# Secure Three-Factor Anonymous User Authentication Scheme for Cloud Computing Environment

Authors: Hakjun Lee; Dongwoo Kang; Youngsook Lee; Dongho Won
Journal: Wireless Communications and Mobile Computing
 (2021)

---

## Abstract

Cloud computing provides virtualized information technology (IT) resources to ensure the workflow desired by user at any time and location; it allows users to borrow computing resources such as software, storage, and servers, as per their needs without the requirements of complicated network and server configurations. With the generalization of small embedded sensor devices and the commercialization of the Internet of Things (IoT), short- and long-range wireless network technologies are being developed rapidly, and the demand for deployment of cloud computing for IoT is increasing significantly. Cloud computing, together with IoT technology, can be used to collect and analyse large amounts of data generated from sensor devices, and easily manage heterogeneous IoT devices such as software updates, network flow control, and user management. In cloud computing, attacks on users and servers can be a serious threat to user privacy. Thus, various user authentication schemes have been proposed to prevent different types of attacks. In this paper, we discuss the security and functional weakness of the related user authentication schemes used in cloud computing and propose a new elliptic curve cryptography- (ECC-) based three-factor authentication scheme to overcome the security shortcomings of existing authentication schemes. To confirm the security of the proposed scheme, we conducted both formal and informal analyses. Finally, we compared the performance of the proposed scheme with those of related schemes to verify that the proposed scheme can be deployed in the real world.


---

## Body

## 1. Introduction

With the significant advances in information technology (IT), numerous types of devices can connect to the Internet and have a variety of features that can be used for different purposes. Using these devices with wireless network technologies, such as Wi-Fi, Bluetooth, 5G, 6lowPAN, and LoRa, has allowed the practical deployment of Internet of Things (IoT) [1]. IoT enables the networking of various types of embedded devices, such as home, mobile, and wearable devices, allowing them to communicate with people and objects at any time and location in our daily lives [2].With combined with cloud computing, IoT technologies can collect and analyse large amounts of data from devices connected to an IoT network with hyperconnectivity and hyperintelligence surpassing the limits of time and space in various areas such as urban life, traffic, welfare, safety, healthcare, manufacturing, energy, finance, and logistics [3, 4]. Cloud computing provides IT resources on demand over the Internet. Cloud computing providers are building and maintaining physical data centers and servers, and users can enjoy the benefits of custom cloud services for greater computing power, storage, and database.With such advantages, cloud computing is becoming a paradigm for the processing, storage, and utilization of large amounts of data generated by billions of smart devices because it can overcome the limitations of such devices, including low capacity and limited processing capability. The integration of IoT with cloud computing allows for better scalability, interoperability, reliability, efficiency, availability, and security through the utilization of various devices and technologies [5]. In addition, it provides benefits such as easy access, use, and deployment-cost reductions. A cloud computing environment can serve as a stable network environment for connection with IoT devices and provide storage for big data generated from IoT devices to securely keep and process the data for analysis. With these advantages, both individuals and small companies can benefit from cloud services.In general, there are three types of cloud services [6]:(1)
Infrastructure as a service (IaaS): providing the user with an infrastructure including storage and network use(2)
Platform as a service (PaaS): providing the user with a platform to develop various applications(3)
Software as a service (SaaS): providing the user with software applicationsBecause cloud computing is deployed in a practical manner, there have been growing concerns regarding its security. As mentioned earlier, clouds are used in various industries and services; thus, cloud servers can collect and process sensitive data, and it can seriously affect user privacy.Security issues associated with cloud computing include various aspects such as embedded security, application security, trust and conviction, client management, cloud data storage, and operating systems. Among the different security requirements, the first security requirement for the protection of user privacy is user authentication that verifies a user’s identity with a trusted party. There are three authentication factors used to verify the user identity: (i) what you know (e.g., secret information such as a password), (ii) what you have (e.g., things we own such as smart cards), and (iii) who you are (e.g., biometric such as fingerprint or iris data) [7].In recent years, various user authentication schemes have been proposed [8–12], and user authentication studies using various cryptographic primitives have been proposed to protect a user’s personal information in a cloud environment. However, the investigation into such studies has revealed that the level of security is still insufficient to authenticate and manage users in the current cloud computing environment. Therefore, in this paper, to strengthen the security of previously proposed schemes, we first report problems in the related authentication scheme used in a cloud computing environment and then propose a new authentication scheme to overcome these problems.


### 1.1. Motivations

Since Lamport [13] first proposed a password-based authentication scheme, many relevant studies on suitable two-factor authentication schemes in various network environments have been proposed to protect user privacy. After the introduction of cloud computing systems, authentication schemes using various encryption technologies, including the Advanced Encryption Standard (AES), hash function, Chebyshev polynomials, and Elliptic Curve Cryptography (ECC), began to be studied to provide secure user authentication and improve security and efficiency.Amin et al. [14] proposed a user authentication scheme for a distributed IoT cloud environment. However, Wang et al. [15] found that Amin et al.’s scheme has some weaknesses—it is vulnerable to a stolen smart card attack, violates user anonymity and forward secrecy, has a time synchronization problem, and provides an insecure identity update phase. Wang et al. [15] also proposed a new authentication scheme to eliminate the security concern associated with Amin et al.’s scheme [14] by applying ECC to share the session key between the user and the cloud server. Nevertheless, their scheme does not provide a session key verification at the end of the authentication phase—an invalid session key may be generated between the user and the cloud server without detecting communication errors that may occur while sharing the parameters for the establishment of a session key.In 2017, Kumari et al. [16] proposed a biometrics-based three-factor authentication scheme in a multicloud server environment using ECC and proved that the scheme is secure for cloud computing environments, but it does not provide an identity update phase.In 2019, Zhou et al. [17] proposed a lightweight authentication scheme for an IoT-cloud architecture using only hash and exclusive-OR (XOR) operations; it is relatively lightweight in comparison with other schemes [14, 18] and satisfies some of the security properties required for cloud computing. However, Martínez-Peláez et al. [19] reported that Wang et al.’s scheme [15] has security vulnerabilities to insider attacks, man-in-the-middle attacks through a replay attack, and user impersonation attacks. Martínez-Peláez et al. [19] then proposed a new lightweight authentication scheme to provide secure access to user by improving the scheme developed by Zhou et al. [17]. However, Yu et al. [20] found that Martínez-Peláez et al.’s scheme [19] is vulnerable to impersonation attacks, session key-disclosure attacks, and replay attacks and that it does not ensure user anonymity. Yu et al. [20] then proposed a lightweight three-factor-based authentication scheme for IoT use in a cloud computing environment to enhance the level of security. In their scheme, the cloud server changes the identity of the user during each session. However, users cannot recover or update their own identity themselves.In this paper, based on the same network model used in the abovementioned related schemes for cloud computing, we propose a new three-factor user authentication scheme to enhance the level of security and efficiently manage users by eliminating the security and functional flaws of the related schemes. In the proposed scheme, we selected the ECC from various cryptographic building blocks, which has various advantages. For example, the safety of the ECC system increases exponentially with the key length and has a shorter key length and faster operation speed than those of the RSA algorithm. This is particularly effective in applications where the processing capacity is limited; these include memory, smart cards, and wireless communication terminals [21]. ECC has been standardized for digital signature algorithms and key exchanges (e.g., ANSI X9.62 and X9.63) and is widely accepted in various network communication standards such as IPsec (RFC 2409) and TLS (RFC 4492).


### 1.2. Organization of the Paper

The remainder of this paper is organized as follows. Section2 presents the preliminaries for security considerations and background of the network model. In Section 3, we detail a secure three-factor anonymous user authentication scheme for a cloud computing environment. We describe the informal and formal security analyses in Sections 4 and 5, respectively. In Section 6, we evaluate the performance of the proposed scheme. Finally, we provide some concluding remarks in Section 7.


## 1.1. Motivations

Since Lamport [13] first proposed a password-based authentication scheme, many relevant studies on suitable two-factor authentication schemes in various network environments have been proposed to protect user privacy. After the introduction of cloud computing systems, authentication schemes using various encryption technologies, including the Advanced Encryption Standard (AES), hash function, Chebyshev polynomials, and Elliptic Curve Cryptography (ECC), began to be studied to provide secure user authentication and improve security and efficiency.Amin et al. [14] proposed a user authentication scheme for a distributed IoT cloud environment. However, Wang et al. [15] found that Amin et al.’s scheme has some weaknesses—it is vulnerable to a stolen smart card attack, violates user anonymity and forward secrecy, has a time synchronization problem, and provides an insecure identity update phase. Wang et al. [15] also proposed a new authentication scheme to eliminate the security concern associated with Amin et al.’s scheme [14] by applying ECC to share the session key between the user and the cloud server. Nevertheless, their scheme does not provide a session key verification at the end of the authentication phase—an invalid session key may be generated between the user and the cloud server without detecting communication errors that may occur while sharing the parameters for the establishment of a session key.In 2017, Kumari et al. [16] proposed a biometrics-based three-factor authentication scheme in a multicloud server environment using ECC and proved that the scheme is secure for cloud computing environments, but it does not provide an identity update phase.In 2019, Zhou et al. [17] proposed a lightweight authentication scheme for an IoT-cloud architecture using only hash and exclusive-OR (XOR) operations; it is relatively lightweight in comparison with other schemes [14, 18] and satisfies some of the security properties required for cloud computing. However, Martínez-Peláez et al. [19] reported that Wang et al.’s scheme [15] has security vulnerabilities to insider attacks, man-in-the-middle attacks through a replay attack, and user impersonation attacks. Martínez-Peláez et al. [19] then proposed a new lightweight authentication scheme to provide secure access to user by improving the scheme developed by Zhou et al. [17]. However, Yu et al. [20] found that Martínez-Peláez et al.’s scheme [19] is vulnerable to impersonation attacks, session key-disclosure attacks, and replay attacks and that it does not ensure user anonymity. Yu et al. [20] then proposed a lightweight three-factor-based authentication scheme for IoT use in a cloud computing environment to enhance the level of security. In their scheme, the cloud server changes the identity of the user during each session. However, users cannot recover or update their own identity themselves.In this paper, based on the same network model used in the abovementioned related schemes for cloud computing, we propose a new three-factor user authentication scheme to enhance the level of security and efficiently manage users by eliminating the security and functional flaws of the related schemes. In the proposed scheme, we selected the ECC from various cryptographic building blocks, which has various advantages. For example, the safety of the ECC system increases exponentially with the key length and has a shorter key length and faster operation speed than those of the RSA algorithm. This is particularly effective in applications where the processing capacity is limited; these include memory, smart cards, and wireless communication terminals [21]. ECC has been standardized for digital signature algorithms and key exchanges (e.g., ANSI X9.62 and X9.63) and is widely accepted in various network communication standards such as IPsec (RFC 2409) and TLS (RFC 4492).


## 1.2. Organization of the Paper

The remainder of this paper is organized as follows. Section2 presents the preliminaries for security considerations and background of the network model. In Section 3, we detail a secure three-factor anonymous user authentication scheme for a cloud computing environment. We describe the informal and formal security analyses in Sections 4 and 5, respectively. In Section 6, we evaluate the performance of the proposed scheme. Finally, we provide some concluding remarks in Section 7.


## 2. Preliminary

### 2.1. Network Model

The network model of the proposed protocol in the IoT environment is based on the cloud server environment adopted in the protocol described in [16–20], as shown in Figure 1. There are three participants in this model:(1)
Registration authority (RA): RA is a trusted authority that creates all system parameters and issues them to users and cloud servers through the registration process(2)
User (Ui): Ui wishes to access and enjoy the services provided by the cloud server using IoT device. For this purpose, the RA shares the session key with the cloud server(3)
Cloud server (CSj): CSj provides IoT cloud services to usersFigure 1
System architecture of cloud computing service with IoT.This network model is for a cloud server-centric service in which the cloud server collects and processes information from IoT devices and shares it with users. For example, a real-world scenario for this is as follows: Alex’s grandfather has dementia, and his family is concerned about his grandfather’s health and fear of getting lost when he goes out. The smartwatch worn by the grandfather can check the health condition through the built-in sensor and transmits the GPS information to the cloud server. Alex’s family wants to use a service that can trace and check the location and health of their grandfather in real time. To this end, Alex’s family and grandfather (Ui) first register their identifier with the registration authority (RA) to sign up for this IoT-based cloud service. RA issues security parameters to be used when establishing session key with CSj (assume that CSj is already registered). Information about the grandfather is sensitive. It should be shared only with the family. To this end, Alex creates a group through the interface provided by the cloud platform, adds family members as group members, and adds the devices of grandpa’s smartwatch and family’s smartphone to set permission to access information shared by registered devices. Ui and CSj generate the session key through the authentication process; the family and grandfather can safely share information.


### 2.2. Elliptic Curve Cryptography

In this study, we apply an elliptic curve cryptography to the proposed scheme, which provides a high level of security with a small key size [22]. ECC is based on the logarithm problems expressed in the point addition and multiplication of elliptic curves.An elliptic curve is given byEpa,b:y2=x3+ax+b mod p over a finite field Fp, where p is the prime order and a,b∈Fp such that p>3 and 4a3+27b2≠0 mod p. The point multiplication over Epa,b is defined through a repetitive addition as +P+⋯+Patimes=aP, where P is a point on Epa,b and a∈Fp∗ is a random integer. The security of ECC relies on the following assumption:(1)
Elliptic curve discrete logarithm problem (ECDLP): givenP, aP∈Epa,b, it is computationally infeasible to find a within polynomial time(2)
Elliptic curve computational Diffie-Hellman problem (ECCDHP): givenaP,bP∈Epa,b, it is computationally infeasible to find abP in polynomial time


### 2.3. Bio-Hash Function

In the proposed scheme, we use a bio-hash function. In 2004, Jin et al. [23] proposed a solution to the problem of false resection in which a genuine user is misidentified for various reasons, such as when experiencing dry or cracked skin. The bio-hash maps the biometric features to a binary string with a user-specific tokenized pseudo-random number. In three-factor authentication, many researchers use a bio-hash to identify the biometric features of the users [24–26]. It is a simple and efficient tool for resource-constrained devices such as IoT sensor devices.


### 2.4. Adversarial Model

For a security analysis in this paper, we consider the adversarial model as follows [27–29]:(1)
The attacker can control the public communication channel by interrupting, returning, amending, eliminating, or transmitting newly forged messages(2)
The attacker can extract the security parameters in the smart device using a side-channel attack(3)
The attacker can guess the user’s identity and password by enumerating all possible items in polynomial time. The time of such an attack conducted to determine the correct identity and password is linear to the dictionary size


## 2.1. Network Model

The network model of the proposed protocol in the IoT environment is based on the cloud server environment adopted in the protocol described in [16–20], as shown in Figure 1. There are three participants in this model:(1)
Registration authority (RA): RA is a trusted authority that creates all system parameters and issues them to users and cloud servers through the registration process(2)
User (Ui): Ui wishes to access and enjoy the services provided by the cloud server using IoT device. For this purpose, the RA shares the session key with the cloud server(3)
Cloud server (CSj): CSj provides IoT cloud services to usersFigure 1
System architecture of cloud computing service with IoT.This network model is for a cloud server-centric service in which the cloud server collects and processes information from IoT devices and shares it with users. For example, a real-world scenario for this is as follows: Alex’s grandfather has dementia, and his family is concerned about his grandfather’s health and fear of getting lost when he goes out. The smartwatch worn by the grandfather can check the health condition through the built-in sensor and transmits the GPS information to the cloud server. Alex’s family wants to use a service that can trace and check the location and health of their grandfather in real time. To this end, Alex’s family and grandfather (Ui) first register their identifier with the registration authority (RA) to sign up for this IoT-based cloud service. RA issues security parameters to be used when establishing session key with CSj (assume that CSj is already registered). Information about the grandfather is sensitive. It should be shared only with the family. To this end, Alex creates a group through the interface provided by the cloud platform, adds family members as group members, and adds the devices of grandpa’s smartwatch and family’s smartphone to set permission to access information shared by registered devices. Ui and CSj generate the session key through the authentication process; the family and grandfather can safely share information.


## 2.2. Elliptic Curve Cryptography

In this study, we apply an elliptic curve cryptography to the proposed scheme, which provides a high level of security with a small key size [22]. ECC is based on the logarithm problems expressed in the point addition and multiplication of elliptic curves.An elliptic curve is given byEpa,b:y2=x3+ax+b mod p over a finite field Fp, where p is the prime order and a,b∈Fp such that p>3 and 4a3+27b2≠0 mod p. The point multiplication over Epa,b is defined through a repetitive addition as +P+⋯+Patimes=aP, where P is a point on Epa,b and a∈Fp∗ is a random integer. The security of ECC relies on the following assumption:(1)
Elliptic curve discrete logarithm problem (ECDLP): givenP, aP∈Epa,b, it is computationally infeasible to find a within polynomial time(2)
Elliptic curve computational Diffie-Hellman problem (ECCDHP): givenaP,bP∈Epa,b, it is computationally infeasible to find abP in polynomial time


## 2.3. Bio-Hash Function

In the proposed scheme, we use a bio-hash function. In 2004, Jin et al. [23] proposed a solution to the problem of false resection in which a genuine user is misidentified for various reasons, such as when experiencing dry or cracked skin. The bio-hash maps the biometric features to a binary string with a user-specific tokenized pseudo-random number. In three-factor authentication, many researchers use a bio-hash to identify the biometric features of the users [24–26]. It is a simple and efficient tool for resource-constrained devices such as IoT sensor devices.


## 2.4. Adversarial Model

For a security analysis in this paper, we consider the adversarial model as follows [27–29]:(1)
The attacker can control the public communication channel by interrupting, returning, amending, eliminating, or transmitting newly forged messages(2)
The attacker can extract the security parameters in the smart device using a side-channel attack(3)
The attacker can guess the user’s identity and password by enumerating all possible items in polynomial time. The time of such an attack conducted to determine the correct identity and password is linear to the dictionary size


## 3. Proposed Scheme

In this section, we propose an improved three-factor authentication scheme in the cloud environment. Our scheme consists of (1) a registration phase, (2) a login and authentication phase, (3) a password change phase, and (4) an identity update phase. All notations used in this paper are listed in Table1.Table 1
Notations used.
SymbolDescriptionUi, CSj, RAUser, cloud server, registration authorityIDi, CIDjIdentity ofUi and CSjPWiPassword ofUiBIOiBiometrics ofUiSKSession key betweenUi and CSjh·Hash functionH·Bio-hash function||Concatenation⊕XOR operationxPrivate key ofRAxP=PubPublic key ofRA


### 3.1. User Registration Phase

In this phase,Ui registers with RA and shares secret parameters for later login and authentication using IoT smart device. The registration phase of Ui shown in Figure 2 is as follows.(1)
Ui who wants to register in RA enters IDi,PWi, and BIOi, and computes PWBi=hPWiBIOi and UIDi=hIDiPWBi(2)
Ui sends a registration request <IDi,PWBi,UIDi,> through a secure channel(3)
After receiving the registration request message fromUi, RA first searches for UIDi in User_List to check whether the user’s IDi is already registered. If UIDi does not exist in User_List, RA selects a random number r and computes Di=hUIDixr,Ci=hIDiPWBiDi, and Ei=Di⊕PWBi(4)
Here,RA stores <UIDi,r,Honey_List=0> into User_List and issues <Ci,Ei,Pub,P>. Then, Ui stores them to IoT smart deviceFigure 2
User registration phase of the proposed scheme.


### 3.2. Registration Phase for Cloud Server

In this phase,CSj registers with RA and initials the system parameter. The registration phase of CSj shown in Figure 3 is as follows.(1)
CSj selects CIDj and sends it to RA(2)
RA computes Ckeyj=hCIDjx and sends it to CSjFigure 3
Registration phase for cloud server of the proposed scheme.


### 3.3. Login and Authentication Phase

To access a cloud serverCSj, Ui begins a login and authentication protocol on the public channel through the support of RA. In this phase, RA confirms the legitimacy of Ui and CSj; thus, they establish a session key for future communication. To this end, the following steps, shown in Figure 4, are executed.(1)
Ui enters IDi,PWi, and BIOi, and computes PWBi=hPWiBIOi,Di∗=PWBi⊕Ei,UIDi=hIDiPWBi,andCi∗=hIDiPWBiDi∗. If Ci∗andCi are not equal, Ui terminates the login phase; otherwise, it chooses a random number a, and computes X1=aPub,X2=aP,Gi=hUIDiCIDjX1Di∗,andFi=hX1X2⊕UIDi(2)
Ui sends the login request message M1=<CIDj,Gi,Fi,X2> to CSj(3)
CSj chooses a random number b and computes Y1=bPub,Y2=bP, and Kj=hY1CkeyjGiFiX2(4)
CSi sends the login request message M2=<M1,Kj,Y2> to RA(5)
RA computes X1∗=xX2,UIDi∗=Fi⊕hX1∗X2,Di∗=hUIDixr,Gi∗=hUIDi∗CIDjX1∗Di∗. If Gi∗andGi are not equal, RA terminates the login phase; otherwise, it computes Y1∗=xY2,Ckeyj∗=hCIDjx,andKj∗=hY1∗Ckeyj∗Gi∗FiX2. If Ki∗andKi are not equal, RA terminates the login phase; otherwise, it computes Ucs=hY1∗Y2Ckeyj∗Kj∗X2 and Vcs=hX1∗X2UIDiDi∗Y2(6)
RA sends the response message M3=<UCS,VCS> to CSj(7)
CSi computes Vcs∗=hY1Y2CkeyjKjX2 and checks whether Vcs∗ and Vcs are equal. If they are equal, CSi computes Y3=bX2,Hj=Ucs⊕HY1Y2Ckeyj,SKji=hY2X2Y3Hj, and SVj=hSKjiX2(8)
CSi sends the message M4=<Y2,SVj> to Ui(9)
Ui computes X3=aY2,SKij=hY2X2X3UIDi, and SVi=hSKijX2. If SVi and SVj are equal, Ui and CSi have successfully shared the session key with each other; otherwise, the login authentication step has failedFigure 4
Login and authentication phase of the proposed scheme.


### 3.4. Password Change Phase

In this phase,Ui can change to a new password offline. The password change phase shown in Figure 5 is as follows:(1)
Ui enters IDi,PWi,PWinew, and BIOi, and computes PWBi=hPWiBIOi,Di=PWBi⊕Ei,andCi∗=hIDiPWBiDi(2)
IfCi∗andCi are equal, Ui updates Ci and Ei with Cinew and Einew by calculating PWBinew=hPWinewBIOi,Cinew=hIDiPWBinewDi, and Einew=Di⊕PWBi⊕PWBinew, respectivelyFigure 5
Password change phase of the proposed scheme.


### 3.5. Identity Update Phase

When users want to change their identity or phone number, they need to update their identity. In the proposed scheme,Ui can perform an identity update process through RA by entering the old identity IDi and new identity IDinew, shown in Figure 6, as follows:(1)
Ui enters IDi,IDinew,PWi, and BIOi, and computes PWBi=hPWiHBIOi,Di∗=PWBi⊕Ei,andCi∗=hIDiPWBiDi∗(2)
IfCi∗andCi are equal, Ui chooses a random number a, and computes X1=aPub,X2=aP,UIDinew=hIDinewPWBi,Gi=hUIDiX1DiUIDinew,Fi=hX1X2⊕UIDi,andNUIDi=hX1X2⊕UIDinew(3)
Ui sends the request message M1=<Gi,Fi,X2,NUIDi> to RA(4)
RA computes X1∗=xX2,UIDi∗=Fi⊕hX1∗X2,Di∗=hUIDixr,UIDinew=hX1X2⊕NUIDi,andGi∗=hUIDi∗X1∗Di∗UIDinew. If Gi∗andGi are not equal, RA rejects the request and sets Honey_List=Honey_List+1. Once it exceeds the present value, Ui is suspended(5)
Otherwise,RA updates UIDi with UIDinew in User_List and computes Dinew=hUIDinewxr,MCS=hUIDinewUIDi∗Di∗DinewDi∗X1∗,andNDi=Dinew⊕hX1∗(6)
RA sends M2=<MCS,NDi> to Ui(7)
Ui computes Dinew=NDi⊕hX1andMCS∗=hUIDinewUIDiDinewDi∗X1 and checks whether MCS∗ and MCS are equal. If so, Ui computes Cinew=hIDinewPWBiDinew, and Einew=Dinew⊕PWBi, and updates Ci and Ei with Cinew and Dinew, respectivelyFigure 6
Identity update phase of the proposed scheme.


## 3.1. User Registration Phase

In this phase,Ui registers with RA and shares secret parameters for later login and authentication using IoT smart device. The registration phase of Ui shown in Figure 2 is as follows.(1)
Ui who wants to register in RA enters IDi,PWi, and BIOi, and computes PWBi=hPWiBIOi and UIDi=hIDiPWBi(2)
Ui sends a registration request <IDi,PWBi,UIDi,> through a secure channel(3)
After receiving the registration request message fromUi, RA first searches for UIDi in User_List to check whether the user’s IDi is already registered. If UIDi does not exist in User_List, RA selects a random number r and computes Di=hUIDixr,Ci=hIDiPWBiDi, and Ei=Di⊕PWBi(4)
Here,RA stores <UIDi,r,Honey_List=0> into User_List and issues <Ci,Ei,Pub,P>. Then, Ui stores them to IoT smart deviceFigure 2
User registration phase of the proposed scheme.


## 3.2. Registration Phase for Cloud Server

In this phase,CSj registers with RA and initials the system parameter. The registration phase of CSj shown in Figure 3 is as follows.(1)
CSj selects CIDj and sends it to RA(2)
RA computes Ckeyj=hCIDjx and sends it to CSjFigure 3
Registration phase for cloud server of the proposed scheme.


## 3.3. Login and Authentication Phase

To access a cloud serverCSj, Ui begins a login and authentication protocol on the public channel through the support of RA. In this phase, RA confirms the legitimacy of Ui and CSj; thus, they establish a session key for future communication. To this end, the following steps, shown in Figure 4, are executed.(1)
Ui enters IDi,PWi, and BIOi, and computes PWBi=hPWiBIOi,Di∗=PWBi⊕Ei,UIDi=hIDiPWBi,andCi∗=hIDiPWBiDi∗. If Ci∗andCi are not equal, Ui terminates the login phase; otherwise, it chooses a random number a, and computes X1=aPub,X2=aP,Gi=hUIDiCIDjX1Di∗,andFi=hX1X2⊕UIDi(2)
Ui sends the login request message M1=<CIDj,Gi,Fi,X2> to CSj(3)
CSj chooses a random number b and computes Y1=bPub,Y2=bP, and Kj=hY1CkeyjGiFiX2(4)
CSi sends the login request message M2=<M1,Kj,Y2> to RA(5)
RA computes X1∗=xX2,UIDi∗=Fi⊕hX1∗X2,Di∗=hUIDixr,Gi∗=hUIDi∗CIDjX1∗Di∗. If Gi∗andGi are not equal, RA terminates the login phase; otherwise, it computes Y1∗=xY2,Ckeyj∗=hCIDjx,andKj∗=hY1∗Ckeyj∗Gi∗FiX2. If Ki∗andKi are not equal, RA terminates the login phase; otherwise, it computes Ucs=hY1∗Y2Ckeyj∗Kj∗X2 and Vcs=hX1∗X2UIDiDi∗Y2(6)
RA sends the response message M3=<UCS,VCS> to CSj(7)
CSi computes Vcs∗=hY1Y2CkeyjKjX2 and checks whether Vcs∗ and Vcs are equal. If they are equal, CSi computes Y3=bX2,Hj=Ucs⊕HY1Y2Ckeyj,SKji=hY2X2Y3Hj, and SVj=hSKjiX2(8)
CSi sends the message M4=<Y2,SVj> to Ui(9)
Ui computes X3=aY2,SKij=hY2X2X3UIDi, and SVi=hSKijX2. If SVi and SVj are equal, Ui and CSi have successfully shared the session key with each other; otherwise, the login authentication step has failedFigure 4
Login and authentication phase of the proposed scheme.


## 3.4. Password Change Phase

In this phase,Ui can change to a new password offline. The password change phase shown in Figure 5 is as follows:(1)
Ui enters IDi,PWi,PWinew, and BIOi, and computes PWBi=hPWiBIOi,Di=PWBi⊕Ei,andCi∗=hIDiPWBiDi(2)
IfCi∗andCi are equal, Ui updates Ci and Ei with Cinew and Einew by calculating PWBinew=hPWinewBIOi,Cinew=hIDiPWBinewDi, and Einew=Di⊕PWBi⊕PWBinew, respectivelyFigure 5
Password change phase of the proposed scheme.


## 3.5. Identity Update Phase

When users want to change their identity or phone number, they need to update their identity. In the proposed scheme,Ui can perform an identity update process through RA by entering the old identity IDi and new identity IDinew, shown in Figure 6, as follows:(1)
Ui enters IDi,IDinew,PWi, and BIOi, and computes PWBi=hPWiHBIOi,Di∗=PWBi⊕Ei,andCi∗=hIDiPWBiDi∗(2)
IfCi∗andCi are equal, Ui chooses a random number a, and computes X1=aPub,X2=aP,UIDinew=hIDinewPWBi,Gi=hUIDiX1DiUIDinew,Fi=hX1X2⊕UIDi,andNUIDi=hX1X2⊕UIDinew(3)
Ui sends the request message M1=<Gi,Fi,X2,NUIDi> to RA(4)
RA computes X1∗=xX2,UIDi∗=Fi⊕hX1∗X2,Di∗=hUIDixr,UIDinew=hX1X2⊕NUIDi,andGi∗=hUIDi∗X1∗Di∗UIDinew. If Gi∗andGi are not equal, RA rejects the request and sets Honey_List=Honey_List+1. Once it exceeds the present value, Ui is suspended(5)
Otherwise,RA updates UIDi with UIDinew in User_List and computes Dinew=hUIDinewxr,MCS=hUIDinewUIDi∗Di∗DinewDi∗X1∗,andNDi=Dinew⊕hX1∗(6)
RA sends M2=<MCS,NDi> to Ui(7)
Ui computes Dinew=NDi⊕hX1andMCS∗=hUIDinewUIDiDinewDi∗X1 and checks whether MCS∗ and MCS are equal. If so, Ui computes Cinew=hIDinewPWBiDinew, and Einew=Dinew⊕PWBi, and updates Ci and Ei with Cinew and Dinew, respectivelyFigure 6
Identity update phase of the proposed scheme.


## 4. Security Comparison with the Related Scheme

This section provides a security comparison with other relevant schemes [15, 16, 19, 30]. For detailed procedures of the compared schemes, see Appendices A, B, C, and D.(1)
Wang et al. [15]: Wang et al. scheme does not provide the verification process of session key. In their scheme, after CSj sends <Y2,Qcs> and Ui check the legitimacy of Qcs, Ui generates a session key SKi=hY2X2X3. Here, after Ui considers that the session key has been shared with CSj, the authentication process is terminated. However, Ui does not check whether the SKi is same as SKj generated by CSj. If the session key is created incorrectly due to some error, the session key establishment process has to be executed again(2)
Kumari et al. [16] and Wang et al. [30]: their scheme consists of registration, login, authentication, and password change steps. However, it does not provide an identity update process for the user. This process is necessary when the mobile phone number of Ui changes or the identity has to be changed for security reasons(3)
Martínez-Peláez et al. [19]: in their scheme, the adversary can extractor the secret parameters <PIDi,C2,C3,C4,hnU> from the smart card of the user and intercept D1 from message M1. Then, the adversary can compute real identity IDi=C2⊕D1. From now on, by creating Tu and nU, an attacker can construct a malicious message M1 that can easily impersonate a user. After that, the message generated by the attacker is delivered to the cloud server and the RA and processed. Eventually, the attacker will share the session key with the cloud server. In the aftermath of this attack, the attacker can acquire TUnew, TSnew, TCSnew, nUnew, nSnew, and nCSnew. Therefore, their scheme cannot resist user impersonation attacks and replay attacks, and violates mutual authentication and user anonymity. In addition, their scheme does not support the three-factor authentication and the identity update for userIn Table2, we summarize the results of an informal analysis wherein the proposed scheme is compared with other relevant schemes. In the next section, we prove that our scheme satisfies all the security properties mentioned in Table 2.Table 2
Security comparisons of the proposed scheme with related schemes in cloud computing environment.
SchemeWang et al. [15]Kumari et al. [16]Martínez-Peláez et al. [19]Wang et al. [30]ProposedSP1OO×OOSP2OOOOOSP3OOOOOSP4OO×OOSP5×OOOOSP6OO×OOSP7OO×OOSP8OOOOOSP9OOOOOSP10OOOOOSP11OOOOOSP12OOOOOSP13××××OSP14OO×OOSP1: user anonymity; SP2: user untraceability; SP3: resistance to stolen-device attack; SP4: mutual authentication and session key agreement; SP5: verification of session key; SP6: resistance to user impersonation attack; SP7: resistance to replay attack; SP8: local user verification; SP9: resistance to privileged-insider attack; SP10: forward secrecy; SP11: resistance to stolen-verifier attack; SP12: user-friendly password change; SP13: providing identity update phase; SP14: providing three-factor user authentication.


## 5. Informal Analysis of the Proposed Scheme

In this section, we describe an informal analysis of the proposed scheme and show that it satisfies the desired security features and is secure against known attacks. In Table2, we summarize the results of an informal analysis wherein the proposed scheme is compared with other relevant schemes.


### 5.1. User Anonymity

In the user authentication phase of our scheme, the user’sIDi is protected in UIDi and is preserved by the user’s secret value X1. The attacker must know two values, X1 and HBIOi, to know the user’s IDi from messages sent over a public channel. The value X1=aPub=axP is under the ECCDH problem, and the BIOi is unique to each individual. Therefore, it is extremely difficult for an attacker to determine these two values, and thus, the proposed scheme guarantees user anonymity.


### 5.2. User Untraceability

In the login authentication phase,Ui sends a message M1 to CSj and receives a message M4 from CSj on a public channel that an attacker can eavesdrop on. In message M1, Gi, Fi, and X2 contain a random number a, and in message M4, Y2 and SVj include random numbers a and b. Because both random numbers are changed during each session, and it is difficult to solve the ECCDH problem, the connection between the messages in each session cannot be determined, and the user activity cannot be tracked. Thus, the proposed scheme ensures user untraceability.


### 5.3. Resistance to Stolen-Device Attack

According to the attacker model, the attacker may extract the secret parameters<Ci,Ei,P,Pub> by applying a side-channel attack if the attacker acquires a user’s IoT smart device. In this attack, an attacker attempts to guess IDi and PWi using the two values, CiandEi, to impersonate a user or obtain the user’s personal information. The attacker needs to know the HBIOi value to obtain the user’s IDi and PWi. However, the user’s biometric information is unique to each individual. Therefore, the proposed scheme resists a stolen-device attack.


### 5.4. Mutual Authentication and Session Key Agreement

In the proposed scheme,Ui and CSj establish a session key through mutual authentication based on the support of RA. First, RA authenticates Ui by validating Gi included in M1. The value of Di included in Gi contains the server’s private keys x and r stored in the user list maintained by RA. In addition, Ui must calculate Di correctly at the login stage to verify its legitimacy to RA. Moreover, CSj verifies its identity to the RA by validating the value of Kj contained in message M2. To do so, CSj must include a valid Ckeyj that contains the secret key x of RA in Kj.IfCSj and Ui are authenticated, the RA calculates X1 and Y1 (both can be calculated by a valid RA) and includes these two values in UCS and VCS, respectively. After receiving message M3, CSj calculates VCS∗ and compares it with the received VCS to check the validity of the RA. Then, CSj multiplies X2 by its random nonce b to generate a value of Y3, calculates the session key SKji and SVj for the verification of session key, and sends SVj to Ui.After receiving messageM4, Ui multiplies Y2 by its random nonce a to compute X3, and calculates session key SKij and verification value SVi for the session key.Because the validity ofY2 received from CSj is confirmed through the soundness of SVj by adding UIDi∗ into SKji, even if Y3 is generated by multiplying any random nonce of the malicious attacker by X2, the validation process for SVj generated by a malicious CSj is not passed. Therefore, the proposed scheme supports mutual authentication between Ui, CSj, and RA and provides a secure session key establishment between Ui and CSj.


### 5.5. Verification of Session Key

In the proposed scheme,CSj calculates SVj including the session key calculated by itself and transmits it to Ui. Then, Ui also calculates the session key SVi calculated by itself and compares whether it is the same as SVj. Therefore, the proposed scheme can prevent session key disagreement that may occur due to communication errors.


### 5.6. Resistance to User-Impersonation Attack

For an attacker to conduct a user impersonation attack, the attacker must either maliciously control the session key establishment process or extract secret parameters from the user’s IoT smart device. However, as mentioned earlier, the proposed scheme guarantees mutual authentication and protection from stolen-device attacks. Therefore, the proposed scheme provides a safe protection technique using biometrics and under the ECCDH problem against user impersonation attacks.


### 5.7. Resistance to Replay Attack

To establish a malicious session by pretending to be a participant in the communication, an attacker must know the random numbera or b to create a session key by eavesdropping on the messages sent and received over the public channel and then reuse them. However, with the proposed scheme, the random numbers included in the session key are protected from the ECCDH problem. Even if an attacker attempts to connect a malicious session by replaying the message, communication in the next step cannot be continued without knowing the secret parameter or random nonce. Therefore, the proposed scheme resists a replay attack.


### 5.8. Local User Verification

In the login and authentication phase of the proposed scheme, the user first entersIDi, PWi, and BIOi to calculate Ci∗ and then checks whether Ci∗ is equal to Ci stored in the IoT smart device. Only Ui who have passed this local user verification procedure can perform the next mutual authentication phase. Because Ui cannot log in without inputs of the user’s legitimate personal information, the proposed scheme can block unauthorized access in the local area.


### 5.9. Resistance to Privileged-Insider Attack

In the registration phase of the proposed scheme, the user sendsIDi, UIDi, and PWBi to the RA. To perform the privileged-insider attack, here, the insider of the RA needs BIOi to guess PWi of Ui. However, the user’s BIOi is protected by PWi, and thus, the malicious insider cannot impersonate Ui to communicate with CSj. In addition, the proposed scheme can change PWBi locally in Ui’s IoT smart device without an intervention of RA. Therefore, the proposed scheme is safe from an insider attack.


### 5.10. Forward Secrecy

With the proposed scheme, the session key is not transmitted directly. Instead, the user andCSj agree on the session key by calculating the secret parameters constituting the session key. Here, the session key shared between them includes a different random nonce for each session. Therefore, it is difficult for an attacker to attempt to guess the session key by collecting the session key verification value SVj. Therefore, the proposed scheme guarantees forward secrecy.


### 5.11. Resistance to Stolen-Verifier Attack

In the proposed scheme, the personal login information ofUi, including PWi and HBIOi, is not directly transmitted to CSj. RA retains User_List=<RIDi,r,Honey_List=0> in the database. Even if the attacker misappropriates User_List, the attacker cannot obtain the real identity of Ui because it is protected by the secret parameter x. Therefore, the proposed scheme is secure against stolen-verifier attacks.


### 5.12. User-Friendly Password Change

In the proposed scheme, the user can change to a new password by applying the user’s information offline without interacting with the server. Therefore, the proposed scheme supports a change in the password in a user-friendly manner.


### 5.13. Providing Identity Update Phase

In the proposed scheme, users can requestRA to change their identity. Thus, the user can set a new identity IDinew when he or she wants, such as changing his or her mobile phone number. When RA receives a request from the user, RA calculates new secret parameters for IDinew and stores them in the User_List, so that the user’s legitimacy can be authenticated at a later login and authentication step.


## 5.1. User Anonymity

In the user authentication phase of our scheme, the user’sIDi is protected in UIDi and is preserved by the user’s secret value X1. The attacker must know two values, X1 and HBIOi, to know the user’s IDi from messages sent over a public channel. The value X1=aPub=axP is under the ECCDH problem, and the BIOi is unique to each individual. Therefore, it is extremely difficult for an attacker to determine these two values, and thus, the proposed scheme guarantees user anonymity.


## 5.2. User Untraceability

In the login authentication phase,Ui sends a message M1 to CSj and receives a message M4 from CSj on a public channel that an attacker can eavesdrop on. In message M1, Gi, Fi, and X2 contain a random number a, and in message M4, Y2 and SVj include random numbers a and b. Because both random numbers are changed during each session, and it is difficult to solve the ECCDH problem, the connection between the messages in each session cannot be determined, and the user activity cannot be tracked. Thus, the proposed scheme ensures user untraceability.


## 5.3. Resistance to Stolen-Device Attack

According to the attacker model, the attacker may extract the secret parameters<Ci,Ei,P,Pub> by applying a side-channel attack if the attacker acquires a user’s IoT smart device. In this attack, an attacker attempts to guess IDi and PWi using the two values, CiandEi, to impersonate a user or obtain the user’s personal information. The attacker needs to know the HBIOi value to obtain the user’s IDi and PWi. However, the user’s biometric information is unique to each individual. Therefore, the proposed scheme resists a stolen-device attack.


## 5.4. Mutual Authentication and Session Key Agreement

In the proposed scheme,Ui and CSj establish a session key through mutual authentication based on the support of RA. First, RA authenticates Ui by validating Gi included in M1. The value of Di included in Gi contains the server’s private keys x and r stored in the user list maintained by RA. In addition, Ui must calculate Di correctly at the login stage to verify its legitimacy to RA. Moreover, CSj verifies its identity to the RA by validating the value of Kj contained in message M2. To do so, CSj must include a valid Ckeyj that contains the secret key x of RA in Kj.IfCSj and Ui are authenticated, the RA calculates X1 and Y1 (both can be calculated by a valid RA) and includes these two values in UCS and VCS, respectively. After receiving message M3, CSj calculates VCS∗ and compares it with the received VCS to check the validity of the RA. Then, CSj multiplies X2 by its random nonce b to generate a value of Y3, calculates the session key SKji and SVj for the verification of session key, and sends SVj to Ui.After receiving messageM4, Ui multiplies Y2 by its random nonce a to compute X3, and calculates session key SKij and verification value SVi for the session key.Because the validity ofY2 received from CSj is confirmed through the soundness of SVj by adding UIDi∗ into SKji, even if Y3 is generated by multiplying any random nonce of the malicious attacker by X2, the validation process for SVj generated by a malicious CSj is not passed. Therefore, the proposed scheme supports mutual authentication between Ui, CSj, and RA and provides a secure session key establishment between Ui and CSj.


## 5.5. Verification of Session Key

In the proposed scheme,CSj calculates SVj including the session key calculated by itself and transmits it to Ui. Then, Ui also calculates the session key SVi calculated by itself and compares whether it is the same as SVj. Therefore, the proposed scheme can prevent session key disagreement that may occur due to communication errors.


## 5.6. Resistance to User-Impersonation Attack

For an attacker to conduct a user impersonation attack, the attacker must either maliciously control the session key establishment process or extract secret parameters from the user’s IoT smart device. However, as mentioned earlier, the proposed scheme guarantees mutual authentication and protection from stolen-device attacks. Therefore, the proposed scheme provides a safe protection technique using biometrics and under the ECCDH problem against user impersonation attacks.


## 5.7. Resistance to Replay Attack

To establish a malicious session by pretending to be a participant in the communication, an attacker must know the random numbera or b to create a session key by eavesdropping on the messages sent and received over the public channel and then reuse them. However, with the proposed scheme, the random numbers included in the session key are protected from the ECCDH problem. Even if an attacker attempts to connect a malicious session by replaying the message, communication in the next step cannot be continued without knowing the secret parameter or random nonce. Therefore, the proposed scheme resists a replay attack.


## 5.8. Local User Verification

In the login and authentication phase of the proposed scheme, the user first entersIDi, PWi, and BIOi to calculate Ci∗ and then checks whether Ci∗ is equal to Ci stored in the IoT smart device. Only Ui who have passed this local user verification procedure can perform the next mutual authentication phase. Because Ui cannot log in without inputs of the user’s legitimate personal information, the proposed scheme can block unauthorized access in the local area.


## 5.9. Resistance to Privileged-Insider Attack

In the registration phase of the proposed scheme, the user sendsIDi, UIDi, and PWBi to the RA. To perform the privileged-insider attack, here, the insider of the RA needs BIOi to guess PWi of Ui. However, the user’s BIOi is protected by PWi, and thus, the malicious insider cannot impersonate Ui to communicate with CSj. In addition, the proposed scheme can change PWBi locally in Ui’s IoT smart device without an intervention of RA. Therefore, the proposed scheme is safe from an insider attack.


## 5.10. Forward Secrecy

With the proposed scheme, the session key is not transmitted directly. Instead, the user andCSj agree on the session key by calculating the secret parameters constituting the session key. Here, the session key shared between them includes a different random nonce for each session. Therefore, it is difficult for an attacker to attempt to guess the session key by collecting the session key verification value SVj. Therefore, the proposed scheme guarantees forward secrecy.


## 5.11. Resistance to Stolen-Verifier Attack

In the proposed scheme, the personal login information ofUi, including PWi and HBIOi, is not directly transmitted to CSj. RA retains User_List=<RIDi,r,Honey_List=0> in the database. Even if the attacker misappropriates User_List, the attacker cannot obtain the real identity of Ui because it is protected by the secret parameter x. Therefore, the proposed scheme is secure against stolen-verifier attacks.


## 5.12. User-Friendly Password Change

In the proposed scheme, the user can change to a new password by applying the user’s information offline without interacting with the server. Therefore, the proposed scheme supports a change in the password in a user-friendly manner.


## 5.13. Providing Identity Update Phase

In the proposed scheme, users can requestRA to change their identity. Thus, the user can set a new identity IDinew when he or she wants, such as changing his or her mobile phone number. When RA receives a request from the user, RA calculates new secret parameters for IDinew and stores them in the User_List, so that the user’s legitimacy can be authenticated at a later login and authentication step.


## 6. Formal Analysis of the Proposed Scheme

### 6.1. ProVerif

To prove the security of the proposed scheme, we adapted ProVerif [31], which is an automated tool used to analyse cryptographic protocols. ProVerif supports an analysis of protocols based on various cryptographic primitives such as symmetric and asymmetric cryptography, digital signatures, and hash functions. ProVerif is widely used by many researchers [32–35] to validate a security analysis of the key agreement and authentication schemes for various network environments. In this section, we introduce the ProVerif code and present the analysis results to verify the proposed scheme’s security.We present the process of predefined identifiers and the definitions of the proposed scheme in Figure7. Here, we define the public and secure channels used among Ui, CSj, and RA; the cryptographic parameters and operations; and the start and end of communication between nodes to be verified for the correspondence relationship of the messages.Figure 7
ProVerif code for predefined identifiers and definitions.We define the overallUi process code for the proposed scheme, as shown in Figure 8. We model the registration phase in lines 37-41 and the login and authentication phase in lines 42-58.Figure 8
ProVerif code for the entire user process.We define the overallCSj process code for the proposed scheme, as shown in Figure 9. We model the registration phase in lines 60-64 and the login and authentication phase in lines 65-82.Figure 9
ProVerif code for the entire cloud server process.Figure10 shows the overall RA process code for the proposed scheme. We model the registration phase in lines 84-94 and the login and authentication phase in lines 95-113.Figure 10
ProVerif code for the entire registration agency process.The code shown in Figure11 is intended to model the attacker’s capabilities and verify the equivalencies of inter-process communication. The code in lines 115 and 116 checks whether the session keys SKij and SKji are secure against the attacker. The code in lines 117-119 verifies whether the internodal relationships of the proposed scheme are accurate during the procedure.Figure 11
ProVerif code for adversary capabilities and verifying equivalences.The execution of all codes described earlier verifies the effectiveness and availability of the simulated events and queries and generates the results of the simulation, as presented in Figure12. This indicates that Ui, CSj, and RA in the proposed scheme achieve a successful mutual authentication and securely establish the session key. Furthermore, it can be considered that the proposed scheme is secure against simulated attacks.Figure 12
ProVerif code for adversary capabilities and verifying equivalence verification.


### 6.2. BAN Logic

Burrows-Abadi-Needham (BAN) logic [36] is used to prove the trust of each party in the authentication protocol on the formal logic. We utilize this logic to prove that Ui and CSj share a valid and fresh session key through mutual authentication. We define the notations of BAN logic as follows:(1)
U⊲C:U sees condition C(2)
U∣≡C: condition C is believed by U(3)
#C: it makes a fresh C(4)
U∣~C:U expresses the condition C(5)
U↔KS:U and S share a secret key K(6)
U⟹C: condition C is handled by U(7)
CK:C is encrypted under key KWe define five rules of BAN logic to prove the mutual authentication of the proposed scheme.(1)
Rule 1: message-meaning ruleU∣≡U↔KS,U⊲CK/U≡S~C: if U trusts that key K is shared with S, U sees C combined with K and trusts S once said C(2)
Rule 2: nonce-verification ruleU∣≡#C,U≡S~C/U≡S≡C: if U trusts that freshness of C and trusts S once said C, then U trusts that S trusts C(3)
Rule 3: belief ruleU≡C,U≡M/A∣≡C,M: if U trusts C and M, C,M are also trusted by U(4)
Rule 4: freshness-conjuncatenation ruleU≡#C/A≡#C,M: if the freshness of C is trusted by U, then U can trust the freshness of the full condition(5)
Rule 5: jurisdiction ruleU≡S⟹C,U≡S≡C/A≡C: if U trusts that S has jurisdiction over C, and U trusts that S trusts a condition C, then U also trusts CWe must satisfy the following four goals:(1)
Goal 1:Ui≡Ui↔SKijCSj(2)
Goal 2:CSj≡Ui↔SKijCSj(3)
Goal 3:Ui≡CSj≡Ui↔SKijCSj(4)
Goal 4:CSj≡Ui≡Ui↔SKijCSjThe four messages transmitted in the proposed scheme can be converted into the idealized form as follows:(1)
UsingM1=<CIDj,Gi,Fi,X2>, Ui⟶CSj:Gi=hUIDiCIDjX1D1,Fi=hX1X2⊕UIDi. This is reduced to MSG1:(UIDi,CIDj,D1,X1,X2)(2)
UsingM2=<M1,Kj,Y2>, CSj⟶RA:Kj=hY1CkeyjGiFiX2. This is reduced to MSG2:M1,Y1,Ckeyj,X2(3)
UsingM3=<Ucs,Vcs>, RA⟶CSj:Ucs=hY1∗Y2Ckeyj∗Kj∗X2⊕hUIDi∗,Vcs=hX1∗X2UIDiDi∗Y2. This is reduced to MSG3:(Y1,Y2,Ckeyj,X2,UIDi)(4)
UsingM4=<Y2,SVj>, CSj⟶Ui:SVj=hSKjiX2. This is reduced to MSG4:Y2,X2To derive the goals of the proposed scheme, we define the following assumptions.(1)
Ui≡#UIDi(2)
CSj∣≡#Ckeyj(3)
RA≡#x(4)
CSj≡#b(5)
CSj∣≡Ui↔aCSj(6)
CSj≡CSj↔bRA(7)
RA≡CSj↔bRA(8)
Ui≡Ui↔aCSj(9)
Ui≡CSj≡Ui↔SKjiCSj(10)
CSj≡Ui≡Ui↔SKijCSjWe describe the main proof of the proposed scheme using the BAN logic rules, messages, and assumptions as follows:(1)
FromM1, we obtain V1:CSj⊲CIDj,UIDi,Pa(2)
FromA5 and rule 1, we obtain V2:CSj≡Ui~CIDj,UIDi,Pa(3)
FromA1 and rule 4, we obtain V3:CSj≡#CIDj,UIDi,Pa(4)
FromV1, V2, and rule 2, we obtain V4:CSj≡Ui≡CIDj,UIDi,Pa(5)
FromM2, we obtain V5:RA⊲Ckeyj,CIDj,UIDi,Pb(6)
FromA7 and rule 1, we obtain V6:RA≡CSj~Ckeyj,CIDj,UIDi,Pb(7)
FromA2 and rule 4, we obtain V7:CSj≡#Ckeyj,CIDj,UIDi,Pb(8)
FromV5, V6, and rule 2, we obtain V8:RA≡CSj≡Ckeyj,CIDj,UIDi,Pb(9)
FromM3, we obtain V9:CSj⊲a,x,P,Ckeyj,UIDib(10)
FromA6 and rule 1, we obtain V10:CSj≡RA~a,x,P,Ckeyj,UIDib(11)
FromA3 and rule 4, we obtain V11:CSj≡#a,x,P,Ckeyj,UIDib(12)
FromV9, V10, and rule 2, we obtain V12:CSj≡RA≡a,x,P,Ckeyj,UIDib(13)
FromM4, we obtain V13:Ui⊲b,x,Pa(14)
FromA8 and rule 1, we obtain V14:Ui≡CSj~b,x,Pa(15)
FromA4 and rule 4, we obtain V15:Ui≡#b,x,Pa(16)
FromV13, V14, and rule 2, we obtain V16:Ui≡CSj≡b,x,Pa(17)
FromV12, V16, and SK, we obtain V17:Ui≡Ui↔SKijCSj (goal 1)(18)
FromV4, V8, and SK, we obtain V18:CSj≡Ui↔SKijCSj (goal 2)(19)
FromA9, V17, and rule 5, we obtain V19:Ui≡CSj≡Ui↔SKijCSj (goal 3)(20)
FromA10, V18, and rule 5, we obtain V17:CSj≡Ui≡Ui↔SKijCSj (goal 4)From goals 1, 2, 3, and 4 that we achieved earlier, we see thatUi and Cj establish a session key through a secure mutual authentication.


## 6.1. ProVerif

To prove the security of the proposed scheme, we adapted ProVerif [31], which is an automated tool used to analyse cryptographic protocols. ProVerif supports an analysis of protocols based on various cryptographic primitives such as symmetric and asymmetric cryptography, digital signatures, and hash functions. ProVerif is widely used by many researchers [32–35] to validate a security analysis of the key agreement and authentication schemes for various network environments. In this section, we introduce the ProVerif code and present the analysis results to verify the proposed scheme’s security.We present the process of predefined identifiers and the definitions of the proposed scheme in Figure7. Here, we define the public and secure channels used among Ui, CSj, and RA; the cryptographic parameters and operations; and the start and end of communication between nodes to be verified for the correspondence relationship of the messages.Figure 7
ProVerif code for predefined identifiers and definitions.We define the overallUi process code for the proposed scheme, as shown in Figure 8. We model the registration phase in lines 37-41 and the login and authentication phase in lines 42-58.Figure 8
ProVerif code for the entire user process.We define the overallCSj process code for the proposed scheme, as shown in Figure 9. We model the registration phase in lines 60-64 and the login and authentication phase in lines 65-82.Figure 9
ProVerif code for the entire cloud server process.Figure10 shows the overall RA process code for the proposed scheme. We model the registration phase in lines 84-94 and the login and authentication phase in lines 95-113.Figure 10
ProVerif code for the entire registration agency process.The code shown in Figure11 is intended to model the attacker’s capabilities and verify the equivalencies of inter-process communication. The code in lines 115 and 116 checks whether the session keys SKij and SKji are secure against the attacker. The code in lines 117-119 verifies whether the internodal relationships of the proposed scheme are accurate during the procedure.Figure 11
ProVerif code for adversary capabilities and verifying equivalences.The execution of all codes described earlier verifies the effectiveness and availability of the simulated events and queries and generates the results of the simulation, as presented in Figure12. This indicates that Ui, CSj, and RA in the proposed scheme achieve a successful mutual authentication and securely establish the session key. Furthermore, it can be considered that the proposed scheme is secure against simulated attacks.Figure 12
ProVerif code for adversary capabilities and verifying equivalence verification.


## 6.2. BAN Logic

Burrows-Abadi-Needham (BAN) logic [36] is used to prove the trust of each party in the authentication protocol on the formal logic. We utilize this logic to prove that Ui and CSj share a valid and fresh session key through mutual authentication. We define the notations of BAN logic as follows:(1)
U⊲C:U sees condition C(2)
U∣≡C: condition C is believed by U(3)
#C: it makes a fresh C(4)
U∣~C:U expresses the condition C(5)
U↔KS:U and S share a secret key K(6)
U⟹C: condition C is handled by U(7)
CK:C is encrypted under key KWe define five rules of BAN logic to prove the mutual authentication of the proposed scheme.(1)
Rule 1: message-meaning ruleU∣≡U↔KS,U⊲CK/U≡S~C: if U trusts that key K is shared with S, U sees C combined with K and trusts S once said C(2)
Rule 2: nonce-verification ruleU∣≡#C,U≡S~C/U≡S≡C: if U trusts that freshness of C and trusts S once said C, then U trusts that S trusts C(3)
Rule 3: belief ruleU≡C,U≡M/A∣≡C,M: if U trusts C and M, C,M are also trusted by U(4)
Rule 4: freshness-conjuncatenation ruleU≡#C/A≡#C,M: if the freshness of C is trusted by U, then U can trust the freshness of the full condition(5)
Rule 5: jurisdiction ruleU≡S⟹C,U≡S≡C/A≡C: if U trusts that S has jurisdiction over C, and U trusts that S trusts a condition C, then U also trusts CWe must satisfy the following four goals:(1)
Goal 1:Ui≡Ui↔SKijCSj(2)
Goal 2:CSj≡Ui↔SKijCSj(3)
Goal 3:Ui≡CSj≡Ui↔SKijCSj(4)
Goal 4:CSj≡Ui≡Ui↔SKijCSjThe four messages transmitted in the proposed scheme can be converted into the idealized form as follows:(1)
UsingM1=<CIDj,Gi,Fi,X2>, Ui⟶CSj:Gi=hUIDiCIDjX1D1,Fi=hX1X2⊕UIDi. This is reduced to MSG1:(UIDi,CIDj,D1,X1,X2)(2)
UsingM2=<M1,Kj,Y2>, CSj⟶RA:Kj=hY1CkeyjGiFiX2. This is reduced to MSG2:M1,Y1,Ckeyj,X2(3)
UsingM3=<Ucs,Vcs>, RA⟶CSj:Ucs=hY1∗Y2Ckeyj∗Kj∗X2⊕hUIDi∗,Vcs=hX1∗X2UIDiDi∗Y2. This is reduced to MSG3:(Y1,Y2,Ckeyj,X2,UIDi)(4)
UsingM4=<Y2,SVj>, CSj⟶Ui:SVj=hSKjiX2. This is reduced to MSG4:Y2,X2To derive the goals of the proposed scheme, we define the following assumptions.(1)
Ui≡#UIDi(2)
CSj∣≡#Ckeyj(3)
RA≡#x(4)
CSj≡#b(5)
CSj∣≡Ui↔aCSj(6)
CSj≡CSj↔bRA(7)
RA≡CSj↔bRA(8)
Ui≡Ui↔aCSj(9)
Ui≡CSj≡Ui↔SKjiCSj(10)
CSj≡Ui≡Ui↔SKijCSjWe describe the main proof of the proposed scheme using the BAN logic rules, messages, and assumptions as follows:(1)
FromM1, we obtain V1:CSj⊲CIDj,UIDi,Pa(2)
FromA5 and rule 1, we obtain V2:CSj≡Ui~CIDj,UIDi,Pa(3)
FromA1 and rule 4, we obtain V3:CSj≡#CIDj,UIDi,Pa(4)
FromV1, V2, and rule 2, we obtain V4:CSj≡Ui≡CIDj,UIDi,Pa(5)
FromM2, we obtain V5:RA⊲Ckeyj,CIDj,UIDi,Pb(6)
FromA7 and rule 1, we obtain V6:RA≡CSj~Ckeyj,CIDj,UIDi,Pb(7)
FromA2 and rule 4, we obtain V7:CSj≡#Ckeyj,CIDj,UIDi,Pb(8)
FromV5, V6, and rule 2, we obtain V8:RA≡CSj≡Ckeyj,CIDj,UIDi,Pb(9)
FromM3, we obtain V9:CSj⊲a,x,P,Ckeyj,UIDib(10)
FromA6 and rule 1, we obtain V10:CSj≡RA~a,x,P,Ckeyj,UIDib(11)
FromA3 and rule 4, we obtain V11:CSj≡#a,x,P,Ckeyj,UIDib(12)
FromV9, V10, and rule 2, we obtain V12:CSj≡RA≡a,x,P,Ckeyj,UIDib(13)
FromM4, we obtain V13:Ui⊲b,x,Pa(14)
FromA8 and rule 1, we obtain V14:Ui≡CSj~b,x,Pa(15)
FromA4 and rule 4, we obtain V15:Ui≡#b,x,Pa(16)
FromV13, V14, and rule 2, we obtain V16:Ui≡CSj≡b,x,Pa(17)
FromV12, V16, and SK, we obtain V17:Ui≡Ui↔SKijCSj (goal 1)(18)
FromV4, V8, and SK, we obtain V18:CSj≡Ui↔SKijCSj (goal 2)(19)
FromA9, V17, and rule 5, we obtain V19:Ui≡CSj≡Ui↔SKijCSj (goal 3)(20)
FromA10, V18, and rule 5, we obtain V17:CSj≡Ui≡Ui↔SKijCSj (goal 4)From goals 1, 2, 3, and 4 that we achieved earlier, we see thatUi and Cj establish a session key through a secure mutual authentication.


## 7. Performance Analysis

In this section, we compare the computational and communication costs for the proposed scheme with those of other related schemes for cloud computing environments. We considered the computational cost and number of communications occurring during the login and authentication process. As described by Kocarev and Lian [37], we consider the execution time of cryptographic operations as follows:(1)
160-bit elliptic multiplication operation:Te≈63.08ms(2)
128-bit Advanced Encryption Standard (AES) algorithm:Ts≈8.7ms(3)
128-bit hash function:Th≈0.5ms(4)
128-bit Chebyshev polynomial computation:Th≈21.02msWe summarize the results of the comparison in terms of the computational time and communication costs in Table3. The results reveal that Martínez-Peláez et al.’s scheme [19] is significantly faster in terms of computational time than the other schemes. However, as described in Section 1.2, Yu et al. [20] revealed that Martínez-Peláez et al.’s scheme [19] is vulnerable to various attacks. Wang et al.’s scheme [30] applies a Chebyshev chaotic map as cryptography primitive to strengthen the security of the session key. However, their scheme does not provide the identity update phase. The securities of schemes proposed by Kumari et al. [16] and Wang et al. [15] are based on the ECC for which the communication participants agree on the session key. However, Wang et al.’s scheme [15] does not provide the session key verification procedure to check its validation, and Kumari et al. [16] do not design the identity update phase in their scheme. Meanwhile, our scheme has slightly higher computational costs than those of Kumari et al.’s [16] and Wang et al.’s scheme [30], although the proposed scheme satisfies all security requirements, as mentioned in Section 5.Table 3
Comparisons in terms of the computational time and the communication costs.
SchemeWang et al. [15]Kumari et al. [16]Martínez-Peláez et al. [19]Wang et al. [30]ProposedUi9Th+3Te7Th+3Te7Th+3Ts9Th+2TC+1TS12Th+3TeCSj3Th+3Te5Th+3Te5Th+3Ts5Th+2TC+1TS5Th+3TeRA7Th+2Te6Th+2Te21Th+2Ts9Th+4Ts10Th+2TeTotal19Th+8Te18Th+6Te33Th+8Ts21Th+4Tc+6Ts27Th+8TeTime514.14 ms513.64 ms86.1 ms147.78 ms514.64 msCommunication cost2080 bits2304 bits3200 bits1696 bits1792 bitsAccording to the results of previous analysis [28, 38], we assume that the lengths of the identity, random number, and timestamp are 128, 64, and 32 bits, respectively, for a comparison of the communication costs. The hash function produces 160 bits; the block size of the symmetric encryption is 128 bits; the size of the Chebyshev polynomial is 128 bits; the size of the point multiplication on the elliptic curve is 160 bits.Table3 also provides data from the comparisons of the communication costs. The total communication cost of the proposed scheme is 1792 bits, whereas those of Amin et al.’s [14], Kumari et al.’s [16], Martínez-Peláez et al.’s [19], and Wang et al.’s schemes [30] are 2080, 2304, 3200, and 1696 bits, respectively. Table 3 shows that the scheme proposed by Wang et al. [30] requires the lowest communication cost, whereas the proposed scheme has the second-lowest communication cost. However, as shown in Table 2, Wang et al.’s scheme [30] does not support the identity update phase. Therefore, the proposed scheme is a more practical option in a cloud computing environment.


## 8. Conclusion

In this study, we conducted an informal analysis to demonstrate the security of the proposed scheme against various known attacks. In addition, using ProVerif and BAN logic, we applied a formal analysis to prove that the user and cloud server establish a session key through secure mutual authentication. Moreover, we conducted an analysis of the proposed scheme in terms of the security features and performance; we compared it with those of existing related schemes and proved that our proposed scheme ensures better safety and efficiency in user management and that it is suitable for use in a practical cloud computing environment.



---

*Source: 2098530-2021-07-27.xml*