# Analysis and Improvement on an Authentication Protocol for IoT-Enabled Devices in Distributed Cloud Computing Environment

Authors: Baoyuan Kang; Yanbao Han; Kun Qian; Jianqi Du
Journal: Mathematical Problems in Engineering
 (2020)

---

## Abstract

Recently, a number of authentication protocols integrated with the Internet of Things (IoT) and cloud computing have been proposed for secure access control on large-scale IoT networks. In this paper, we carefully analyze Amin et al.’s authentication protocol for IoT-enabled devices in distributed cloud computing environment and find that Amin et al.’s protocol is vulnerable to several weaknesses. The main shortcoming of Amin et al.’s protocol is in authentication phase; a malicious cloud server can counterfeit the cloud server chosen by a user, and the control server cannot find this counterfeit. To overcome the shortcomings of Amin et al.’s protocol, we propose an improved protocol. In the registration phase of the improved protocol, the pseudoidentity and real identity of a user or a cloud server are bundled up with the control server’s secret numbers. This measure can effectively prevent impersonation attack. We also compare the improved protocol with several existing authentication protocols in security and computational efficiency.


---

## Body

## 1. Introduction

With the development of the Internet technology, people’s life and production have been greatly improved by Internet of Things (IoT) [1]. But, IoT also faces problems of efficiency due to its sensors with low memory and low power. Using powerful cloud services [2] can improve the efficiency of IoT. Now, authentication protocols integrated with the IoT and cloud computing attract people’s attention.The first suggested authentication protocol was proposed by Lamport [3]. Then, many password-based authentication protocols were proposed [4–8]. Recently, people discuss authentication protocols for multiserver in IoT and cloud environment [9–16]. Amin et al. [13] showed security vulnerabilities of two authentication protocols in multiserver cloud environment proposed by Xue et al. [11] and Chuang and Chen [12]. Then, Amin et al. [13] proposed an authentication protocol for IoT-enabled devices in distributed cloud computing environment. They claimed that the proposed protocol is protected against all possible security threats. However, in this paper, we find that Amin et al.’s protocol is vulnerable to several weaknesses. Firstly, during the registration phase of Amin et al.’s protocol, it is unreasonable for a user to register with a pseudoidentity. Secondly, the main shortcoming of Amin et al.’s protocol is that, in its authentication and key agreement phase, although the control server can identify a cloud server is legal, the control server cannot tell if this cloud server is the one chosen by a user. So, in Amin et al.’s protocol, a malicious server can counterfeit the server chosen by a user.On the basis of analyzing the shortcomings of Amin et al.’s protocol, we propose an improvement on Amin et al.’s protocol. In the registration phase of the improved protocol, the pseudoidentity and real identity of a user or a cloud server are bundled up with the control server’s secret numbers. This measure can effectively prevent impersonation attacks. We also compare the improved protocol with two existing protocols [11, 12] in security and computational efficiency.The rest of the paper is organized as follows. In Section2, we briefly review Amin et al.’s protocol and analyze its weaknesses. The improved protocol is proposed in Section 3. Security cryptanalysis and comparisons are given in Section 4. Finally, the article is concluded in Section 5.


## 2. Amin et al.’s Protocol and Its Weaknesses

This section briefly reviews the Amin et al.’s protocol [13] and shows its weaknesses. In Amin et al.’s protocol, there are three types of entity such as user Ui, service provider server Sm, and control server (CS). The CS is a trusted third party responsible for registration and authentication of users and service providing servers. The Sm provides set of services to Ui. The notations used in this article are recorded in Table 1.Table 1
Notations table.
SymbolDescriptionCSThe control serverSmmth cloud serverSIDmIdentity of themth cloud serverdRandom number ofSmUiith userIDiIdentity of the userUiPiPassword of the userUib1,b2Two random numbers ofUix,ySecret numbers of CSh⋅Hash functionTTimestamp⊕Bit-wise xor operation||Concatenate operation


### 2.1. Amin et al.’s Protocol

Amin et al.’s protocol [13] contains five phases: registration, login, authentication and key agreement, password change, and identity update. For the sake of brevity, password change and identity update phases are not revised.


#### 2.1.1. Registration Phase

During cloud server registration, the cloud serverSm sends SIDm,d to CS. After receiving it, the CS computes PSIDm=hSIDmd and BSm=hPSIDmy and sends BSm to Sm securely. Finally, Sm stores secret parameter BSm,d into his memory.During user registration, the userUi computes Ai=hPib1 and PIDi=hIDib2bbi=b2⊕Ai and sends Ai,PIDi to the CS securely. On getting Ai,PIDi, the CS calculates Ci=hAiPIDi, Di=hPIDix, and Ei=Di⊕Ai. Finally, the CS prepares and delivers a smartcard for each Ui after recording Ci,Ei,h⋅ in the smartcard and transports it to Ui through private communication. After getting it, Ui records DP,bbi in the smartcard, where DP=hIDiPi⊕b1. Finally, the smartcard holds Ci,Ei,DP,bbi,h⋅.


#### 2.1.2. Login Phase

For accessing server resources, a legal userUi first punches the smartcard into card reader and inputs IDi∗ and Pi∗ to the terminal. Then, the card reader calculates b1∗=DP⊕hIDi∗Pi∗, Ai∗=hPi∗bi∗, b2∗=bbi∗⊕Ai∗, PIDi∗=hIDi∗b2∗, and Ci∗=hAi∗PIDi∗. Then, the card reader checks the condition Ci∗=Ci. If Ci∗=Ci, it means that IDi∗=IDi and Pi∗=Pi. The card reader produces a random number Ni and computes Di=Ei⊕Ai, Gi=hPIDiSIDmNiTSiDi, Fi=Di⊕Ni, and Zi=SIDm⊕hDiNi, where SIDm is the cloud server’s identity chosen by the user Ui. Then, the CR transmits the login messages Gi,Fi,Zi,PIDi,TSi to Sm publicly.


#### 2.1.3. Authentication and Key Agreement Phase

This phase is necessary for performing mutual authentication as well as key agreement amongUi, Sm, and CS. The detail explanation of this phase is as follows:Step 1: theSm first checks the condition whether TSm−TSi<ΔT holds or not on receiving the login message, where TSm and ΔT are the cloud server’s current timestamp and expected valid time interval for transmission delay, respectively. If the condition is not true, the Sm terminates the connection; otherwise, the Sm produces a random number Nm and computes Ji=BSm⊕Nm and Ki=hNmBSmGiTSm. Finally, Sm sends Ji,Ki,PSIDm,Gi,Fi,Zi,PIDi,TSi,TSm to the CS publicly.Step 2: on getting messages fromSm, CS first checks the time interval, i.e., TSCS−TSm<ΔT, where TSCSandΔT are the CS’s current timestamp and expected valid time interval for transmission delay, respectively. If the verification holds, CS computes Di=hPIDix, Ni∗=Fi⊕Di, SIDm∗=Zi⊕hDiNi∗, and Gi∗=hPIDiSIDm∗Ni∗TSiDi. After that, the CS checks the condition Gi∗=Gi. If Gi∗=Gi, the CS thinks that the Ui is legal; otherwise, the procedures are terminated. After that, the CS computes BSm∗=hPSIDmy, Nm∗=BSm∗⊕Ji, and Ki∗=hBSm∗Nm∗GiTSm. Again, the CS checks the condition Ki∗=Ki. If Ki∗=Ki, the CS thinks that Sm is legal; otherwise, the procedure is terminated. After that, the CS chooses a random number NCS and computes PCS=Nm⊕NCS⊕hNi||Di, RCS=Ni⊕NCS⊕hBSm∗||Nm∗, SKCS=hNi⊕Nm⊕NCS, QCS=hNm⊕NCS||SKCS, and VCS=hNi⊕NCS||SKCS, where SKCS is the secret session key. Finally, the CS sends PCS,RCS,QCS,VCS to Sm for achieving mutual authentication of the protocol through public communication.Step 3: on getting reply messages from CS,Sm computes Wm=hBSm||Nm, Ni⊕NCS=RCS⊕Wm,SKm=hNi⊕NCS⊕Nm, and VCS∗=hNi⊕NCSSKm. Then, the Sm checks the condition VCS∗=VCS or not. If VCS∗=VCS, the session is terminated; otherwise, messages PCS,QCS are sent to the Ui publicly.Step 4: on obtaining messages fromSm, the Ui calculates Li=hNi||Di, Nm⊕NCS=PCS⊕Li, SKi=hNm⊕NCS⊕Ni, and QCS∗=hNm⊕NCSSKi. Then, the Ui checks the condition QCS∗=QCS, and if QCS∗=QCS, it proves the authenticity of Sm and CS. Finally, the proposed protocol achieves mutual authentication among Ui, Sm, and CS. Now, the Ui and the Sm can exchange their secret information securely using SKm=SKi.


### 2.2. The Weaknesses of Amin et al.’s Protocol

This section shows that Amin et al.’s protocol [13] has some security drawbacks.


#### 2.2.1. Weaknesses in User Registration Phase

During registration in CS, the userUi sends Ai,PIDi to the CS. But, Ai=hPibi and PIDi=hIDi||b2.PIDi is just a pseudoidentity. It is unreasonable for a user to register with a pseudoidentity.


#### 2.2.2. Weaknesses in Authentication and Key Agreement Phase

In authentication and key agreement phase, when the CS receives messagesJi,Ki,PSIDm,Gi,Fi,Zi,PIDi,TSi,TSm from the cloud server Sm, although CS can know the identity SIDm of the server chosen by the user from following calculation,(1)Di=hPIDix,Ni=Fi⊕Di,SIDm=Zi⊕hDiNi,Gi∗=hPIDiSIDmNiTSiDi,and verifying Gi∗=Gi.CS also can know the server with pseudoidentityPSIDm, and the secret value BSm is a legal server by following calculation:(2)BSm=hPSIDmy,Nm=BSm⊕Ji,Ki∗=hBSmNmGiTSm,and verifying Ki∗=Ki.But, the CS cannot tell if the server with pseudoidentityPSIDm and the secret value BSm is the one the user chose with real identity SIDm.Due to the above weaknesses, a malicious server can counterfeit the server chosen by the user, and the CS cannot see through him.


#### 2.2.3. Puzzling Question of the User

Due to the weaknesses in Section2.2.2, the user cannot be convinced that the session key SKi is shared with his chosen server.


## 2.1. Amin et al.’s Protocol

Amin et al.’s protocol [13] contains five phases: registration, login, authentication and key agreement, password change, and identity update. For the sake of brevity, password change and identity update phases are not revised.


### 2.1.1. Registration Phase

During cloud server registration, the cloud serverSm sends SIDm,d to CS. After receiving it, the CS computes PSIDm=hSIDmd and BSm=hPSIDmy and sends BSm to Sm securely. Finally, Sm stores secret parameter BSm,d into his memory.During user registration, the userUi computes Ai=hPib1 and PIDi=hIDib2bbi=b2⊕Ai and sends Ai,PIDi to the CS securely. On getting Ai,PIDi, the CS calculates Ci=hAiPIDi, Di=hPIDix, and Ei=Di⊕Ai. Finally, the CS prepares and delivers a smartcard for each Ui after recording Ci,Ei,h⋅ in the smartcard and transports it to Ui through private communication. After getting it, Ui records DP,bbi in the smartcard, where DP=hIDiPi⊕b1. Finally, the smartcard holds Ci,Ei,DP,bbi,h⋅.


### 2.1.2. Login Phase

For accessing server resources, a legal userUi first punches the smartcard into card reader and inputs IDi∗ and Pi∗ to the terminal. Then, the card reader calculates b1∗=DP⊕hIDi∗Pi∗, Ai∗=hPi∗bi∗, b2∗=bbi∗⊕Ai∗, PIDi∗=hIDi∗b2∗, and Ci∗=hAi∗PIDi∗. Then, the card reader checks the condition Ci∗=Ci. If Ci∗=Ci, it means that IDi∗=IDi and Pi∗=Pi. The card reader produces a random number Ni and computes Di=Ei⊕Ai, Gi=hPIDiSIDmNiTSiDi, Fi=Di⊕Ni, and Zi=SIDm⊕hDiNi, where SIDm is the cloud server’s identity chosen by the user Ui. Then, the CR transmits the login messages Gi,Fi,Zi,PIDi,TSi to Sm publicly.


### 2.1.3. Authentication and Key Agreement Phase

This phase is necessary for performing mutual authentication as well as key agreement amongUi, Sm, and CS. The detail explanation of this phase is as follows:Step 1: theSm first checks the condition whether TSm−TSi<ΔT holds or not on receiving the login message, where TSm and ΔT are the cloud server’s current timestamp and expected valid time interval for transmission delay, respectively. If the condition is not true, the Sm terminates the connection; otherwise, the Sm produces a random number Nm and computes Ji=BSm⊕Nm and Ki=hNmBSmGiTSm. Finally, Sm sends Ji,Ki,PSIDm,Gi,Fi,Zi,PIDi,TSi,TSm to the CS publicly.Step 2: on getting messages fromSm, CS first checks the time interval, i.e., TSCS−TSm<ΔT, where TSCSandΔT are the CS’s current timestamp and expected valid time interval for transmission delay, respectively. If the verification holds, CS computes Di=hPIDix, Ni∗=Fi⊕Di, SIDm∗=Zi⊕hDiNi∗, and Gi∗=hPIDiSIDm∗Ni∗TSiDi. After that, the CS checks the condition Gi∗=Gi. If Gi∗=Gi, the CS thinks that the Ui is legal; otherwise, the procedures are terminated. After that, the CS computes BSm∗=hPSIDmy, Nm∗=BSm∗⊕Ji, and Ki∗=hBSm∗Nm∗GiTSm. Again, the CS checks the condition Ki∗=Ki. If Ki∗=Ki, the CS thinks that Sm is legal; otherwise, the procedure is terminated. After that, the CS chooses a random number NCS and computes PCS=Nm⊕NCS⊕hNi||Di, RCS=Ni⊕NCS⊕hBSm∗||Nm∗, SKCS=hNi⊕Nm⊕NCS, QCS=hNm⊕NCS||SKCS, and VCS=hNi⊕NCS||SKCS, where SKCS is the secret session key. Finally, the CS sends PCS,RCS,QCS,VCS to Sm for achieving mutual authentication of the protocol through public communication.Step 3: on getting reply messages from CS,Sm computes Wm=hBSm||Nm, Ni⊕NCS=RCS⊕Wm,SKm=hNi⊕NCS⊕Nm, and VCS∗=hNi⊕NCSSKm. Then, the Sm checks the condition VCS∗=VCS or not. If VCS∗=VCS, the session is terminated; otherwise, messages PCS,QCS are sent to the Ui publicly.Step 4: on obtaining messages fromSm, the Ui calculates Li=hNi||Di, Nm⊕NCS=PCS⊕Li, SKi=hNm⊕NCS⊕Ni, and QCS∗=hNm⊕NCSSKi. Then, the Ui checks the condition QCS∗=QCS, and if QCS∗=QCS, it proves the authenticity of Sm and CS. Finally, the proposed protocol achieves mutual authentication among Ui, Sm, and CS. Now, the Ui and the Sm can exchange their secret information securely using SKm=SKi.


## 2.1.1. Registration Phase

During cloud server registration, the cloud serverSm sends SIDm,d to CS. After receiving it, the CS computes PSIDm=hSIDmd and BSm=hPSIDmy and sends BSm to Sm securely. Finally, Sm stores secret parameter BSm,d into his memory.During user registration, the userUi computes Ai=hPib1 and PIDi=hIDib2bbi=b2⊕Ai and sends Ai,PIDi to the CS securely. On getting Ai,PIDi, the CS calculates Ci=hAiPIDi, Di=hPIDix, and Ei=Di⊕Ai. Finally, the CS prepares and delivers a smartcard for each Ui after recording Ci,Ei,h⋅ in the smartcard and transports it to Ui through private communication. After getting it, Ui records DP,bbi in the smartcard, where DP=hIDiPi⊕b1. Finally, the smartcard holds Ci,Ei,DP,bbi,h⋅.


## 2.1.2. Login Phase

For accessing server resources, a legal userUi first punches the smartcard into card reader and inputs IDi∗ and Pi∗ to the terminal. Then, the card reader calculates b1∗=DP⊕hIDi∗Pi∗, Ai∗=hPi∗bi∗, b2∗=bbi∗⊕Ai∗, PIDi∗=hIDi∗b2∗, and Ci∗=hAi∗PIDi∗. Then, the card reader checks the condition Ci∗=Ci. If Ci∗=Ci, it means that IDi∗=IDi and Pi∗=Pi. The card reader produces a random number Ni and computes Di=Ei⊕Ai, Gi=hPIDiSIDmNiTSiDi, Fi=Di⊕Ni, and Zi=SIDm⊕hDiNi, where SIDm is the cloud server’s identity chosen by the user Ui. Then, the CR transmits the login messages Gi,Fi,Zi,PIDi,TSi to Sm publicly.


## 2.1.3. Authentication and Key Agreement Phase

This phase is necessary for performing mutual authentication as well as key agreement amongUi, Sm, and CS. The detail explanation of this phase is as follows:Step 1: theSm first checks the condition whether TSm−TSi<ΔT holds or not on receiving the login message, where TSm and ΔT are the cloud server’s current timestamp and expected valid time interval for transmission delay, respectively. If the condition is not true, the Sm terminates the connection; otherwise, the Sm produces a random number Nm and computes Ji=BSm⊕Nm and Ki=hNmBSmGiTSm. Finally, Sm sends Ji,Ki,PSIDm,Gi,Fi,Zi,PIDi,TSi,TSm to the CS publicly.Step 2: on getting messages fromSm, CS first checks the time interval, i.e., TSCS−TSm<ΔT, where TSCSandΔT are the CS’s current timestamp and expected valid time interval for transmission delay, respectively. If the verification holds, CS computes Di=hPIDix, Ni∗=Fi⊕Di, SIDm∗=Zi⊕hDiNi∗, and Gi∗=hPIDiSIDm∗Ni∗TSiDi. After that, the CS checks the condition Gi∗=Gi. If Gi∗=Gi, the CS thinks that the Ui is legal; otherwise, the procedures are terminated. After that, the CS computes BSm∗=hPSIDmy, Nm∗=BSm∗⊕Ji, and Ki∗=hBSm∗Nm∗GiTSm. Again, the CS checks the condition Ki∗=Ki. If Ki∗=Ki, the CS thinks that Sm is legal; otherwise, the procedure is terminated. After that, the CS chooses a random number NCS and computes PCS=Nm⊕NCS⊕hNi||Di, RCS=Ni⊕NCS⊕hBSm∗||Nm∗, SKCS=hNi⊕Nm⊕NCS, QCS=hNm⊕NCS||SKCS, and VCS=hNi⊕NCS||SKCS, where SKCS is the secret session key. Finally, the CS sends PCS,RCS,QCS,VCS to Sm for achieving mutual authentication of the protocol through public communication.Step 3: on getting reply messages from CS,Sm computes Wm=hBSm||Nm, Ni⊕NCS=RCS⊕Wm,SKm=hNi⊕NCS⊕Nm, and VCS∗=hNi⊕NCSSKm. Then, the Sm checks the condition VCS∗=VCS or not. If VCS∗=VCS, the session is terminated; otherwise, messages PCS,QCS are sent to the Ui publicly.Step 4: on obtaining messages fromSm, the Ui calculates Li=hNi||Di, Nm⊕NCS=PCS⊕Li, SKi=hNm⊕NCS⊕Ni, and QCS∗=hNm⊕NCSSKi. Then, the Ui checks the condition QCS∗=QCS, and if QCS∗=QCS, it proves the authenticity of Sm and CS. Finally, the proposed protocol achieves mutual authentication among Ui, Sm, and CS. Now, the Ui and the Sm can exchange their secret information securely using SKm=SKi.


## 2.2. The Weaknesses of Amin et al.’s Protocol

This section shows that Amin et al.’s protocol [13] has some security drawbacks.


### 2.2.1. Weaknesses in User Registration Phase

During registration in CS, the userUi sends Ai,PIDi to the CS. But, Ai=hPibi and PIDi=hIDi||b2.PIDi is just a pseudoidentity. It is unreasonable for a user to register with a pseudoidentity.


### 2.2.2. Weaknesses in Authentication and Key Agreement Phase

In authentication and key agreement phase, when the CS receives messagesJi,Ki,PSIDm,Gi,Fi,Zi,PIDi,TSi,TSm from the cloud server Sm, although CS can know the identity SIDm of the server chosen by the user from following calculation,(1)Di=hPIDix,Ni=Fi⊕Di,SIDm=Zi⊕hDiNi,Gi∗=hPIDiSIDmNiTSiDi,and verifying Gi∗=Gi.CS also can know the server with pseudoidentityPSIDm, and the secret value BSm is a legal server by following calculation:(2)BSm=hPSIDmy,Nm=BSm⊕Ji,Ki∗=hBSmNmGiTSm,and verifying Ki∗=Ki.But, the CS cannot tell if the server with pseudoidentityPSIDm and the secret value BSm is the one the user chose with real identity SIDm.Due to the above weaknesses, a malicious server can counterfeit the server chosen by the user, and the CS cannot see through him.


### 2.2.3. Puzzling Question of the User

Due to the weaknesses in Section2.2.2, the user cannot be convinced that the session key SKi is shared with his chosen server.


## 2.2.1. Weaknesses in User Registration Phase

During registration in CS, the userUi sends Ai,PIDi to the CS. But, Ai=hPibi and PIDi=hIDi||b2.PIDi is just a pseudoidentity. It is unreasonable for a user to register with a pseudoidentity.


## 2.2.2. Weaknesses in Authentication and Key Agreement Phase

In authentication and key agreement phase, when the CS receives messagesJi,Ki,PSIDm,Gi,Fi,Zi,PIDi,TSi,TSm from the cloud server Sm, although CS can know the identity SIDm of the server chosen by the user from following calculation,(1)Di=hPIDix,Ni=Fi⊕Di,SIDm=Zi⊕hDiNi,Gi∗=hPIDiSIDmNiTSiDi,and verifying Gi∗=Gi.CS also can know the server with pseudoidentityPSIDm, and the secret value BSm is a legal server by following calculation:(2)BSm=hPSIDmy,Nm=BSm⊕Ji,Ki∗=hBSmNmGiTSm,and verifying Ki∗=Ki.But, the CS cannot tell if the server with pseudoidentityPSIDm and the secret value BSm is the one the user chose with real identity SIDm.Due to the above weaknesses, a malicious server can counterfeit the server chosen by the user, and the CS cannot see through him.


## 2.2.3. Puzzling Question of the User

Due to the weaknesses in Section2.2.2, the user cannot be convinced that the session key SKi is shared with his chosen server.


## 3. The Improved Protocol

To overcome the shortcomings of Amin et al.’s protocol, in this section, an improved protocol is proposed. Also, for the sake of brevity, only the registration, login, and authentication key agreement phases are described.


### 3.1. Registration Phase

Suppose the control server CS is a trusted third party responsible for registration and authentication of users and cloud servers. CS chooses two random secret numbersx and y.In registration phase, any cloud server and user can register with CS. When one cloud serverSm wants register with CS, it chooses its identity SIDm and a random number d. Then, it sends SIDm,d to the control server CS. After CS receives SIDm,d, CS computes(3)PSIDm=hSIDmd,BSm=hPSIDmSIDmy,and sends BSm to the cloud server Sm through the secure channel. Once Sm receives BSm, Sm stores secret parameters BSm,d.When one userUi registers with CS, Ui chooses his identity IDi and password Pi. Then, Ui calculates Ai=Pi⊕hBi. Here, Bi is his biometric. Finally, Ui submits IDi,Ai to the CS through the secure channel. On receiving the message, CS chooses a random number bi and computes(4)PIDi=hIDibi,Ci=hIDiAi,Di=hPIDix,Ei=Di⊕Ai,Δi=hPIDiIDix,Ωi=bi⊕Ai,and issues a smart card containing the information Ci,Ωi,Δi,Ei,h⋅ to the user Ui.


### 3.2. Login Phase

After punching his smart card, a userUi provides IDi∗, Pi∗, and Bi∗ to the card reader. The card reader computes(5)Ai∗=Pi∗⊕hBi∗,Ci∗=hIDi∗Ai∗.Then, the card reader checks whetherCi∗=Ci or not. When Ci∗=Ci, IDi∗=IDi, Pi∗=Pi, and Bi∗=Bi, Ai∗=Ai. Then, the card reader chooses a random number Ni and computes(6)bi=Ωi⊕Ai,PIDi=hIDibi,Di=Ei⊕Ai,Oi=IDi⊕Di,Gi=hIDiSIDmNiTSiDi,Fi=Δi⊕Ni,Zi=SIDm⊕hDiNi,where SIDm is the identity of the cloud server Sm chosen by the user Ui. Then, the card reader sends the login messages Gi,Fi,Zi,Oi,PIDi,TSi to the cloud server Sm publicly. TSi is the Ui’s current timestamp.


### 3.3. Authentication Key Agreement Phase

This phase includes four steps. It is also illustrated in Figure1.Step 1: onceSm receives the login message, Sm checks the condition whether TSm−TSi<ΔT holds or not. If the condition is true, Sm chooses a random number Nm and computes(7)Ji=BSm⊕Nm,Ki=hNmBSmPIDiGiTSm.Then, theSm submits Ji,Ki,PSIDm,Gi,Fi,Zi,Oi,PIDi,TSi,TSm to the CS. Here, TSm and ΔT are the cloud server’s current timestamp and expected time interval for transmission delay, respectively.Step 2: on receiving the messages fromSm, CS first checks whether TSCS−TSm<ΔT holds or not, where TSCSandΔT are the similar meanings mentioned before. If the verification holds, CS calculates(8)Di=hPIDix,IDi=Oi⊕Di,Ni=Fi⊕hPIDiIDix,SIDm=Zi⊕hDiNi,Gi∗=hIDiSIDmNiTSiDi.Then, the CS checks whetherGi∗=Gi holds or not. If Gi∗=Gi, the CS believes the Ui with real identity IDi is legal. Then, the CS computes(9)BSm=hPSIDmSIDmy,Nm=BSm⊕Ji,Ki∗=hNmBSmPIDiGiTSm.Then, the CS checks the conditionKi∗=Ki. If Ki∗=Ki, the CS believes Sm with real SIDm is legal and chosen by the user Ui. Then, the CS produces a random number NCS and computes(10)PCS=Nm⊕NCS⊕hNiDiFi,RCS=Ni⊕NCS⊕hBSmNm,SKCS=hNi⊕Nm⊕NCS,QCS=hNm⊕NCSSKCS,VCS=hNi⊕NCSSKCS.Then, the CS sendsPCS,RCS,QCS,VCS to the Sm publicly.Step 3: on receiving the reply messages from CS,Sm computes(11)Wm=hBSmNm,Ni⊕NCS=RCS⊕Wm,SKm=hNi⊕NCS⊕Nm,VCS∗=hNi⊕NCSSKm.Then, theSm checks the condition VCS∗=VCS. If VCS∗=VCS, Sm sends messages PCS,QCS to the Ui publicly.Step 4: on receiving messages fromSm, the Ui calculates(12)Li=hNiDiFi,Nm⊕NCS=PCS⊕Li,SKi=hNm⊕NCS⊕Ni,QCS∗=hNm⊕NCSSKi.Next, theUi checks whether QCS∗=QCS. If QCS∗=QCS, Ui believes the authenticity of Sm and CS and shares a session key SKi=SKm with the cloud server Sm.Figure 1
Authentication key agreement phase.


## 3.1. Registration Phase

Suppose the control server CS is a trusted third party responsible for registration and authentication of users and cloud servers. CS chooses two random secret numbersx and y.In registration phase, any cloud server and user can register with CS. When one cloud serverSm wants register with CS, it chooses its identity SIDm and a random number d. Then, it sends SIDm,d to the control server CS. After CS receives SIDm,d, CS computes(3)PSIDm=hSIDmd,BSm=hPSIDmSIDmy,and sends BSm to the cloud server Sm through the secure channel. Once Sm receives BSm, Sm stores secret parameters BSm,d.When one userUi registers with CS, Ui chooses his identity IDi and password Pi. Then, Ui calculates Ai=Pi⊕hBi. Here, Bi is his biometric. Finally, Ui submits IDi,Ai to the CS through the secure channel. On receiving the message, CS chooses a random number bi and computes(4)PIDi=hIDibi,Ci=hIDiAi,Di=hPIDix,Ei=Di⊕Ai,Δi=hPIDiIDix,Ωi=bi⊕Ai,and issues a smart card containing the information Ci,Ωi,Δi,Ei,h⋅ to the user Ui.


## 3.2. Login Phase

After punching his smart card, a userUi provides IDi∗, Pi∗, and Bi∗ to the card reader. The card reader computes(5)Ai∗=Pi∗⊕hBi∗,Ci∗=hIDi∗Ai∗.Then, the card reader checks whetherCi∗=Ci or not. When Ci∗=Ci, IDi∗=IDi, Pi∗=Pi, and Bi∗=Bi, Ai∗=Ai. Then, the card reader chooses a random number Ni and computes(6)bi=Ωi⊕Ai,PIDi=hIDibi,Di=Ei⊕Ai,Oi=IDi⊕Di,Gi=hIDiSIDmNiTSiDi,Fi=Δi⊕Ni,Zi=SIDm⊕hDiNi,where SIDm is the identity of the cloud server Sm chosen by the user Ui. Then, the card reader sends the login messages Gi,Fi,Zi,Oi,PIDi,TSi to the cloud server Sm publicly. TSi is the Ui’s current timestamp.


## 3.3. Authentication Key Agreement Phase

This phase includes four steps. It is also illustrated in Figure1.Step 1: onceSm receives the login message, Sm checks the condition whether TSm−TSi<ΔT holds or not. If the condition is true, Sm chooses a random number Nm and computes(7)Ji=BSm⊕Nm,Ki=hNmBSmPIDiGiTSm.Then, theSm submits Ji,Ki,PSIDm,Gi,Fi,Zi,Oi,PIDi,TSi,TSm to the CS. Here, TSm and ΔT are the cloud server’s current timestamp and expected time interval for transmission delay, respectively.Step 2: on receiving the messages fromSm, CS first checks whether TSCS−TSm<ΔT holds or not, where TSCSandΔT are the similar meanings mentioned before. If the verification holds, CS calculates(8)Di=hPIDix,IDi=Oi⊕Di,Ni=Fi⊕hPIDiIDix,SIDm=Zi⊕hDiNi,Gi∗=hIDiSIDmNiTSiDi.Then, the CS checks whetherGi∗=Gi holds or not. If Gi∗=Gi, the CS believes the Ui with real identity IDi is legal. Then, the CS computes(9)BSm=hPSIDmSIDmy,Nm=BSm⊕Ji,Ki∗=hNmBSmPIDiGiTSm.Then, the CS checks the conditionKi∗=Ki. If Ki∗=Ki, the CS believes Sm with real SIDm is legal and chosen by the user Ui. Then, the CS produces a random number NCS and computes(10)PCS=Nm⊕NCS⊕hNiDiFi,RCS=Ni⊕NCS⊕hBSmNm,SKCS=hNi⊕Nm⊕NCS,QCS=hNm⊕NCSSKCS,VCS=hNi⊕NCSSKCS.Then, the CS sendsPCS,RCS,QCS,VCS to the Sm publicly.Step 3: on receiving the reply messages from CS,Sm computes(11)Wm=hBSmNm,Ni⊕NCS=RCS⊕Wm,SKm=hNi⊕NCS⊕Nm,VCS∗=hNi⊕NCSSKm.Then, theSm checks the condition VCS∗=VCS. If VCS∗=VCS, Sm sends messages PCS,QCS to the Ui publicly.Step 4: on receiving messages fromSm, the Ui calculates(12)Li=hNiDiFi,Nm⊕NCS=PCS⊕Li,SKi=hNm⊕NCS⊕Ni,QCS∗=hNm⊕NCSSKi.Next, theUi checks whether QCS∗=QCS. If QCS∗=QCS, Ui believes the authenticity of Sm and CS and shares a session key SKi=SKm with the cloud server Sm.Figure 1
Authentication key agreement phase.


## 4. Security Analysis and Comparisons

### 4.1. Security Analysis

This section shows that the improved protocol is well protected against relevant security threats. Firstly, like Amin et al.’s protocol [13], the improved protocol is user anonymous and protected against password guessing attack, replay attack, insider attack, and session key discloser attack. For the shortcomings of Amin et al.’s protocol, the following analysis is focused on the improved protocol against impersonation attack.In cloud server registration phase of the improved protocol, the cloud serverSm with identity SIDm and pseudoidentity PSIDm has secret value(13)BSm=hPSIDmSIDmy,computed by the control server CS. So, in the authentication phase, if one cloud server Sm∗ not chosen by the user Ui counterfeits Sm, Sm∗ intercepts the login messages Gi,Fi,Zi,Oi,PIDi,TSi from Ui and computes(14)Ji=BSm∗⊕Nm∗,Ki=hNmBSm∗PIDiGiTSm∗,where BSm∗=hPSIDm∗SIDm∗y. Then, Sm∗ sends(15)Ji,Ki,PSIDm∗,Gi,Fi,Zi,Oi,PIDi,TSi,TSm∗,to the CS publicly. But, CS obtains the identity SIDm of the cloud server Sm chosen by the user Ui from Zi and computes(16)BS¯m∗=hPSIDm∗SIDmy,Nm∗=BS¯m∗⊕Ji,Ki∗=hNm∗BS¯m∗PIDiGiTSm∗.Obviously, due toBSm∗≠BS¯m∗, then Ki∗≠Ki. So, Sm∗ cannot pass the CS’s verification.IfSm∗ wants to tamper Zi by computing Zi∗=SIDm∗⊕hDi∗Ni∗, since Di∗≠Di and Ni∗≠Ni, Sm∗ also cannot pass the CS’s verification.Therefore, the improved protocol is protected against cloud server impersonation attack.In Amin et al.’s protocol, CS does not know the real identities of the user. But, in improved protocol, we useOi to show the real identities of the user. Also, Δi=hPIDiIDix is used in the improved protocol, and the user cannot pass CS’s verification if he uses false identity.In summary, the improved protocol completely overcomes the shortcomings of Amin et al.’s protocol. In the improved protocol, neither the user nor the cloud server can launch impersonation attacks. In the improved protocol, the user and the cloud server can use the shared session key between them with trust.


### 4.2. Comparisons

In this section, the comparison of the improved protocol with other protocols [11,13] is shown. The comparison results of the security features and computation costs are shown, respectively, in Tables 2 and 3.Table 2
Comparison of security.
F1F2F3F4F5F6F7Xue et al. [11]YesNoYesYesYesYesYesAmin et al. [13]YesYesYesYesYesNoNoImproved protocolYesYesYesYesYesYesYesF1: user anonymity; F2: resist password guessing attack; F3: resist replay attack; F4: resist insider attack; F5: resist session key discloser attack; F6: resist impersonation attack; F7: CS knows the real identities of users and cloud servers.Table 3
Comparison of computation costs.
P1P2P3P4Xue et al. [11]7H + 2X5H + 5X25H + 25X37H + 32XImproved protocol7H + 3X5H + 6X18H + 21X30H + 30XP1: registration phase; P2: login phase; P3: authentication phase; P4: total computation cost; H: hash computation and its time cost; X: xor operation and its time cost.From Table2, the improved protocol is superior to the protocols [11,13] in terms of security. Furthermore, in Table 3, the comparison of computation costs is shown between the improved protocol and the relatively good protocol [11]. From Table 3, the total computation cost of the protocol [11] is 37H + 32X, but the total computational cost of the improved scheme is 30H + 30X. The computation cost of the improved protocol is significantly less than the protocol [11].


## 4.1. Security Analysis

This section shows that the improved protocol is well protected against relevant security threats. Firstly, like Amin et al.’s protocol [13], the improved protocol is user anonymous and protected against password guessing attack, replay attack, insider attack, and session key discloser attack. For the shortcomings of Amin et al.’s protocol, the following analysis is focused on the improved protocol against impersonation attack.In cloud server registration phase of the improved protocol, the cloud serverSm with identity SIDm and pseudoidentity PSIDm has secret value(13)BSm=hPSIDmSIDmy,computed by the control server CS. So, in the authentication phase, if one cloud server Sm∗ not chosen by the user Ui counterfeits Sm, Sm∗ intercepts the login messages Gi,Fi,Zi,Oi,PIDi,TSi from Ui and computes(14)Ji=BSm∗⊕Nm∗,Ki=hNmBSm∗PIDiGiTSm∗,where BSm∗=hPSIDm∗SIDm∗y. Then, Sm∗ sends(15)Ji,Ki,PSIDm∗,Gi,Fi,Zi,Oi,PIDi,TSi,TSm∗,to the CS publicly. But, CS obtains the identity SIDm of the cloud server Sm chosen by the user Ui from Zi and computes(16)BS¯m∗=hPSIDm∗SIDmy,Nm∗=BS¯m∗⊕Ji,Ki∗=hNm∗BS¯m∗PIDiGiTSm∗.Obviously, due toBSm∗≠BS¯m∗, then Ki∗≠Ki. So, Sm∗ cannot pass the CS’s verification.IfSm∗ wants to tamper Zi by computing Zi∗=SIDm∗⊕hDi∗Ni∗, since Di∗≠Di and Ni∗≠Ni, Sm∗ also cannot pass the CS’s verification.Therefore, the improved protocol is protected against cloud server impersonation attack.In Amin et al.’s protocol, CS does not know the real identities of the user. But, in improved protocol, we useOi to show the real identities of the user. Also, Δi=hPIDiIDix is used in the improved protocol, and the user cannot pass CS’s verification if he uses false identity.In summary, the improved protocol completely overcomes the shortcomings of Amin et al.’s protocol. In the improved protocol, neither the user nor the cloud server can launch impersonation attacks. In the improved protocol, the user and the cloud server can use the shared session key between them with trust.


## 4.2. Comparisons

In this section, the comparison of the improved protocol with other protocols [11,13] is shown. The comparison results of the security features and computation costs are shown, respectively, in Tables 2 and 3.Table 2
Comparison of security.
F1F2F3F4F5F6F7Xue et al. [11]YesNoYesYesYesYesYesAmin et al. [13]YesYesYesYesYesNoNoImproved protocolYesYesYesYesYesYesYesF1: user anonymity; F2: resist password guessing attack; F3: resist replay attack; F4: resist insider attack; F5: resist session key discloser attack; F6: resist impersonation attack; F7: CS knows the real identities of users and cloud servers.Table 3
Comparison of computation costs.
P1P2P3P4Xue et al. [11]7H + 2X5H + 5X25H + 25X37H + 32XImproved protocol7H + 3X5H + 6X18H + 21X30H + 30XP1: registration phase; P2: login phase; P3: authentication phase; P4: total computation cost; H: hash computation and its time cost; X: xor operation and its time cost.From Table2, the improved protocol is superior to the protocols [11,13] in terms of security. Furthermore, in Table 3, the comparison of computation costs is shown between the improved protocol and the relatively good protocol [11]. From Table 3, the total computation cost of the protocol [11] is 37H + 32X, but the total computational cost of the improved scheme is 30H + 30X. The computation cost of the improved protocol is significantly less than the protocol [11].


## 5. Conclusion

In this paper, we find that Amin et al.’s authentication protocol is vulnerable to several weaknesses. To overcome the shortcomings of Amin et al.’s protocol, we propose an improved protocol. We also compare the improved protocol with several existing authentication protocols in security and computational efficiency. The improved protocol not only completely overcomes the shortcomings of Amin et al.’s protocol but also has less computation cost.



---

*Source: 1970798-2020-06-23.xml*