14
T
h
+
6
T
c
13
T
h
+
6
T
c
14
T
h
+
4
T
c
15
T
h
+
4
T
c
16
T
h
+
6
T
c
11
T
h
+
6
T
c
18
T
h
+
2
T
c
+
2
T
f
Time (ms)
≈197.2
≈197.0
≈132.4
≈132.6
≈197.6
≈196.6
≈72.9


## 7.1. Functionality Analysis

Table1 compares the security features provided by the proposed protocol with previous protocols. The results indicate that the proposed protocol is distinctly invulnerable and achieves all of the avoidance requirements.Table 1
Functionality comparison of the improved protocol with others.
Property
[23]
[24]
[25]
[26]
[27]
[28]
The proposed
Mutual authentication
×
×
×
×
√
×
√
User anonymity
×
×
×
×
√
√
√
Impersonation attack
×
×
×
×
×
×
√
Insider attack
×
×
√
√
√
×
√
DoS attack
√
√
×
√
√
√
√
Replay attack
×
√
×
√
√
√
√
Off-line password guessing attack
×
√
×
×
√
×
√
Stolen verifier attack
×
√
√
√
√
√
√
Session key attack
×
×
×
×
×
×
√
Provable security
×
×
×
×
√
×
√


## 7.2. Performance Analysis

We demonstrated the computational cost of the improved protocol against previous protocols in terms of the computational cost. According to the simulations obtained in [34], we found that Tc≈32.40 ms and Th≈0.20 ms, respectively, with a system using Pentium IV 3.2 G (CPU) with a 3.0 GB (RAM). According to [47], the computational cost of the fuzzy extractor technique Tf is nearly identical to ECC multiplication. Kilinc and Yanik [48] has gauged the execution time of some cryptographic algorithms by using the Pairing-Based Cryptography Library (version 0.5.12) [49] in the OS: 32-bit Ubuntu 12.04.1, 2.2 G (CPU), and 2.0 G (RAM). They demonstrated that the cost to perform an elliptic curve point multiplication Te is nearly 2.226 ms. In addition, they proved that the cost of a bitwise XOR operation is negligible. In Table 2, we presented the computational cost of the improved protocol for each phase and execution time (millisecond) with the related schemes. Compared to Islam et al.’s protocol, the improved protocol performs seven further hash functions and two fuzzy-extract operations. However, we reduce four extended chaotic operations. The improved protocol therefore is more effective than Islam et al.’s protocol.Table 2
Performance comparison of the improved protocol with others.
[25]
[29]
[26]
[27]
[28]
[30]
The proposed
Registration
3
T
h
4
T
h
4
T
h
+
T
c
6
T
h
+
T
c
4
T
h
3
T
h
+
T
c
7
T
h
+
T
c
+
T
f
Login
5
T
h
+
T
c
3
T
h
+
2
T
c
2
T
h
+
2
T
c
3
T
h
+
2
T
c
5
T
h
+
2
T
c
2
T
h
+
3
T
c
3
T
h
+
T
f
Verification
6
T
h
+
5
T
c
6
T
h
+
4
T
c
6
T
h
+
T
c
6
T
h
+
T
c
7
T
h
+
4
T
c
6
T
h
+
2
T
c
8
T
h
+
1
T
c
Total
14
T
h
+
6
T
c
13
T
h
+
6
T
c
14
T
h
+
4
T
c
15
T
h
+
4
T
c
16
T
h
+
6
T
c
11
T
h
+
6
T
c
18
T
h
+
2
T
c
+
2
T
f
Time (ms)
≈197.2
≈197.0
≈132.4
≈132.6
≈197.6
≈196.6
≈72.9


## 8. Conclusion

Recently, Islam et al. demonstrated the security vulnerabilities in Lin et al.’s protocol and presented an improved authentication protocol using extended chaotic map. Islam et al. also asserted that their authentication protocol is more secure than Lin et al.’s protocol and that it guarantees user anonymity. However, Islam et al.’s protocol is still insecure against some types of attacks, such as on-line identity guessing and user impersonation. To overcome these security weaknesses, in the current paper, we suggest an improved user authentication protocol using a fuzzy extractor that preserves the advantages of Islam et al.’s protocol and contributes to inclusive security properties. The formal and informal analyses of this work clarify why the improved protocol is more efficient and secure.



---

*Source: 1378128-2017-09-27.xml*