# Security Enhanced Anonymous Multiserver Authenticated Key Agreement Scheme Using Smart Cards and Biometrics

Authors: Younsung Choi; Junghyun Nam; Donghoon Lee; Jiye Kim; Jaewook Jung; Dongho Won
Journal: The Scientific World Journal
 (2014)

---

## Abstract

An anonymous user authentication scheme allows a user, who wants to access a remote application server, to achieve mutual authentication and session key establishment with the server in an anonymous manner. To enhance the security of such authentication schemes, recent researches combined user’s biometrics with a password. However, these authentication schemes are designed for single server environment. So when a user wants to access different application servers, the user has to register many times. To solve this problem, Chuang and Chen proposed an anonymous multiserver authenticated key agreement scheme using smart cards together with passwords and biometrics. Chuang and Chen claimed that their scheme not only supports multiple servers but also achieves various security requirements. However, we show that this scheme is vulnerable to a masquerade attack, a smart card attack, a user impersonation attack, and a DoS attack and does not achieve perfect forward secrecy. We also propose a security enhanced anonymous multiserver authenticated key agreement scheme which addresses all the weaknesses identified in Chuang and Chen’s scheme.


---

## Body

## 1. Introduction

With the rapid growth of internet technology, a system providing various services using the network often consists of many different servers around the world. The distribution of the remote system hardware allows its users to access resources efficiently and conveniently. In multiple server environments, an authentication mechanism is required to achieve a high level of security [1]. Lamport [2] first proposed a password authentication scheme for communication through an insecure channel. However, Lamport’s scheme requires the server to manage a password table and is, thus, vulnerable to stolen-verifier attacks. To resist this attack, several researchers proposed improved password-based authentication schemes using smart cards. But, these schemes are still easily broken by simple dictionary attacks due to the low entropy of passwords and because the information stored in smart cards could be extracted by physically monitoring power consumption [3, 4]. Therefore, many other researchers have combined users’ biometrics and passwords to enhance the security of their user authentication schemes for multiserver environments; see, for example, references [5–7] for earlier work in this domain. Every human being has a different biometrics, and thus, it is difficult for the adversary to compute the biometric information [8, 9].Relatively recently, D. Yang and B. Yang [10] and Yoon and Yoo [11] independently introduced a biometric-based multiserver authentication scheme. But, these schemes still do not consider user anonymity which has been identified as a major security property for privacy protection in many applications, including location-based services, anonymous web browsing, e-voting, and mobile roaming services. Moreover, D. Yang and B. Yang’s scheme requires users to perform expensive exponentiation operations, while Yoon and Yoo’s scheme, as demonstrated by He [12], is vulnerable to a privileged insider attack, a masquerade attack, and a stolen smart card attack.Recently, Chuang and Chen [13] proposed an anonymous multiserver authenticated key agreement scheme to address the weaknesses in the D. Yang and B. Yang’s scheme [10] and the Yoon-Yoo scheme [11]. This scheme is based on nonces and is very efficient in that it only requires users to perform hash function evaluations. Chuang and Chen claimed that their scheme satisfies all the desired security-related properties: anonymity, absence of verification tables, mutual authentication, resistance to forgery attack, resistance to modification attacks, resistance to replay attacks, fast error detection, resistance to off-line guessing attacks, resistance to insider attacks, simple and secure password choice and modification, biometric template protection, and session key agreement. However, we found that Chuang and Chen’s scheme has various security problems. According to our analysis given in this paper, Chuang and Chen’s scheme is vulnerable to a masquerade attack, a smart card attack, a user impersonation attack, and a denial-of-service (DoS) attack and does not achieve perfect forward secrecy. To solve these security problems with Chuang and Chen’s scheme, we propose an improved anonymous multiserver authenticated key agreement scheme using a smart card together with biometrics and passwords.The remainder of this paper is organized as follows. Section2 describes security and efficiency requirements for anonymous user authentication schemes in multiserver environments. Section 3 briefly reviews Chuang and Chen’s authentication scheme, while Section 4 provides a detailed security analysis on the scheme. Section 5 presents our security-enhanced authentication scheme and shows how the security weaknesses of Chuang and Chen’s scheme are addressed in our scheme. Section 6 analyzes our scheme in terms of both security and efficiency. Section 7 concludes the paper.


## 2. Requirements for Multiserver Authentication Schemes

Most conventional password authentication methods, when they are deployed in a multiple server environment, require each network user not only to log into various remote servers repetitively but also to remember many sets of identities and passwords. Such inefficiency and complexity easily lead to the exposure of users’ identities and passwords and necessarily make it difficult to manage the shared secret keys among the involved participants. Moreover, those conventional authentication methods usually do not provide user anonymity. In contrast, an anonymous multiserver authentication scheme is designed to allow users to be authenticated by multiple servers via only one registration with the registration center [1]. Figure 1 shows a framework of an anonymous user authentication system in a multiserver environment.Figure 1
Framework of a multiserver authentication system.


### 2.1. Security Properties

Various security requirements for a multiserver authentication scheme have been suggested in the previous studies [1, 7, 10, 13–24]. The most essential security properties include the following.(S1)
Anonymity: anonymity is of increasing importance and is achieved when the user’s identity is not disclosed to an unauthorized party.
(S2)
Mutual authentication: mutual authentication means that the two parties, user and server, authenticate each other. That is, both user and server are assured of each other’s identity.
(S3)
Session key agreement: the user and server securely agree on a session key to be used for protecting their subsequent communications.
(S4)
Perfect forward secrecy: perfect forward secrecy means that a session key derived from a set of long-term keys will not be compromised if one of the long-term keys is compromised in the future.


### 2.2. Attack Resistance

To achieve these security properties, a multiserver authentication scheme has to resist various kinds of attacks. The most typical attacks include the following(A1)
Replay attack: an adversary intercepts data transmissions for the purpose of making use of that data in some manner. Typically, this type of attack involves copying and possibly altering the data in various ways before releasing it for delivery to the intended recipient.
(A2)
Modification attack: an adversary intercepts the authentication message and attempts to modify it for illegal authentication.
(A3)
Stolen-verifier attack: an adversary steals the password-verifier from the server and directly uses it to masquerade as a legitimate user.
(A4)
Off-line guessing attack: an adversary guesses a password and verifies it in an off-line environment. The information stored in the smart card is often used in such an attack.
(A5)
Forgery attack: a malicious yet legitimate user attempts to forge an authentication message of another legitimate user.
(A6)
Insider attack: an insider attack literally means an attack mounted by a malicious insider. Malicious insiders have a distinct advantage over external adversaries because they have an authorized system access and also may be familiar with the network architecture and system policies/procedures. Typically, malicious insiders want to acquire users’ private information such as their password and biometrics.
(A7)
Masquerade attack: an adversary is authenticated by the server using a fake user ID.
(A8)
Smart card attack: an adversary is authenticated by the server by using only the information obtained from a user’s smart card but without the password or biometrics of the user.
(A9)
User impersonation attack: an adversary impersonates a legitimate user using only the user’s smart card but without the password or biometric of the user.
(A10)
DoS attack: a DoS attack is any event that diminishes or eliminates a network’s capability of performing its expected function. In other words, an adversary mounts a DoS attack to make the server unavailable.


### 2.3. Efficiency Measures

Efficiency is an important consideration in evaluating any schemes or protocols. The efficiency of a multiserver authentication scheme can be measured by the following metrics.(E1)
Single registration: a single point of registration ought to allow users to gain access to all the servers in the system.
(E2)
Simple and secure password modification: the system should allow users to choose and change their passwords easily and securely. In other words, each user should be able to change their passwords without the help of any third trusted party once the authenticity of the user is verified by its smart card.
(E3)
Fast error detection: the smart card needs to check the user’s incorrect password or any other discrepancy quickly.
(E4)
Low computational cost: the computational cost incurred by the scheme should be minimized for the participants.


## 2.1. Security Properties

Various security requirements for a multiserver authentication scheme have been suggested in the previous studies [1, 7, 10, 13–24]. The most essential security properties include the following.(S1)
Anonymity: anonymity is of increasing importance and is achieved when the user’s identity is not disclosed to an unauthorized party.
(S2)
Mutual authentication: mutual authentication means that the two parties, user and server, authenticate each other. That is, both user and server are assured of each other’s identity.
(S3)
Session key agreement: the user and server securely agree on a session key to be used for protecting their subsequent communications.
(S4)
Perfect forward secrecy: perfect forward secrecy means that a session key derived from a set of long-term keys will not be compromised if one of the long-term keys is compromised in the future.


## 2.2. Attack Resistance

To achieve these security properties, a multiserver authentication scheme has to resist various kinds of attacks. The most typical attacks include the following(A1)
Replay attack: an adversary intercepts data transmissions for the purpose of making use of that data in some manner. Typically, this type of attack involves copying and possibly altering the data in various ways before releasing it for delivery to the intended recipient.
(A2)
Modification attack: an adversary intercepts the authentication message and attempts to modify it for illegal authentication.
(A3)
Stolen-verifier attack: an adversary steals the password-verifier from the server and directly uses it to masquerade as a legitimate user.
(A4)
Off-line guessing attack: an adversary guesses a password and verifies it in an off-line environment. The information stored in the smart card is often used in such an attack.
(A5)
Forgery attack: a malicious yet legitimate user attempts to forge an authentication message of another legitimate user.
(A6)
Insider attack: an insider attack literally means an attack mounted by a malicious insider. Malicious insiders have a distinct advantage over external adversaries because they have an authorized system access and also may be familiar with the network architecture and system policies/procedures. Typically, malicious insiders want to acquire users’ private information such as their password and biometrics.
(A7)
Masquerade attack: an adversary is authenticated by the server using a fake user ID.
(A8)
Smart card attack: an adversary is authenticated by the server by using only the information obtained from a user’s smart card but without the password or biometrics of the user.
(A9)
User impersonation attack: an adversary impersonates a legitimate user using only the user’s smart card but without the password or biometric of the user.
(A10)
DoS attack: a DoS attack is any event that diminishes or eliminates a network’s capability of performing its expected function. In other words, an adversary mounts a DoS attack to make the server unavailable.


## 2.3. Efficiency Measures

Efficiency is an important consideration in evaluating any schemes or protocols. The efficiency of a multiserver authentication scheme can be measured by the following metrics.(E1)
Single registration: a single point of registration ought to allow users to gain access to all the servers in the system.
(E2)
Simple and secure password modification: the system should allow users to choose and change their passwords easily and securely. In other words, each user should be able to change their passwords without the help of any third trusted party once the authenticity of the user is verified by its smart card.
(E3)
Fast error detection: the smart card needs to check the user’s incorrect password or any other discrepancy quickly.
(E4)
Low computational cost: the computational cost incurred by the scheme should be minimized for the participants.


## 3. A Review of Chuang and Chen’s Scheme

This section describes Chuang and Chen’s anonymous multiserver authenticated key agreement scheme which involves four phases: server registration, user registration, login and authentication, and password change. For convenience, the notations used throughout this paper are summarized in Notation Section.


### 3.1. The Server Registration Phase

The application server sends the RC a join message if it would like to become an authorized server. Then, the RC replies with the key (PSK) to the server through a secure channel. And then, the authorized server uses the PSK to check the user’s authentication message. If the server needs to obtain the PSK from the RC to perform the authentication phase every session, authentication delay and the communication cost between the RC and the servers will increase substantially, but this scheme and proposed scheme register only once so they are efficient.


### 3.2.  The User Registration Phase

For a useruse
r
i, this phase is performed only once when use
r
i registers itself with the registration center RC.(1)
use
r
i chooses his identity UI
D
i and password P
W
i freely and inputs his biometrics BI
O
i and sends the identity use
r
i and h
(
P
W
i
⊕
BI
O
i
) to RC via a secure channel.
(2)
RC computesA
i
=
h
(
UI
D
i
∥
x
) and B
i
=
h
2
(
UI
D
i
∥
x
)
=
h
(
A
i
) and C
i
=
h
(
P
W
i
∥
BI
O
i
)
⊕
B
i and D
i
=
PSK
⊕
A
i and issues use
r
i a smart card loaded with 〈
UI
D
i
,
h
(
)
,
B
i
,
C
i
,
D
i
〉.


### 3.3.  The Login and Authentication Phase

In this phase,use
r
i logs in to the smart card and is authenticated by  serve
r
j. In login phase, is executed to check the user’s legality. The smart card can detects an error event immediately using the user’s identification, password, and biometrics information. And then, the smart card computes 〈
AUI
D
i
,
M
1
,
M
2
,
D
i
〉 for the authentication. In authentication phase, the smart card sends authentication messages to the serve
r
j after the use
r
i finishes the login phase successfully. The smart card never send user’s real identity to execute the authentication phase for providing the user’s anonymity. During the phase, the session-key establishment is conducted between use
r
i and serve
r
j. Algorithm 1 depicts how the login and authentication phase works.Algorithm 1:Login and authentication phase of Chuang and Chen’s scheme.
U
s
e
r
i          S
m
a
r
t
c
a
r
d         S
e
r
v
e
r
j
entersU
I
D
i and P
W
i
inputsB
I
O
i using sensors
→
〈
U
I
D
i
,
P
W
i
,
B
I
O
i
〉
checksU
I
D
i
checksh
(
P
W
i
⊕
B
I
O
i
)
⊕
C
i
=
B
i
generatesN
1
M
1
=
h
(
B
i
)
⊕
N
1
A
U
I
D
i
=
h
(
N
1
)
⊕
U
I
D
i
M
2
=
h
(
N
1
∥
A
U
I
D
i
∥
D
i
)
→
〈
A
U
I
D
i
,
M
1
,
M
2
,
D
i
〉
A
i
=
D
i
⊕
P
S
K
N
1
=
M
1
⊕
h
2
(
A
i
)
checks h
(
N
1
∥
A
U
I
D
i
∥
D
i
)
=
M
2
generatesN
2
S
K
i
j
=
h
(
N
1
∥
N
2
)
M
3
=
N
2
⊕
h
2
(
N
1
)
M
4
=
h
(
S
I
D
j
∥
N
2
)
←
〈
S
I
D
j
,
M
3
,
M
4
〉
computesh
2
(
N
1
)
N
2
=
M
3
⊕
h
2
(
N
1
)
checksh
(
S
I
D
j
∥
N
2
)
=
M
4
S
K
i
j
=
h
(
N
1
∥
N
2
)
→
〈
S
K
i
j
⊕
h
(
N
2
)
〉
checksh
(
N
2
)


### 3.4. The Password Change Phase

One of the general guidelines to get better password security is to ensure that passwords are changed at regular intervals. Chuang and Chen’s scheme allows legitimate users to freely change their passwords:(1)
use
r
i inserts his smart card into a card reader and enters both the current password P
W
i and the new password P
W
i
*.
(2)
The smart card checksUI
D
i and h
(
P
W
i
⊕
BI
O
i
)
⊕
C
i
=
B
i.
(3)
The smart card computesC
i
*
=
C
i
⊕
h
(
P
W
i
⊕
BI
O
i
)
⊕
h
(
P
W
i
*
⊕
BI
O
i
) and replaces C
i with C
i
*.


## 3.1. The Server Registration Phase

The application server sends the RC a join message if it would like to become an authorized server. Then, the RC replies with the key (PSK) to the server through a secure channel. And then, the authorized server uses the PSK to check the user’s authentication message. If the server needs to obtain the PSK from the RC to perform the authentication phase every session, authentication delay and the communication cost between the RC and the servers will increase substantially, but this scheme and proposed scheme register only once so they are efficient.


## 3.2.  The User Registration Phase

For a useruse
r
i, this phase is performed only once when use
r
i registers itself with the registration center RC.(1)
use
r
i chooses his identity UI
D
i and password P
W
i freely and inputs his biometrics BI
O
i and sends the identity use
r
i and h
(
P
W
i
⊕
BI
O
i
) to RC via a secure channel.
(2)
RC computesA
i
=
h
(
UI
D
i
∥
x
) and B
i
=
h
2
(
UI
D
i
∥
x
)
=
h
(
A
i
) and C
i
=
h
(
P
W
i
∥
BI
O
i
)
⊕
B
i and D
i
=
PSK
⊕
A
i and issues use
r
i a smart card loaded with 〈
UI
D
i
,
h
(
)
,
B
i
,
C
i
,
D
i
〉.


## 3.3.  The Login and Authentication Phase

In this phase,use
r
i logs in to the smart card and is authenticated by  serve
r
j. In login phase, is executed to check the user’s legality. The smart card can detects an error event immediately using the user’s identification, password, and biometrics information. And then, the smart card computes 〈
AUI
D
i
,
M
1
,
M
2
,
D
i
〉 for the authentication. In authentication phase, the smart card sends authentication messages to the serve
r
j after the use
r
i finishes the login phase successfully. The smart card never send user’s real identity to execute the authentication phase for providing the user’s anonymity. During the phase, the session-key establishment is conducted between use
r
i and serve
r
j. Algorithm 1 depicts how the login and authentication phase works.Algorithm 1:Login and authentication phase of Chuang and Chen’s scheme.
U
s
e
r
i          S
m
a
r
t
c
a
r
d         S
e
r
v
e
r
j
entersU
I
D
i and P
W
i
inputsB
I
O
i using sensors
→
〈
U
I
D
i
,
P
W
i
,
B
I
O
i
〉
checksU
I
D
i
checksh
(
P
W
i
⊕
B
I
O
i
)
⊕
C
i
=
B
i
generatesN
1
M
1
=
h
(
B
i
)
⊕
N
1
A
U
I
D
i
=
h
(
N
1
)
⊕
U
I
D
i
M
2
=
h
(
N
1
∥
A
U
I
D
i
∥
D
i
)
→
〈
A
U
I
D
i
,
M
1
,
M
2
,
D
i
〉
A
i
=
D
i
⊕
P
S
K
N
1
=
M
1
⊕
h
2
(
A
i
)
checks h
(
N
1
∥
A
U
I
D
i
∥
D
i
)
=
M
2
generatesN
2
S
K
i
j
=
h
(
N
1
∥
N
2
)
M
3
=
N
2
⊕
h
2
(
N
1
)
M
4
=
h
(
S
I
D
j
∥
N
2
)
←
〈
S
I
D
j
,
M
3
,
M
4
〉
computesh
2
(
N
1
)
N
2
=
M
3
⊕
h
2
(
N
1
)
checksh
(
S
I
D
j
∥
N
2
)
=
M
4
S
K
i
j
=
h
(
N
1
∥
N
2
)
→
〈
S
K
i
j
⊕
h
(
N
2
)
〉
checksh
(
N
2
)


## 3.4. The Password Change Phase

One of the general guidelines to get better password security is to ensure that passwords are changed at regular intervals. Chuang and Chen’s scheme allows legitimate users to freely change their passwords:(1)
use
r
i inserts his smart card into a card reader and enters both the current password P
W
i and the new password P
W
i
*.
(2)
The smart card checksUI
D
i and h
(
P
W
i
⊕
BI
O
i
)
⊕
C
i
=
B
i.
(3)
The smart card computesC
i
*
=
C
i
⊕
h
(
P
W
i
⊕
BI
O
i
)
⊕
h
(
P
W
i
*
⊕
BI
O
i
) and replaces C
i with C
i
*.


## 4. Security Vulnerabilities in Chuang and Chen’s Scheme

We analyze Chuang and Chen’s scheme and figure out some security vulnerabilities. Their scheme is vulnerable to the masquerade attack, smart card attack, user impersonation attack, and DoS attack and does not achieve perfect forward secrecy.


### 4.1. A Masquerade Attack

Chuang and Chen’s scheme is vulnerable to user masquerade attack. An adversary can be authenticated to anotherserve
r
k using the messages that use
r
i sends to serve
r
j for authentication. Figure 2 describes the masquerade attack on Chuang and Chen’s scheme. When the use
r
i wants to be authenticate with server
j, the use
r
i logs on the smart card and then sends a message (1) to the server
j. After an adversary intercepts the message (1), the adversary will send it to another server serve
r
k. This is because that message (1) does not include about the server
j as follows:
(1)
Message
(
1
)
=
〈
AUI
D
i
,
M
1
,
M
2
,
D
i
〉
,
AUI
D
i
=
h
(
N
1
)
⊕
UI
D
i
,
M
1
=
h
(
B
i
)
⊕
N
1
,
M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
)
,
D
i
=
A
i
⊕
PSK
.Figure 2
Masquerade attack on Chuang and Chen’s scheme.So theserve
r
k executes operation (2) and sends the message (3) to the adversary without any suspicion of the attack. The adversary forwards the message (3) to the use
r
i. The use
r
i does not check the SI
D
j of the serve
r
j. It only checks the sameness with the SID of M
4 and the SID of the message (3) as follows:
(2)
Message
(
3
)
=
〈
SI
D
j
,
M
3
,
M
4
〉
,
M
4
=
h
(
SI
D
j
∥
N
2
)
.So theuse
r
i executes operation (4) and sends message (5) to serve
r
j without any suspicion of the attack. Then, an adversary intercepts the message (5) and sends it to another serve
r
k. Finally, the adversary can be authenticated with serve
r
k. Therefore, the adversary can masquerade as a legitimate user to serve
r
k. In this way, the scheme becomes vulnerable to the masquerade attack.Theserve
r
k cannot check whether use
r
i wants to be authenticated by serve
r
k or not. Thus serve
r
k authenticates all legitimate messages though these message are not sent to serve
r
k. And use
r
i does not check whether serve
r
j wants to be authenticated with use
r
i. Thus use
r
i authenticates all legitimate messages though these message are sent by serve
r
k. The use
r
i only checks whether SID in message (3) and SID in M
4 are the same or not. To solve this problem, the destination of message is added to authentication messages. So the information about SID of serve
r
j has to be added to the message (1), and this means that use
r
i want to be authenticated with serve
r
j, not serve
r
k. And the information about AUID of use
r
i has to be added to message (3); it means that the serve
r
j wants to be authenticated with anonymous use
r
i.


### 4.2. A Smart Card Attack

When an adversary gets or steals the user’s smart card, the adversary can compute the session key between theuse
r
i and serve
r
j without the user’s password or biometric information. So the adversary can decrypt the all encrypted communications between the use
r
i and serve
r
j because the adversary can compute all previous session keys. Algorithm 3 describes the smart card attack on Chuang and Chen’s scheme.Algorithm 3:Smart card attack on Chuang and Chen’s scheme.
(i)A
d
v
e
r
s
a
r
y gets(steals) user’s smart card.
⇒ Extracting the information of smart card.
(Using SPA and DPA…etc) ⇒ Obtains  B
i
(ii)A
d
v
e
r
s
a
r
y gets M
1 and  M
3 in public channel.
⇒N
1
=
M
1
⊕
h
(
B
i
)
⇒N
2
=
M
3
⊕
h
2
(
N
1
)
⇒S
K
i
j
=
h
2
(
N
1
∥
N
2
)
(iii)A
d
v
e
r
s
a
r
y can compute the session key S
K
i
j between U
s
e
r
i and S
e
r
v
e
r
j.When the adversary obtains the user’s smart card, the adversary can extract information about the smart card using a side-channel attack such as SPA (simple power analysis) or DPA (differential power analysis). The adversary can obtainB
i in the user’s smart card and M
1, M
3 in the public communication channel. Then, the adversary can compute N
1 using M
1 and h
(
B
i
) and N
2 using M
3 and h
2
(
N
1
). Finally, the adversary can determine the session key user and server using N
1 and N
2. This scheme uses the combination values with a password and biometrics, so the adversary cannot compute the user’s password. However, using the smart card attack, the adversary can compute the session key between the use
r
i and the serve
r
j without the information about user’s password or biometrics.Kocher et al. and Messerges et al. pointed out that confidential information stored in all existent smart cards could be extracted by physically monitoring power consumption [3, 4]. If a user loses his smart card, all secrets in the smart card may be revealed to the adversary. Using this information, the adversary can determine the session key between the use
r
i and serve
r
j. To solve this problem, it is necessary to add authentication value that adversary cannot reveal using the side-channel attack. In other words, it is necessary to add the value that only legitimate user and server can compute using the secret information, which the adversary cannot know or compute.


### 4.3. A User Impersonation Attack

In Chuang and Chen’s scheme, an adversary can be authenticated with the server using user’s smart card without user’s password or biometrics, so the adversary can impersonate the legitimate user. It is critical problem that the adversary can be authenticated with the server using user’s smart card only. Figure3 describes the user impersonation attack on Chuang and Chen’s scheme. As described above, the adversary can illegally extract the secret values including B
i from the user’s smart card by some means. And he can intercept the message (1) = 〈
AUI
D
i
,
M
1
,
M
2
,
D
i
〉 and acquire the AUI
D
i, M
1, and D
i.Figure 3
User impersonation attack on Chuang and Chen's scheme.Next procedure for user impersonation attack occurs in the following steps. The adversary computes theN
1 using M
1 and h
(
B
i
). And then, he can figure out the UI
D
i using AUI
D
i and h
(
N
1
). Next, the adversary generates another random nonce N
A
1 and computes M
A
1, AUI
D
A
i, and M
A
2. Next, the adversary sends AUI
D
A
i, M
A
1, M
A
2, and D
i to serve
r
j. The adversary can be authenticate to serve
r
j because he knows B
i, N
A
1, and UI
D
i and the serve
r
j cannot figure out the difference between the adversary and legitimate user. The user’s password and biometric information are not used in authentication phase, so serve
r
j authenticates the adversary without doubt. serve
r
j does not store user’s password or biometric information because Chuang and Chen’s scheme is designed for anonymous user. Therefore, server cannot check the password or biometric information for authentication. To solve this problem, it is necessary to add the shared value between the user and servers. The share value can be computed by only the legitimate user using user’s password and biometircs in login and authentication phase, and never be stored in the smart card.


### 4.4. A DoS Attack

The DoS attack is an attempt to make a machine or network resource unavailable to its intended users. Although the means to carry out motives for and targets of the DoS attack may vary, it generally consists of efforts to temporarily or indefinitely interrupt or suspend services of a host connected to the networks. In Chuang and Chen’s scheme, an adversary can implement the DoS attack without difficulty. Figure4 describes DoS attack on Chuang and Chen’s scheme. The adversary gets the previous message (1) from a legitimate user and sends it to the serve
r
j. Then, the serve
r
j executes operation (2) and sends message (3) to the use
r
i. The processes of operation (2) include executing the hash function 7 times, calculating the exclusive-or operation 3 times, and generating a random nonce once. The adversary can attempt to make the server or network resource unavailable if he uses a lot of intercepted authentication messages.Figure 4
DoS attack on Chuang and Chen’s scheme.In Chuang and Chen’s scheme,serve
r
j does not check the freshness of authentication message from use
r
i. Thus, when an adversary sends the intercepted authentication messages to serve
r
j, the serve
r
j cannot know whether the message is current or outdated. So, serve
r
j executes a lot of operations. To resist the DoS attack, the serve
r
j has to check the freshness of messages using the timestamp or other means.


### 4.5. No Perfect Forward Secrecy

Perfect forward secrecy means that a session key derived from a set of long-term keys will not be compromised if one of the long-term keys is compromised in the future. Chuang and Chen’s scheme does not achieve perfect forward secrecy. So the adversary can compute the all session key between theuse
r
i and serve
r
j if the adversary knows the one of long-term keys A
i in future. Algorithm 2 describes why Chuang and Chen’s scheme does not achieve perfect forward secrecy. First, the adversary got M
P
1 and M
P
3 in previous communication between use
r
i and serve
r
j. Next, the adversary knows one of user’s long-term secrets A
i. So the adversary can calculate N
P
1 from N
P
1
=
M
P
1
⊕
h
2
(
A
i
) and N
P
2 from N
P
2
=
M
P
3
⊕
h
2
(
N
P
1
). Finally, the adversary can compute the previous session key S
K
P
i
j using N
P
1 and N
P
2 Therefore, this scheme does not achieve perfect forward secrecy.Algorithm 2:No perfect forward secrecy on Chuang and Chen’s scheme.
(i)A
d
v
e
r
s
a
r
y got M
P
1 and M
P
3 in previous public channel.
(ii)A
d
v
e
r
s
a
r
y knew one of user’s long-term secret:  A
i
⇒A
d
v
e
r
s
a
r
y has A
i
,
M
P
1 and M
P
3
⇒N
P
1
=
M
P
1
⊕
h
2
(
A
i
)
⇒N
P
2
=
M
P
3
⊕
h
2
(
N
P
1
)
⇒S
K
P
i
j
=
h
2
(
N
P
1
∥
N
P
2
)
(iii)A
d
v
e
r
s
a
r
y can compute all of previous session key S
K
P
i
j.In Chuang and Chen’s scheme,A
i is a secure shared key among RC and authenticated use
r
i. The RC computes A
i using UI
D
i and secret value x. And then, The RC sends the h
(
A
i
) to use
r
i within user’s smart card. The h
(
A
i
) is unchanged even if use
r
i changes his password. So A
i is one of the long-term keys. If an adversary got the M
P
1 and M
P
3 in previous public channel and knows A
i at present, the adversary can compute the previous session key between the use
r
i and serve
r
j. To solve this problem, it is needed that the adversary cannot compute the N
1 and N
2 using only A
i. By adding another secret information, it is necessary that the adversary cannot compromise the session key between use
r
i and serve
r
j.


## 4.1. A Masquerade Attack

Chuang and Chen’s scheme is vulnerable to user masquerade attack. An adversary can be authenticated to anotherserve
r
k using the messages that use
r
i sends to serve
r
j for authentication. Figure 2 describes the masquerade attack on Chuang and Chen’s scheme. When the use
r
i wants to be authenticate with server
j, the use
r
i logs on the smart card and then sends a message (1) to the server
j. After an adversary intercepts the message (1), the adversary will send it to another server serve
r
k. This is because that message (1) does not include about the server
j as follows:
(1)
Message
(
1
)
=
〈
AUI
D
i
,
M
1
,
M
2
,
D
i
〉
,
AUI
D
i
=
h
(
N
1
)
⊕
UI
D
i
,
M
1
=
h
(
B
i
)
⊕
N
1
,
M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
)
,
D
i
=
A
i
⊕
PSK
.Figure 2
Masquerade attack on Chuang and Chen’s scheme.So theserve
r
k executes operation (2) and sends the message (3) to the adversary without any suspicion of the attack. The adversary forwards the message (3) to the use
r
i. The use
r
i does not check the SI
D
j of the serve
r
j. It only checks the sameness with the SID of M
4 and the SID of the message (3) as follows:
(2)
Message
(
3
)
=
〈
SI
D
j
,
M
3
,
M
4
〉
,
M
4
=
h
(
SI
D
j
∥
N
2
)
.So theuse
r
i executes operation (4) and sends message (5) to serve
r
j without any suspicion of the attack. Then, an adversary intercepts the message (5) and sends it to another serve
r
k. Finally, the adversary can be authenticated with serve
r
k. Therefore, the adversary can masquerade as a legitimate user to serve
r
k. In this way, the scheme becomes vulnerable to the masquerade attack.Theserve
r
k cannot check whether use
r
i wants to be authenticated by serve
r
k or not. Thus serve
r
k authenticates all legitimate messages though these message are not sent to serve
r
k. And use
r
i does not check whether serve
r
j wants to be authenticated with use
r
i. Thus use
r
i authenticates all legitimate messages though these message are sent by serve
r
k. The use
r
i only checks whether SID in message (3) and SID in M
4 are the same or not. To solve this problem, the destination of message is added to authentication messages. So the information about SID of serve
r
j has to be added to the message (1), and this means that use
r
i want to be authenticated with serve
r
j, not serve
r
k. And the information about AUID of use
r
i has to be added to message (3); it means that the serve
r
j wants to be authenticated with anonymous use
r
i.


## 4.2. A Smart Card Attack

When an adversary gets or steals the user’s smart card, the adversary can compute the session key between theuse
r
i and serve
r
j without the user’s password or biometric information. So the adversary can decrypt the all encrypted communications between the use
r
i and serve
r
j because the adversary can compute all previous session keys. Algorithm 3 describes the smart card attack on Chuang and Chen’s scheme.Algorithm 3:Smart card attack on Chuang and Chen’s scheme.
(i)A
d
v
e
r
s
a
r
y gets(steals) user’s smart card.
⇒ Extracting the information of smart card.
(Using SPA and DPA…etc) ⇒ Obtains  B
i
(ii)A
d
v
e
r
s
a
r
y gets M
1 and  M
3 in public channel.
⇒N
1
=
M
1
⊕
h
(
B
i
)
⇒N
2
=
M
3
⊕
h
2
(
N
1
)
⇒S
K
i
j
=
h
2
(
N
1
∥
N
2
)
(iii)A
d
v
e
r
s
a
r
y can compute the session key S
K
i
j between U
s
e
r
i and S
e
r
v
e
r
j.When the adversary obtains the user’s smart card, the adversary can extract information about the smart card using a side-channel attack such as SPA (simple power analysis) or DPA (differential power analysis). The adversary can obtainB
i in the user’s smart card and M
1, M
3 in the public communication channel. Then, the adversary can compute N
1 using M
1 and h
(
B
i
) and N
2 using M
3 and h
2
(
N
1
). Finally, the adversary can determine the session key user and server using N
1 and N
2. This scheme uses the combination values with a password and biometrics, so the adversary cannot compute the user’s password. However, using the smart card attack, the adversary can compute the session key between the use
r
i and the serve
r
j without the information about user’s password or biometrics.Kocher et al. and Messerges et al. pointed out that confidential information stored in all existent smart cards could be extracted by physically monitoring power consumption [3, 4]. If a user loses his smart card, all secrets in the smart card may be revealed to the adversary. Using this information, the adversary can determine the session key between the use
r
i and serve
r
j. To solve this problem, it is necessary to add authentication value that adversary cannot reveal using the side-channel attack. In other words, it is necessary to add the value that only legitimate user and server can compute using the secret information, which the adversary cannot know or compute.


## 4.3. A User Impersonation Attack

In Chuang and Chen’s scheme, an adversary can be authenticated with the server using user’s smart card without user’s password or biometrics, so the adversary can impersonate the legitimate user. It is critical problem that the adversary can be authenticated with the server using user’s smart card only. Figure3 describes the user impersonation attack on Chuang and Chen’s scheme. As described above, the adversary can illegally extract the secret values including B
i from the user’s smart card by some means. And he can intercept the message (1) = 〈
AUI
D
i
,
M
1
,
M
2
,
D
i
〉 and acquire the AUI
D
i, M
1, and D
i.Figure 3
User impersonation attack on Chuang and Chen's scheme.Next procedure for user impersonation attack occurs in the following steps. The adversary computes theN
1 using M
1 and h
(
B
i
). And then, he can figure out the UI
D
i using AUI
D
i and h
(
N
1
). Next, the adversary generates another random nonce N
A
1 and computes M
A
1, AUI
D
A
i, and M
A
2. Next, the adversary sends AUI
D
A
i, M
A
1, M
A
2, and D
i to serve
r
j. The adversary can be authenticate to serve
r
j because he knows B
i, N
A
1, and UI
D
i and the serve
r
j cannot figure out the difference between the adversary and legitimate user. The user’s password and biometric information are not used in authentication phase, so serve
r
j authenticates the adversary without doubt. serve
r
j does not store user’s password or biometric information because Chuang and Chen’s scheme is designed for anonymous user. Therefore, server cannot check the password or biometric information for authentication. To solve this problem, it is necessary to add the shared value between the user and servers. The share value can be computed by only the legitimate user using user’s password and biometircs in login and authentication phase, and never be stored in the smart card.


## 4.4. A DoS Attack

The DoS attack is an attempt to make a machine or network resource unavailable to its intended users. Although the means to carry out motives for and targets of the DoS attack may vary, it generally consists of efforts to temporarily or indefinitely interrupt or suspend services of a host connected to the networks. In Chuang and Chen’s scheme, an adversary can implement the DoS attack without difficulty. Figure4 describes DoS attack on Chuang and Chen’s scheme. The adversary gets the previous message (1) from a legitimate user and sends it to the serve
r
j. Then, the serve
r
j executes operation (2) and sends message (3) to the use
r
i. The processes of operation (2) include executing the hash function 7 times, calculating the exclusive-or operation 3 times, and generating a random nonce once. The adversary can attempt to make the server or network resource unavailable if he uses a lot of intercepted authentication messages.Figure 4
DoS attack on Chuang and Chen’s scheme.In Chuang and Chen’s scheme,serve
r
j does not check the freshness of authentication message from use
r
i. Thus, when an adversary sends the intercepted authentication messages to serve
r
j, the serve
r
j cannot know whether the message is current or outdated. So, serve
r
j executes a lot of operations. To resist the DoS attack, the serve
r
j has to check the freshness of messages using the timestamp or other means.


## 4.5. No Perfect Forward Secrecy

Perfect forward secrecy means that a session key derived from a set of long-term keys will not be compromised if one of the long-term keys is compromised in the future. Chuang and Chen’s scheme does not achieve perfect forward secrecy. So the adversary can compute the all session key between theuse
r
i and serve
r
j if the adversary knows the one of long-term keys A
i in future. Algorithm 2 describes why Chuang and Chen’s scheme does not achieve perfect forward secrecy. First, the adversary got M
P
1 and M
P
3 in previous communication between use
r
i and serve
r
j. Next, the adversary knows one of user’s long-term secrets A
i. So the adversary can calculate N
P
1 from N
P
1
=
M
P
1
⊕
h
2
(
A
i
) and N
P
2 from N
P
2
=
M
P
3
⊕
h
2
(
N
P
1
). Finally, the adversary can compute the previous session key S
K
P
i
j using N
P
1 and N
P
2 Therefore, this scheme does not achieve perfect forward secrecy.Algorithm 2:No perfect forward secrecy on Chuang and Chen’s scheme.
(i)A
d
v
e
r
s
a
r
y got M
P
1 and M
P
3 in previous public channel.
(ii)A
d
v
e
r
s
a
r
y knew one of user’s long-term secret:  A
i
⇒A
d
v
e
r
s
a
r
y has A
i
,
M
P
1 and M
P
3
⇒N
P
1
=
M
P
1
⊕
h
2
(
A
i
)
⇒N
P
2
=
M
P
3
⊕
h
2
(
N
P
1
)
⇒S
K
P
i
j
=
h
2
(
N
P
1
∥
N
P
2
)
(iii)A
d
v
e
r
s
a
r
y can compute all of previous session key S
K
P
i
j.In Chuang and Chen’s scheme,A
i is a secure shared key among RC and authenticated use
r
i. The RC computes A
i using UI
D
i and secret value x. And then, The RC sends the h
(
A
i
) to use
r
i within user’s smart card. The h
(
A
i
) is unchanged even if use
r
i changes his password. So A
i is one of the long-term keys. If an adversary got the M
P
1 and M
P
3 in previous public channel and knows A
i at present, the adversary can compute the previous session key between the use
r
i and serve
r
j. To solve this problem, it is needed that the adversary cannot compute the N
1 and N
2 using only A
i. By adding another secret information, it is necessary that the adversary cannot compromise the session key between use
r
i and serve
r
j.


## 5. Our Proposed Scheme

Our proposed scheme improves Chuang and Chen’s scheme in various aspects: (1) it checks the destination of messages and so it prevents the masquerade attack, (2) it withstands the smart card attack and the user impersonation attack even when the information in the smart card is disclosed, (3) it resists DoS attacks by checking the freshness of messages, and (4) it protects the security of previously-established session keys even when the adversary knows the long-term keyA
i, thereby achieving perfect forward secrecy.


### 5.1. Countermeasures

The vulnerability of Chuang and Chen’s scheme to the masquerade attack is due to the fact that(i)
there is no way forserve
r
j to check whether the user wants to be authenticated with it or with another server, serve
r
k;
(ii)
use
r
i cannot check whether the server wants to be authenticated with him or with another user, use
r
j.This design flaw allows the adversary to be authenticated with serve
r
k using use
r
i’s message directed to serve
r
j. Therefore, to prevent the masquerade attack, we suggest to modify the computations of M
2 and M
4 from M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
) and M
4
=
h
(
SI
D
j
∥
N
2
) to
(3)
M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
)
,
M
4
=
h
(
SI
D
j
∥
N
2
∥
AUI
D
i
)
.
The server ID, SI
D
j, and the anonymous user ID, AUI
D
i, are now included as part of the inputs of the hash function. The inclusion of SI
D
j and AUI
D
i allows serve
r
j and use
r
i to confirm the destination of the messages M
2 and M
4, respectively, and therefore effectively prevents the masquerade attack.The Dos attack is possible becauseserve
r
j performs all its operations without checking the freshness of incoming messages, and thus it can be prevented by modifying the computation of M
2 to
(4)
M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
∥
T
i
)
,
where T
i is the timestamp retrieved by use
r
i and sent to serve
r
j. The inclusion of the timestamp T
i to the computation of M
2 enables serve
r
j to check and confirm the freshness of the user’s authentication message and prevents the DoS attack. Due to this modification, the authentication message of use
r
i should be also modified as follows:
(5)
〈
AUI
D
i
,
M
1
,
M
2
,
D
i
〉
⟶
〈
AUI
D
i
,
M
1
,
M
2
,
D
i
,
T
i
〉
.We next present a possible way of eliminating the vulnerability of Chuang and Chen’s scheme to the smart card attack. Recall that this vulnerability is due to that the valueB
i stored in the smart card together with M
1 and M
3 exchanged between use
r
i and serve
r
j enables the adversary to compute N
1 and N
2 and thereby to derive the session key S
K
i
j
=
h
2
(
N
1
∥
N
2
). Therefore, to prevent the smart card attack, we suggest to modify the computations of M
1 and M
3 from M
1
=
h
(
B
i
)
⊕
N
1 and M
3
=
N
2
⊕
h
2
(
N
1
) to
(6)
M
1
=
h
(
B
i
)
⊕
N
1
⊕
h
(
PSK
)
,
M
3
=
N
2
⊕
h
2
(
N
1
)
⊕
h
(
PSK
)
.
With this modification, the adversary now cannot compute N
1 and N
2 without the hash value h
(
PSK
). To make this countermeasure work, we add a new value E
i
=
h
(
PSK
)
⊕
h
(
P
W
i
⊕
BI
O
i
) to use
r
i’s smart card so that only use
r
i can extract h
(
PSK
) from its password and biometrics.However, with the modifications described above, Chuang and Chen’s scheme is still vulnerable to the user impersonation attack as the adversary can obtainh
(
P
W
i
⊕
BI
O
i
) from B
i and C
i
=
h
(
P
W
i
⊕
BI
O
i
)
⊕
B
i which are stored in the smart card. To prevent the user impersonation attack, we modify the computation of C
i to
(7)
C
i
=
h
(
P
W
i
⊕
BI
O
i
)
⊕
B
i
⊕
h
(
PSK
)
.
The adversary now cannot calculate h
(
P
W
i
⊕
BI
O
i
) as it does not know h
(
PSK
).Finally, to provide the perfect forward secrecy in our proposed scheme, we modify the computation ofD
i from D
i
=
PSK
⊕
A
i to
(8)
D
i
=
PSK
⊕
A
i
⊕
h
(
PSK
)
.
With this modification, the adversary cannot derive PSK from the long-term key A
i and, thus, cannot compute N
1, N
2, and the previous session key S
K
i
j
=
h
(
N
1
∥
N
2
).The password update phase should be also modified for consistency purpose (see Section5.5 for details). Combining all the modifications above together yields an improved authentication scheme described in the following subsections.


### 5.2. The Server Registration Phase

The application server sends a message for join to theRC when they want to become an authorized server. Then, the RC sends the key(
PSK
) to the server using secure communication. And then, the server is ready to compute h
(
PSK
) for user authentication. Next, the authorized server uses the shared information like PSK and h
(
PSK
) to check the user’s legitimacy in authentication phase.


### 5.3. The User Registration Phase

The registration phase of proposed scheme is described in Algorithm4. use
r
i needs to perform the user registration phase with the registration center using a secure channel. In this phase, RC sends to use
r
i the information about PSK and h
(
PSK
). PSK is included in D
i
=
PSK
⊕
A
i
⊕
h
(
PSK
). use
r
i can be authenticated with server
j using D
i but cannot compute the PSK and A
i even if he knows the D
i and h
(
PSK
). And use
r
i can calculate the h
(
PSK
) using user’s password and biometrics from E
i
=
h
(
PSK
)
⊕
h
(
P
W
i
⊕
BI
O
i
). In other words, the use
r
i receives the hidden PSK and h
(
PSK
) in D
i and E
i, respectively, included in smart card for user’s login and authentication. Detailed steps are explained as follows.(1)
Theuse
r
i sends UI
D
i and h
(
P
W
i
⊕
BI
O
i
) to the RC through a secure channel.
(2)
After receiving theuse
r
i’s information, the RC computes the authentication parameters for the use
r
i as follows:
(9)
A
i
=
h
(
UI
D
i
∥
x
)
,
B
i
=
h
2
(
UI
D
i
∥
x
)
=
h
(
A
i
)
,
C
i
=
h
(
PW
i
⊕
BI
O
i
)
⊕
B
i
,
D
i
=
PSK
⊕
A
i
⊕
h
(
PSK
)
,
E
i
=
h
(
PSK
)
⊕
h
(
P
W
i
⊕
BI
O
i
)
.
(3)
TheRC stores these authentication parameters 〈
UI
D
i, h
(
), B
i, C
i, D
i, E
i
〉 in a smart card and sends the smart card to use
r
i via a secure channel.Algorithm 4:Our registration phase.
U
s
e
r
i         R
e
g
i
s
t
r
a
i
o
n
c
e
n
t
e
r
→
S
e
c
u
r
e
,
〈
U
I
D
i
,
P
W
i
,
B
I
O
i
〉
A
i
=
h
(
U
I
D
i
∥
x
)
B
i
=
h
2
(
U
I
D
i
∥
x
)
=
h
(
A
i
)
C
i
=
h
(
P
W
i
⊕
B
I
O
i
)
⊕
B
i
D
i
=
P
S
K
⊕
A
i
⊕
h
(
P
S
K
)
E
i
=
h
(
P
S
K
)
⊕
h
(
P
W
i
⊕
B
I
O
i
)
←
S
e
c
u
r
e
,
〈
U
I
D
i
,
h
(
)
,
B
i
,
C
i
,
D
i
,
E
i
〉TheRC does not store the user’s password or biometrics information. Therefore, our proposed scheme is secure against a stolen-verifier attack. The registered user cannot fake another legitimate user successfully though the user obtains these parameters 〈
UI
D
i
,
h
(
)
,
B
i
,
C
i
,
D
i
,
E
i
〉. This is because that the user does not know the secret value x and PSK. The authenticated user can only compute h
(
PSK
) using his password and biometrics.


### 5.4. The Login and Authentication Phases

The login and authentication phases for the proposed scheme are described in Algorithm5. In the login phase, the smart card checks the legitimacy of the user. The smart card checks an error event immediately using identification, password, and biometric information. Detailed steps of the login phase are explained as follows.(1)
Theuse
r
i inserts his smart card into a card reader and enters his UI
D
i and P
W
i. Then, the use
r
i inputs his biometric information BI
O
i using the sensor.
(2)
The smart card checks theUI
D
i and confirms that B
i in smart card is same to h
(
P
W
i
⊕
BI
O
i
)
⊕
C
i. If all information is accurate, then the smart card generates a random nonce N
1 and a timestamp T
i and computes the h
(
PSK
) using E
i and h
(
P
W
i
⊕
BI
O
i
). Next the smart card computes the following:
(10)
M
1
=
h
(
B
i
)
⊕
N
1
⊕
h
(
PSK
)
,
AUI
D
i
=
h
(
N
1
)
⊕
UI
D
i
,
M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
∥
T
i
)
.Algorithm 5:Our login and authentication phase.
U
s
e
r
i          S
m
a
r
t
c
a
r
d         S
e
r
v
e
r
j
entersU
I
D
i and P
W
i
inputsB
I
O
i using sensors
→
〈
U
I
D
i
,
P
W
i
,
B
I
O
i
〉
checksU
I
D
i
checksh
(
P
W
i
⊕
B
I
O
i
)
⊕
C
i
=
B
i
h
(
P
S
K
)
=
E
i
⊕
h
(
P
W
i
⊕
B
I
O
i
)
generates a nonceN
1
generates a timestampT
i
M
1
=
h
(
B
i
)
⊕
N
1
⊕
h
(
P
S
K
)
A
U
I
D
i
=
h
(
N
1
)
⊕
U
I
D
i
M
2
=
h
(
N
1
∥
A
U
I
D
i
∥
D
i
∥
S
I
D
j
∣
T
i
)
→
〈
A
U
I
D
i
,
M
1
,
M
2
,
D
i
,
T
i
〉
checks the freshness of T
i
A
i
=
D
i
⊕
P
S
K
⊕
h
(
P
S
K
)
N
1
=
M
1
⊕
h
2
(
A
i
)
⊕
h
(
P
S
K
)
checksh
(
N
1
∥
A
U
I
D
i
∥
D
i
∥
S
I
D
j
∣
T
i
)
=
M
2
generatesN
2
S
K
i
j
=
h
(
N
1
∥
N
2
)
M
3
=
N
2
⊕
h
2
(
N
1
)
⊕
h
(
P
S
K
)
M
4
=
h
(
S
I
D
j
∥
N
2
∥
A
U
I
D
i
)
←
〈
S
I
D
j
,
M
3
,
M
4
〉
computesh
2
(
N
1
)
N
2
=
M
3
⊕
h
2
(
N
1
)
⊕
h
(
P
S
K
)
checksh
(
S
I
D
j
∥
N
2
∥
A
U
I
D
i
)
=
M
4
S
K
i
j
=
h
(
N
1
∥
N
2
)
→
〈
S
K
i
j
⊕
h
(
N
2
)
〉
checksh
(
N
2
)In the authentication phase, the smart card sends an authentication message to the server after theuse
r
i finishes the login phase successfully. The proposed scheme only uses the anonymous identity AUI
D
i to perform the authentication phase. The detailed steps of the authentication phase are explained as follows.(3)
The smart card sends the message〈
AUI
D
i, M
1, M
2, D
i, T
i
〉 to the serve
r
j for the use
r
i’s authentication.
(4)
Theserve
r
j confirms the legality of the use
r
i and the freshness of authentication message. First, the serve
r
j checks the freshness of T
i. If T
i is not fresh, the serve
r
j rejects the use
r
i’s request. The serve
r
j uses PSK and h
(
PSK
) to obtain A
i from the D
i. The serve
r
j computes the value of N
1 (N
1
=
M
1
⊕
h
2
(
A
i
)
⊕
h
(
PSK
)) and then confirms whether h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
∥
T
i
) is same to M
2. If the result of M
2 is not same, the serve
r
j terminates this session. Then, the serve
r
j computes UI
D
i usingh
(
N
1
) and checks the legitimacy of UI
D
i. Next, the serve
r
j generates a random nonce N
2 and computes the following:
(11)
S
K
i
j
=
h
(
N
1
∥
N
2
)
,
M
3
=
N
2
⊕
h
2
(
N
1
)
⊕
h
(
PSK
)
,
M
4
=
h
(
SI
D
j
∥
N
2
∥
AUI
D
i
)
.
(5)
Theserve
r
j sends back the authentication message 〈
SI
D
j, M
3, M
4
〉 to the smart card.
(6)
The smart card confirms the legality of theserve
r
j. It computes h
2
(
N
1
) and then calculates N
2 using M
3, h
2
(
N
1
), and h
(
PSK
). Next, the smart card checks whether
(12)
h
(
SI
D
j
∥
N
2
∥
AUI
D
i
)
=
M
4
.
Next, the smart card computes the session key S
K
i
j as h
(
N
1
∥
N
2
). Finally, the smart card computes S
K
i
j
⊕
h
(
N
2
).
(7)
The smart card sends the message〈
S
K
i
j
⊕
h
(
N
2
)
〉 to the serve
r
j.
(8)
Theserve
r
j uses the session key S
K
i
j for checking S
K
i
j
⊕
h
(
N
2
), anf if h
(
N
2
) is correct, the serve
r
j authenticates the use
r
i. From now on, the serve
r
j can communicate securely with use
r
i using the S
K
i
j


### 5.5. The Password Change Phase

The password change phase for the proposed scheme is described in Algorithm6. The proposed password change phase is executed when the use
r
i wants to update his password. In this phase, the use
r
i can easily change his password without any assistance from the registration center. Detailed processes are as follows.(1)
Theuse
r
i inserts his smart card into a card reader and enters both the current password P
W
i and the new password P
W
i
* with UI
D
i and BI
O
i.
(2)
The smart card checksUI
D
i and computes h
(
PSK
)
=
E
i
⊕
h
(
P
W
i
⊕
BI
O
i
) and then checks whether
(13)
h
(
P
W
i
⊕
BI
O
i
)
⊕
C
i
⊕
h
(
PSK
)
=
B
i
.
(3)
The smart card computesC
i
*
=
C
i
⊕
h
(
P
W
i
⊕
BI
O
i
)
⊕
h
(
P
W
i
*
⊕
BI
O
i
) and then replaces C
i with C
i
*.Algorithm 6:Our password change phase.
U
s
e
r
i                  S
m
a
r
t
c
a
r
d
→
S
e
c
u
r
e
,
〈
U
I
D
i
,
P
W
i
,
P
W
i
*
,
B
I
O
i
〉
checksU
I
D
i
computesh
(
P
S
K
)
=
E
i
⊕
h
(
P
W
i
⊕
B
I
O
i
)
checksh
(
P
W
i
⊕
B
I
O
i
)
⊕
C
i
⊕
h
(
P
S
K
)
=
B
i
inputs new passwordP
W
i
*
computesC
i
*
=
C
i
⊕
h
(
P
W
i
⊕
B
I
O
i
)
⊕
h
(
P
W
i
*
⊕
B
I
O
i
)
replaces C
i with C
i
*


## 5.1. Countermeasures

The vulnerability of Chuang and Chen’s scheme to the masquerade attack is due to the fact that(i)
there is no way forserve
r
j to check whether the user wants to be authenticated with it or with another server, serve
r
k;
(ii)
use
r
i cannot check whether the server wants to be authenticated with him or with another user, use
r
j.This design flaw allows the adversary to be authenticated with serve
r
k using use
r
i’s message directed to serve
r
j. Therefore, to prevent the masquerade attack, we suggest to modify the computations of M
2 and M
4 from M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
) and M
4
=
h
(
SI
D
j
∥
N
2
) to
(3)
M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
)
,
M
4
=
h
(
SI
D
j
∥
N
2
∥
AUI
D
i
)
.
The server ID, SI
D
j, and the anonymous user ID, AUI
D
i, are now included as part of the inputs of the hash function. The inclusion of SI
D
j and AUI
D
i allows serve
r
j and use
r
i to confirm the destination of the messages M
2 and M
4, respectively, and therefore effectively prevents the masquerade attack.The Dos attack is possible becauseserve
r
j performs all its operations without checking the freshness of incoming messages, and thus it can be prevented by modifying the computation of M
2 to
(4)
M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
∥
T
i
)
,
where T
i is the timestamp retrieved by use
r
i and sent to serve
r
j. The inclusion of the timestamp T
i to the computation of M
2 enables serve
r
j to check and confirm the freshness of the user’s authentication message and prevents the DoS attack. Due to this modification, the authentication message of use
r
i should be also modified as follows:
(5)
〈
AUI
D
i
,
M
1
,
M
2
,
D
i
〉
⟶
〈
AUI
D
i
,
M
1
,
M
2
,
D
i
,
T
i
〉
.We next present a possible way of eliminating the vulnerability of Chuang and Chen’s scheme to the smart card attack. Recall that this vulnerability is due to that the valueB
i stored in the smart card together with M
1 and M
3 exchanged between use
r
i and serve
r
j enables the adversary to compute N
1 and N
2 and thereby to derive the session key S
K
i
j
=
h
2
(
N
1
∥
N
2
). Therefore, to prevent the smart card attack, we suggest to modify the computations of M
1 and M
3 from M
1
=
h
(
B
i
)
⊕
N
1 and M
3
=
N
2
⊕
h
2
(
N
1
) to
(6)
M
1
=
h
(
B
i
)
⊕
N
1
⊕
h
(
PSK
)
,
M
3
=
N
2
⊕
h
2
(
N
1
)
⊕
h
(
PSK
)
.
With this modification, the adversary now cannot compute N
1 and N
2 without the hash value h
(
PSK
). To make this countermeasure work, we add a new value E
i
=
h
(
PSK
)
⊕
h
(
P
W
i
⊕
BI
O
i
) to use
r
i’s smart card so that only use
r
i can extract h
(
PSK
) from its password and biometrics.However, with the modifications described above, Chuang and Chen’s scheme is still vulnerable to the user impersonation attack as the adversary can obtainh
(
P
W
i
⊕
BI
O
i
) from B
i and C
i
=
h
(
P
W
i
⊕
BI
O
i
)
⊕
B
i which are stored in the smart card. To prevent the user impersonation attack, we modify the computation of C
i to
(7)
C
i
=
h
(
P
W
i
⊕
BI
O
i
)
⊕
B
i
⊕
h
(
PSK
)
.
The adversary now cannot calculate h
(
P
W
i
⊕
BI
O
i
) as it does not know h
(
PSK
).Finally, to provide the perfect forward secrecy in our proposed scheme, we modify the computation ofD
i from D
i
=
PSK
⊕
A
i to
(8)
D
i
=
PSK
⊕
A
i
⊕
h
(
PSK
)
.
With this modification, the adversary cannot derive PSK from the long-term key A
i and, thus, cannot compute N
1, N
2, and the previous session key S
K
i
j
=
h
(
N
1
∥
N
2
).The password update phase should be also modified for consistency purpose (see Section5.5 for details). Combining all the modifications above together yields an improved authentication scheme described in the following subsections.


## 5.2. The Server Registration Phase

The application server sends a message for join to theRC when they want to become an authorized server. Then, the RC sends the key(
PSK
) to the server using secure communication. And then, the server is ready to compute h
(
PSK
) for user authentication. Next, the authorized server uses the shared information like PSK and h
(
PSK
) to check the user’s legitimacy in authentication phase.


## 5.3. The User Registration Phase

The registration phase of proposed scheme is described in Algorithm4. use
r
i needs to perform the user registration phase with the registration center using a secure channel. In this phase, RC sends to use
r
i the information about PSK and h
(
PSK
). PSK is included in D
i
=
PSK
⊕
A
i
⊕
h
(
PSK
). use
r
i can be authenticated with server
j using D
i but cannot compute the PSK and A
i even if he knows the D
i and h
(
PSK
). And use
r
i can calculate the h
(
PSK
) using user’s password and biometrics from E
i
=
h
(
PSK
)
⊕
h
(
P
W
i
⊕
BI
O
i
). In other words, the use
r
i receives the hidden PSK and h
(
PSK
) in D
i and E
i, respectively, included in smart card for user’s login and authentication. Detailed steps are explained as follows.(1)
Theuse
r
i sends UI
D
i and h
(
P
W
i
⊕
BI
O
i
) to the RC through a secure channel.
(2)
After receiving theuse
r
i’s information, the RC computes the authentication parameters for the use
r
i as follows:
(9)
A
i
=
h
(
UI
D
i
∥
x
)
,
B
i
=
h
2
(
UI
D
i
∥
x
)
=
h
(
A
i
)
,
C
i
=
h
(
PW
i
⊕
BI
O
i
)
⊕
B
i
,
D
i
=
PSK
⊕
A
i
⊕
h
(
PSK
)
,
E
i
=
h
(
PSK
)
⊕
h
(
P
W
i
⊕
BI
O
i
)
.
(3)
TheRC stores these authentication parameters 〈
UI
D
i, h
(
), B
i, C
i, D
i, E
i
〉 in a smart card and sends the smart card to use
r
i via a secure channel.Algorithm 4:Our registration phase.
U
s
e
r
i         R
e
g
i
s
t
r
a
i
o
n
c
e
n
t
e
r
→
S
e
c
u
r
e
,
〈
U
I
D
i
,
P
W
i
,
B
I
O
i
〉
A
i
=
h
(
U
I
D
i
∥
x
)
B
i
=
h
2
(
U
I
D
i
∥
x
)
=
h
(
A
i
)
C
i
=
h
(
P
W
i
⊕
B
I
O
i
)
⊕
B
i
D
i
=
P
S
K
⊕
A
i
⊕
h
(
P
S
K
)
E
i
=
h
(
P
S
K
)
⊕
h
(
P
W
i
⊕
B
I
O
i
)
←
S
e
c
u
r
e
,
〈
U
I
D
i
,
h
(
)
,
B
i
,
C
i
,
D
i
,
E
i
〉TheRC does not store the user’s password or biometrics information. Therefore, our proposed scheme is secure against a stolen-verifier attack. The registered user cannot fake another legitimate user successfully though the user obtains these parameters 〈
UI
D
i
,
h
(
)
,
B
i
,
C
i
,
D
i
,
E
i
〉. This is because that the user does not know the secret value x and PSK. The authenticated user can only compute h
(
PSK
) using his password and biometrics.


## 5.4. The Login and Authentication Phases

The login and authentication phases for the proposed scheme are described in Algorithm5. In the login phase, the smart card checks the legitimacy of the user. The smart card checks an error event immediately using identification, password, and biometric information. Detailed steps of the login phase are explained as follows.(1)
Theuse
r
i inserts his smart card into a card reader and enters his UI
D
i and P
W
i. Then, the use
r
i inputs his biometric information BI
O
i using the sensor.
(2)
The smart card checks theUI
D
i and confirms that B
i in smart card is same to h
(
P
W
i
⊕
BI
O
i
)
⊕
C
i. If all information is accurate, then the smart card generates a random nonce N
1 and a timestamp T
i and computes the h
(
PSK
) using E
i and h
(
P
W
i
⊕
BI
O
i
). Next the smart card computes the following:
(10)
M
1
=
h
(
B
i
)
⊕
N
1
⊕
h
(
PSK
)
,
AUI
D
i
=
h
(
N
1
)
⊕
UI
D
i
,
M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
∥
T
i
)
.Algorithm 5:Our login and authentication phase.
U
s
e
r
i          S
m
a
r
t
c
a
r
d         S
e
r
v
e
r
j
entersU
I
D
i and P
W
i
inputsB
I
O
i using sensors
→
〈
U
I
D
i
,
P
W
i
,
B
I
O
i
〉
checksU
I
D
i
checksh
(
P
W
i
⊕
B
I
O
i
)
⊕
C
i
=
B
i
h
(
P
S
K
)
=
E
i
⊕
h
(
P
W
i
⊕
B
I
O
i
)
generates a nonceN
1
generates a timestampT
i
M
1
=
h
(
B
i
)
⊕
N
1
⊕
h
(
P
S
K
)
A
U
I
D
i
=
h
(
N
1
)
⊕
U
I
D
i
M
2
=
h
(
N
1
∥
A
U
I
D
i
∥
D
i
∥
S
I
D
j
∣
T
i
)
→
〈
A
U
I
D
i
,
M
1
,
M
2
,
D
i
,
T
i
〉
checks the freshness of T
i
A
i
=
D
i
⊕
P
S
K
⊕
h
(
P
S
K
)
N
1
=
M
1
⊕
h
2
(
A
i
)
⊕
h
(
P
S
K
)
checksh
(
N
1
∥
A
U
I
D
i
∥
D
i
∥
S
I
D
j
∣
T
i
)
=
M
2
generatesN
2
S
K
i
j
=
h
(
N
1
∥
N
2
)
M
3
=
N
2
⊕
h
2
(
N
1
)
⊕
h
(
P
S
K
)
M
4
=
h
(
S
I
D
j
∥
N
2
∥
A
U
I
D
i
)
←
〈
S
I
D
j
,
M
3
,
M
4
〉
computesh
2
(
N
1
)
N
2
=
M
3
⊕
h
2
(
N
1
)
⊕
h
(
P
S
K
)
checksh
(
S
I
D
j
∥
N
2
∥
A
U
I
D
i
)
=
M
4
S
K
i
j
=
h
(
N
1
∥
N
2
)
→
〈
S
K
i
j
⊕
h
(
N
2
)
〉
checksh
(
N
2
)In the authentication phase, the smart card sends an authentication message to the server after theuse
r
i finishes the login phase successfully. The proposed scheme only uses the anonymous identity AUI
D
i to perform the authentication phase. The detailed steps of the authentication phase are explained as follows.(3)
The smart card sends the message〈
AUI
D
i, M
1, M
2, D
i, T
i
〉 to the serve
r
j for the use
r
i’s authentication.
(4)
Theserve
r
j confirms the legality of the use
r
i and the freshness of authentication message. First, the serve
r
j checks the freshness of T
i. If T
i is not fresh, the serve
r
j rejects the use
r
i’s request. The serve
r
j uses PSK and h
(
PSK
) to obtain A
i from the D
i. The serve
r
j computes the value of N
1 (N
1
=
M
1
⊕
h
2
(
A
i
)
⊕
h
(
PSK
)) and then confirms whether h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
∥
T
i
) is same to M
2. If the result of M
2 is not same, the serve
r
j terminates this session. Then, the serve
r
j computes UI
D
i usingh
(
N
1
) and checks the legitimacy of UI
D
i. Next, the serve
r
j generates a random nonce N
2 and computes the following:
(11)
S
K
i
j
=
h
(
N
1
∥
N
2
)
,
M
3
=
N
2
⊕
h
2
(
N
1
)
⊕
h
(
PSK
)
,
M
4
=
h
(
SI
D
j
∥
N
2
∥
AUI
D
i
)
.
(5)
Theserve
r
j sends back the authentication message 〈
SI
D
j, M
3, M
4
〉 to the smart card.
(6)
The smart card confirms the legality of theserve
r
j. It computes h
2
(
N
1
) and then calculates N
2 using M
3, h
2
(
N
1
), and h
(
PSK
). Next, the smart card checks whether
(12)
h
(
SI
D
j
∥
N
2
∥
AUI
D
i
)
=
M
4
.
Next, the smart card computes the session key S
K
i
j as h
(
N
1
∥
N
2
). Finally, the smart card computes S
K
i
j
⊕
h
(
N
2
).
(7)
The smart card sends the message〈
S
K
i
j
⊕
h
(
N
2
)
〉 to the serve
r
j.
(8)
Theserve
r
j uses the session key S
K
i
j for checking S
K
i
j
⊕
h
(
N
2
), anf if h
(
N
2
) is correct, the serve
r
j authenticates the use
r
i. From now on, the serve
r
j can communicate securely with use
r
i using the S
K
i
j


## 5.5. The Password Change Phase

The password change phase for the proposed scheme is described in Algorithm6. The proposed password change phase is executed when the use
r
i wants to update his password. In this phase, the use
r
i can easily change his password without any assistance from the registration center. Detailed processes are as follows.(1)
Theuse
r
i inserts his smart card into a card reader and enters both the current password P
W
i and the new password P
W
i
* with UI
D
i and BI
O
i.
(2)
The smart card checksUI
D
i and computes h
(
PSK
)
=
E
i
⊕
h
(
P
W
i
⊕
BI
O
i
) and then checks whether
(13)
h
(
P
W
i
⊕
BI
O
i
)
⊕
C
i
⊕
h
(
PSK
)
=
B
i
.
(3)
The smart card computesC
i
*
=
C
i
⊕
h
(
P
W
i
⊕
BI
O
i
)
⊕
h
(
P
W
i
*
⊕
BI
O
i
) and then replaces C
i with C
i
*.Algorithm 6:Our password change phase.
U
s
e
r
i                  S
m
a
r
t
c
a
r
d
→
S
e
c
u
r
e
,
〈
U
I
D
i
,
P
W
i
,
P
W
i
*
,
B
I
O
i
〉
checksU
I
D
i
computesh
(
P
S
K
)
=
E
i
⊕
h
(
P
W
i
⊕
B
I
O
i
)
checksh
(
P
W
i
⊕
B
I
O
i
)
⊕
C
i
⊕
h
(
P
S
K
)
=
B
i
inputs new passwordP
W
i
*
computesC
i
*
=
C
i
⊕
h
(
P
W
i
⊕
B
I
O
i
)
⊕
h
(
P
W
i
*
⊕
B
I
O
i
)
replaces C
i with C
i
*


## 6. Analysis of Our Scheme

An anonymous multiserver authenticated key agreement scheme has three important requirements: the security properties, the attack resistance, and the efficiency, so it needs to analyze the proposed scheme using them. In this section, we explain how the proposed scheme is satisfied with the requirements and compare the proposed scheme with other authentication schemes.


### 6.1. Security Properties

(S1)
Anonymity: in the proposed scheme, an adversary cannot compute the user’s real identity UI
D
i without h
(
N
1
) because the real identity of user is always converted using AUI
D
i
=
h
(
N
1
)
⊕
UI
D
i. Only legitimate server can compute and check the user’s real identity, because the server has the PSK and can compute the N
1 from N
1
=
M
1
⊕
h
2
(
A
i
)
⊕
h
(
PSK
) using the PSK, M
1, and A
i. Thus, only authorized server confirms the UID of user. As a result, the adversary cannot obtain the user’s real identity, but legitimate use
r
i can anonymously be authenticated with serve
r
j.
(S2)
Mutual authentication: the mutual authentication means that two parties authenticate each other. In proposed scheme, the user and server authenticated each other using N
1, N
2, h
(
PSK
), and D
i. In the authentication phase, the server authenticates the user if the M
2 is correct as follows:
(14)
M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
∥
T
i
)
.
And the user authenticates the server using M
4 and N
2; it checks whetherthe M
4 is correct as follows:
(15)
M
4
=
h
(
SI
D
j
∥
N
2
∥
AUI
D
i
)
.
Though an adversary intercepts the messages and wants to fake a legitimate user/server, the adversary cannot compute the accurate values, so it cannot send valid reply message to the user/server. This is because that the adversary does not know the secret key PSK, h
(
PSK
) and random nonce N
1 and N
2.
(S3)
Session key agreement: in the proposed scheme, the user and server can share the session key after the authentication phase. Then, they can communicate securely using the shared session key, which encrypts the communication packets. The session key is generated using h
(
N
1
∥
N
2
). N
1 and N
2 change in every session, so session key is different in each session. Therefore, it is difficult for the adversary to compute the session key from the intercepted messages.
(S4)
Perfect forward secrecy: the proposed scheme computes the session key between the use
r
i and serve
r
j as follows:
(16)
A
i
=
D
i
⊕
PSK
⊕
h
(
PSK
)
,
N
1
=
M
1
⊕
h
2
(
A
i
)
⊕
h
(
PSK
)
,
N
2
=
M
3
⊕
h
2
(
N
1
)
⊕
h
(
PSK
)
,
S
K
i
j
=
h
(
N
1
∥
N
2
)
.
Though the user’s long-term key A
i is compromised, the adversary cannot compute N
1 or N
2 because the adversary cannot calculate the h
(
PSK
) and PSK, so it cannot generate session key between use
r
i and serve
r
j. Therefore, the proposed scheme achieves perfect forward secrecy. Table 1 shows the analysis on the security properties of various multisever authenticated key agreement schemes.Table 1
Comparison of security properties.
Security properties
D. Yang and B. Yang scheme [10]
Yoon and Yoo scheme [11]
Chuang and Chen scheme [13]
Our scheme
(S1) Anonymity
×
×
◯
◯
(S2) Mutual authentication
◯
◯
◯
◯
(S3) Session key agreement
◯
◯
◯
◯
(S4) Perfect forward secrecy
◯
◯
◯
◯


### 6.2. Attack Resistance

(A1)
Replay attack resistance: the proposed scheme is secure against replay attack by adding the random nonce N
1 and the timestamp T
i into the message. Though an adversary intercepts the previous authentication message 〈
AUI
D
i, M
1, M
2, D
i, T
i
〉 and sends it to the server, the server can check the illegality of the request using checking N
1 and T
i as follows:
(17)
checks
M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
∥
T
i
)
.
So the proposed scheme can prevent the replay attack using N
1 and T
i because the adversary cannot compute another M
2 in T
i
(A2)
Modification attack resistance: the adversary can intercept the authentication message and attempt to modify it for illegal authentication. Using a one-way hash function, the proposed scheme checks whether authentication information is modified or not. The adversary cannot obtain the random nonce N
i or h
(
PSK
), so the adversary cannot compute a legitimate authentication message. Therefore, the server and user can check whether the authentication message is modified by the adversary or not. Therefore, the proposed scheme is secure against modification attack.
(A3)
Stolen-verifier attack resistanc: the registration center and application servers do not have the user’s ID/password table or the biometrics. The application server serve
r
j authenticates the legitimate user using h
(
PSK
) and D
i. Therefore, the adversary cannot obtain the authentication information about legitimate users even if the adversary gets the authority to access the database of the RC or application servers. Thus, proposed scheme is secure against stolen-verifier attack.
(A4)
Off-line guessing attack resistance: an adversary can extract the information stored in smart card using a side-channel attack such as SPA or DPA. So the adversary can know UI
D
i, B
i, C
i, D
i, and E
i, but he cannot figure out a user’s password because h
(
PSK
), PSK, BI
O
i, and x are unknown to the adversary. In proposed scheme, the user’s password is always used with the biometrics of the user; h
(
P
W
i
⊕
BI
O
i
), which are protected by the one-way hash function. Therefore, the adversary cannot calculate the user’s password because biometric information has high entropy. Moreover, the adversary cannot figure out the biometrics because it is impossible for any two people to have the same biometrics template. Therefore, the proposed scheme is secure on off-line guessing attack.
(A5)
Forgery attack resistance: a legitimate user cannot attempt to forge another legitimate user. The legitimate use
r
i can know his parameters 〈
UI
D
i, B
i, C
i, D
i, E
i, P
W
i and BI
O
i
〉. However the use
r
i cannot calculate another user’s real identity because another user’s anonymous identity AUI
D
i changes in every session and is protected using a random nonce; AUI
D
i = h
(
N
1
)
⊕
UI
D
i. Therefore, the proposed scheme is secure against the forgery attack.
(A6)
Insider attack resistance: in the proposed scheme, the use
r
i never send plain P
W
i and BI
O
i to the registration center RC. The use
r
i sends only h
(
PW
i
⊕
BI
O
i
), so the RC cannot obtain the user’s password or biometrics. And the RC cannot compute the P
W
i using h
(
P
W
i
⊕
BI
O
i
) because the biometric information has high entropy. Moreover, h
(
P
W
i
⊕
BI
O
i
) is sent through a secure channel and needs not store in the database of RC. So, it is difficult for even insider adversary to figure out user’s P
W
i and BI
O
i. Therefore, the proposed scheme is secure against the insider attack.
(A7)
Masquerade attack resistance:the masquerade attack means that an adversary is authenticated with the legitimate server using a fake or real authentication information such as the authentication messages. In Chuang and Chen’s scheme, the adversary uses the authentication message between use
r
i and serve
r
j to gain unauthorized access of serve
r
k. This problem occurred because use
r
i and serve
r
j cannot check the destination of authentication message. To solve this problem, the proposed scheme uses AUI
D
i and SI
D
j including M
2 as follows:
(18)
M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
∥
T
i
)
.
AUI
D
i includes UI
D
i. So the serve
r
j can check whether use
r
i wants to be authenticated with serve
r
j or not. And also M
4 include AUI
D
i and SI
D
j as follows:
(19)
M
4
=
h
(
SI
D
j
∥
N
2
∥
AUI
D
i
)
.
So the use
r
i can check whether serve
r
j wants to be authenticated with use
r
i or not. The adversary cannot compute M
2 and M
4 because the adversary cannot compute N
1 and N
2. Therefore the proposed scheme is resistant to the masquerade attack.
(A8)
Smart card attack resistance: in the proposed scheme, the smart card stores various information such as 〈
UI
D
i, B
i, C
i, D
i, E
i, h
(
)
〉. An adversary can obtain all information stored in user’s smart card using SPA or DPA. But the adversary cannot compute the session key between use
r
i and serve
r
j using M
1 and M
3 because the adversary cannot compute h
(
PSK
) using obtained information as follows:
(20)
N
1
=
M
1
⊕
h
(
B
i
)
⊕
h
(
PSK
)
,
N
2
=
M
3
⊕
h
(
N
1
)
⊕
h
(
PSK
)
,
S
K
i
j
=
h
(
N
1
∥
N
2
)
.
Though the adversary obtains B
i and M
1, the adversary cannot compute N
1 because of the ignorance about h
(
PSK
). Thus the adversary cannot compute N
2 and S
K
i
j. Therefore the proposed scheme is secure against smart card attack.
(A9)
User impersonation attack resistance: in Chuang and Chen’s scheme, an adversary can impersonate the legitimate user using only user’s smart card because the adversary can be authenticated to the serve
r
j using user’s smart card without user’s password or biometrics. However, the proposed scheme uses h
(
PSK
) for protecting D
i, N
1, N
2, M
1, and M
3. For example, even though the adversary knows M
1 and B
i in M
1 = N
1
⊕
h
(
B
i
)
⊕
h
(
PSK
), the adversary cannot compute N
1 without h
(
PSK
), so he cannot generate the S
K
i
j. The adversary cannot know h
(
PSK
) without user’s password or biometric. So the adversary cannot impersonate a legal user. Therefore the proposed scheme is secure against the user impersonation attack.
(A10)
DoS attack resistance: the proposed scheme checks the freshness of message using timestamp, so it is useless that an adversary sends the previous message to the server. Moreover, the proposed scheme uses M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
∥
T
i
) that includes timestamp T
i. The server can check the freshness and legality of M
2 because M
2 and the timestamp do not match even though the adversary sends the previous M
2 with the current timestamp. Therefore the proposed scheme is more secure against the DoS attack than Chuang and Chen’s scheme.The proposed scheme is more secure than Chuang and Chen’s scheme against the masquerade attack, smart card attack, user impersonation attack, and DoS attack, and also it achieves perfect forward secrecy. Moreover, the proposed scheme is also satisfactory with regard to the anonymity, mutual authentication, session key agreement, replay attack resistance, modification attack resistance, stolen-verifier attack resistance, off-line guessing attack resistance, forgery attack resistance, and insider attack resistance. Table2 shows the analysis on attack resistance of various multisever authenticated key agreement schemes.Table 2
Comparison of attack resistance.
Attack resistance
D. Yang and B. Yang scheme [10]
Yoon and Yoo scheme [11]
Chuang and Chen scheme [13]
Our scheme
(A1) Replay attack
◯
×
◯
◯
(A2) Modification attack
◯
◯
◯
◯
(A3) Stolen-verifier attack
◯
◯
◯
◯
(A4) Off-line guessing attack
◯
×
◯
◯
(A5) Forgery attack
◯
×
◯
◯
(A6) Insider attack
×
×
◯
◯
(A7) Masquerade attack
×
×
×
◯
(A8) Smart card attack
◯
×
×
◯
(A9) User impersonation attack
◯
◯
×
◯
(A10) DoS attack
×
×
×
◯


### 6.3.  Efficiency

The efficiency measures include single registration, simple and secure password modification, fast error detection, and low computational cost. In performance, the proposed scheme has similar computational with Chuang and Chen’s scheme. Chuang and Chen’s scheme has slightly lower computational cost than the proposed scheme, but it is vulnerable to various attacks. The proposed scheme has a little higher computational cost, but it is more secure than Chuang and Chen’s scheme. In other words, the proposed scheme solves security problems using similar computational cost as compared with Chuang and Chen’s scheme.(E1)
Single registration: in the proposed scheme, a user can be authenticated with various servers. However, the user does not need to register with every servers. To use the server’s services, the user registers only one time with the registration center. The proposed scheme provides single registration so the user can anonymously use multiserver system using one registration.
(E2)
Simple and secure password modification: in the proposed scheme, the user can change the user’s password conveniently so that it is easy for the user to change the password anytime. And, the password change phase does not need any communication with the RC. Moreover, an adversary cannot change the password even though the adversary can obtain the smart card and the user’s password. This is because that the smart card can check the incorrect biometric information using P
W
i, BI
O
i, C
i, and B
i. The smart card verifies whether h
(
P
W
i
⊕
BI
O
i
)
⊕
C
i is the same to B
i as follows:
(21)
checks
B
i
=
h
(
P
W
i
⊕
BI
O
i
)
⊕
C
i
.
(E3)
Fast error detection: during the login and password change phases, the smart card detects the error or mistake immediately when the adversary inputs the wrong identification, password, and biometrics information. The smart card can check the error or mistake without the RC’s assistance. Therefore the proposed scheme provides fast error detection.In Table3, we use the following notations: “·”: that there is no computational cost in that phase, n: the number of users, m: the number of application servers, C
h: executing time of one-way hash function, C
F: executing time of the fuzzy extractor, C
ECC: executing time of the elliptic curve encryption or decryption operation, and C
EXP: executing time of the exponential operation. C
EXP is higher than C
ECC. And C
EXP and C
ECC are considerably higher than C
h. Therefore, the comparison of computational cost on above-mentioned operations is as follows:
(22)
C
EXP
>
C
ECC
>
C
h
.
And the hash function is generally executed quickly, so it is about 1000 times faster than asymmetric encryption. In D. Yang and B. Yang’s scheme, the exponential operation is executed. In Yoon and Yoo’s scheme, the elliptic curve encryption or decryption operation is executed. But in Chuang and Chen’s scheme and proposed scheme, they use only one-way hash function. Therefore, Chuang and Chen’s scheme and proposed scheme are faster than both D. Yang and B. Yang’s scheme and Yoon and Yoo’s scheme. And our proposed scheme adds only one C
h on RC’s operation in the registration phase and also adds only one C
h on server’s operation in authentication phase in comparison with Chuang and Chen’s scheme. C
h has a little computational cost. Therefore, our proposed scheme has similar computational cost as compared with Chuang and Chen’s scheme, but Chuang and Chen’s scheme has security vulnerabilities on the masquerade attack, smart card attack, user impersonation attack, and DoS attack as well as no perfect forward secrecy. Our proposed scheme similarly maintains the computational performance and solves the security problems of Chuang and Chen’s scheme. Therefore, the proposed scheme is the security enhanced anonymous multiserver authenticated key agreement scheme using the smart card and biometrics.Table 3
Comparison of efficiency measures.
Efficiency measures
D. Yang and B. Yang scheme [10]
Yoon and Yoo scheme [11]
Chuang and Chen scheme [13]
Our scheme
(E1) Single registration
◯
◯
◯
◯
(E2) S/S PW modification
◯
◯
◯
◯
(E3) Fast error detection
◯
◯
◯
◯
(E4) Low computational cost
Registration user
·
C
h
C
h
C
h
Registration server
·
·
·
·
Registration RC
n
(
3
C
h
+
C
EXP
+
C
F)
(
n
+
m
)
C
h
n
(
2
C
h
)
n
(
2
C
h
)
+
C
h
Login user
4
C
h
+
C
EXP
+
C
F
2
C
h
+
C
ECC
4
C
h
4
C
h
Login server
·
·
·
·
Authentication user
C
h
+
C
EXP
3
C
h
+
C
ECC
5
C
h
5
C
h
Authentication server
3
C
h
+
2
C
EXP
5
C
h
+
2
C
ECC
8
C
h
9
C
h
Authentication RC
·
7
C
h
·
·
PW change user
3
C
h
+
C
F
2
C
h
3
C
h
3
C
h
PW change RC
·
·
·
·


## 6.1. Security Properties

(S1)
Anonymity: in the proposed scheme, an adversary cannot compute the user’s real identity UI
D
i without h
(
N
1
) because the real identity of user is always converted using AUI
D
i
=
h
(
N
1
)
⊕
UI
D
i. Only legitimate server can compute and check the user’s real identity, because the server has the PSK and can compute the N
1 from N
1
=
M
1
⊕
h
2
(
A
i
)
⊕
h
(
PSK
) using the PSK, M
1, and A
i. Thus, only authorized server confirms the UID of user. As a result, the adversary cannot obtain the user’s real identity, but legitimate use
r
i can anonymously be authenticated with serve
r
j.
(S2)
Mutual authentication: the mutual authentication means that two parties authenticate each other. In proposed scheme, the user and server authenticated each other using N
1, N
2, h
(
PSK
), and D
i. In the authentication phase, the server authenticates the user if the M
2 is correct as follows:
(14)
M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
∥
T
i
)
.
And the user authenticates the server using M
4 and N
2; it checks whetherthe M
4 is correct as follows:
(15)
M
4
=
h
(
SI
D
j
∥
N
2
∥
AUI
D
i
)
.
Though an adversary intercepts the messages and wants to fake a legitimate user/server, the adversary cannot compute the accurate values, so it cannot send valid reply message to the user/server. This is because that the adversary does not know the secret key PSK, h
(
PSK
) and random nonce N
1 and N
2.
(S3)
Session key agreement: in the proposed scheme, the user and server can share the session key after the authentication phase. Then, they can communicate securely using the shared session key, which encrypts the communication packets. The session key is generated using h
(
N
1
∥
N
2
). N
1 and N
2 change in every session, so session key is different in each session. Therefore, it is difficult for the adversary to compute the session key from the intercepted messages.
(S4)
Perfect forward secrecy: the proposed scheme computes the session key between the use
r
i and serve
r
j as follows:
(16)
A
i
=
D
i
⊕
PSK
⊕
h
(
PSK
)
,
N
1
=
M
1
⊕
h
2
(
A
i
)
⊕
h
(
PSK
)
,
N
2
=
M
3
⊕
h
2
(
N
1
)
⊕
h
(
PSK
)
,
S
K
i
j
=
h
(
N
1
∥
N
2
)
.
Though the user’s long-term key A
i is compromised, the adversary cannot compute N
1 or N
2 because the adversary cannot calculate the h
(
PSK
) and PSK, so it cannot generate session key between use
r
i and serve
r
j. Therefore, the proposed scheme achieves perfect forward secrecy. Table 1 shows the analysis on the security properties of various multisever authenticated key agreement schemes.Table 1
Comparison of security properties.
Security properties
D. Yang and B. Yang scheme [10]
Yoon and Yoo scheme [11]
Chuang and Chen scheme [13]
Our scheme
(S1) Anonymity
×
×
◯
◯
(S2) Mutual authentication
◯
◯
◯
◯
(S3) Session key agreement
◯
◯
◯
◯
(S4) Perfect forward secrecy
◯
◯
◯
◯


## 6.2. Attack Resistance

(A1)
Replay attack resistance: the proposed scheme is secure against replay attack by adding the random nonce N
1 and the timestamp T
i into the message. Though an adversary intercepts the previous authentication message 〈
AUI
D
i, M
1, M
2, D
i, T
i
〉 and sends it to the server, the server can check the illegality of the request using checking N
1 and T
i as follows:
(17)
checks
M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
∥
T
i
)
.
So the proposed scheme can prevent the replay attack using N
1 and T
i because the adversary cannot compute another M
2 in T
i
(A2)
Modification attack resistance: the adversary can intercept the authentication message and attempt to modify it for illegal authentication. Using a one-way hash function, the proposed scheme checks whether authentication information is modified or not. The adversary cannot obtain the random nonce N
i or h
(
PSK
), so the adversary cannot compute a legitimate authentication message. Therefore, the server and user can check whether the authentication message is modified by the adversary or not. Therefore, the proposed scheme is secure against modification attack.
(A3)
Stolen-verifier attack resistanc: the registration center and application servers do not have the user’s ID/password table or the biometrics. The application server serve
r
j authenticates the legitimate user using h
(
PSK
) and D
i. Therefore, the adversary cannot obtain the authentication information about legitimate users even if the adversary gets the authority to access the database of the RC or application servers. Thus, proposed scheme is secure against stolen-verifier attack.
(A4)
Off-line guessing attack resistance: an adversary can extract the information stored in smart card using a side-channel attack such as SPA or DPA. So the adversary can know UI
D
i, B
i, C
i, D
i, and E
i, but he cannot figure out a user’s password because h
(
PSK
), PSK, BI
O
i, and x are unknown to the adversary. In proposed scheme, the user’s password is always used with the biometrics of the user; h
(
P
W
i
⊕
BI
O
i
), which are protected by the one-way hash function. Therefore, the adversary cannot calculate the user’s password because biometric information has high entropy. Moreover, the adversary cannot figure out the biometrics because it is impossible for any two people to have the same biometrics template. Therefore, the proposed scheme is secure on off-line guessing attack.
(A5)
Forgery attack resistance: a legitimate user cannot attempt to forge another legitimate user. The legitimate use
r
i can know his parameters 〈
UI
D
i, B
i, C
i, D
i, E
i, P
W
i and BI
O
i
〉. However the use
r
i cannot calculate another user’s real identity because another user’s anonymous identity AUI
D
i changes in every session and is protected using a random nonce; AUI
D
i = h
(
N
1
)
⊕
UI
D
i. Therefore, the proposed scheme is secure against the forgery attack.
(A6)
Insider attack resistance: in the proposed scheme, the use
r
i never send plain P
W
i and BI
O
i to the registration center RC. The use
r
i sends only h
(
PW
i
⊕
BI
O
i
), so the RC cannot obtain the user’s password or biometrics. And the RC cannot compute the P
W
i using h
(
P
W
i
⊕
BI
O
i
) because the biometric information has high entropy. Moreover, h
(
P
W
i
⊕
BI
O
i
) is sent through a secure channel and needs not store in the database of RC. So, it is difficult for even insider adversary to figure out user’s P
W
i and BI
O
i. Therefore, the proposed scheme is secure against the insider attack.
(A7)
Masquerade attack resistance:the masquerade attack means that an adversary is authenticated with the legitimate server using a fake or real authentication information such as the authentication messages. In Chuang and Chen’s scheme, the adversary uses the authentication message between use
r
i and serve
r
j to gain unauthorized access of serve
r
k. This problem occurred because use
r
i and serve
r
j cannot check the destination of authentication message. To solve this problem, the proposed scheme uses AUI
D
i and SI
D
j including M
2 as follows:
(18)
M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
∥
T
i
)
.
AUI
D
i includes UI
D
i. So the serve
r
j can check whether use
r
i wants to be authenticated with serve
r
j or not. And also M
4 include AUI
D
i and SI
D
j as follows:
(19)
M
4
=
h
(
SI
D
j
∥
N
2
∥
AUI
D
i
)
.
So the use
r
i can check whether serve
r
j wants to be authenticated with use
r
i or not. The adversary cannot compute M
2 and M
4 because the adversary cannot compute N
1 and N
2. Therefore the proposed scheme is resistant to the masquerade attack.
(A8)
Smart card attack resistance: in the proposed scheme, the smart card stores various information such as 〈
UI
D
i, B
i, C
i, D
i, E
i, h
(
)
〉. An adversary can obtain all information stored in user’s smart card using SPA or DPA. But the adversary cannot compute the session key between use
r
i and serve
r
j using M
1 and M
3 because the adversary cannot compute h
(
PSK
) using obtained information as follows:
(20)
N
1
=
M
1
⊕
h
(
B
i
)
⊕
h
(
PSK
)
,
N
2
=
M
3
⊕
h
(
N
1
)
⊕
h
(
PSK
)
,
S
K
i
j
=
h
(
N
1
∥
N
2
)
.
Though the adversary obtains B
i and M
1, the adversary cannot compute N
1 because of the ignorance about h
(
PSK
). Thus the adversary cannot compute N
2 and S
K
i
j. Therefore the proposed scheme is secure against smart card attack.
(A9)
User impersonation attack resistance: in Chuang and Chen’s scheme, an adversary can impersonate the legitimate user using only user’s smart card because the adversary can be authenticated to the serve
r
j using user’s smart card without user’s password or biometrics. However, the proposed scheme uses h
(
PSK
) for protecting D
i, N
1, N
2, M
1, and M
3. For example, even though the adversary knows M
1 and B
i in M
1 = N
1
⊕
h
(
B
i
)
⊕
h
(
PSK
), the adversary cannot compute N
1 without h
(
PSK
), so he cannot generate the S
K
i
j. The adversary cannot know h
(
PSK
) without user’s password or biometric. So the adversary cannot impersonate a legal user. Therefore the proposed scheme is secure against the user impersonation attack.
(A10)
DoS attack resistance: the proposed scheme checks the freshness of message using timestamp, so it is useless that an adversary sends the previous message to the server. Moreover, the proposed scheme uses M
2
=
h
(
N
1
∥
AUI
D
i
∥
D
i
∥
SI
D
j
∥
T
i
) that includes timestamp T
i. The server can check the freshness and legality of M
2 because M
2 and the timestamp do not match even though the adversary sends the previous M
2 with the current timestamp. Therefore the proposed scheme is more secure against the DoS attack than Chuang and Chen’s scheme.The proposed scheme is more secure than Chuang and Chen’s scheme against the masquerade attack, smart card attack, user impersonation attack, and DoS attack, and also it achieves perfect forward secrecy. Moreover, the proposed scheme is also satisfactory with regard to the anonymity, mutual authentication, session key agreement, replay attack resistance, modification attack resistance, stolen-verifier attack resistance, off-line guessing attack resistance, forgery attack resistance, and insider attack resistance. Table2 shows the analysis on attack resistance of various multisever authenticated key agreement schemes.Table 2
Comparison of attack resistance.
Attack resistance
D. Yang and B. Yang scheme [10]
Yoon and Yoo scheme [11]
Chuang and Chen scheme [13]
Our scheme
(A1) Replay attack
◯
×
◯
◯
(A2) Modification attack
◯
◯
◯
◯
(A3) Stolen-verifier attack
◯
◯
◯
◯
(A4) Off-line guessing attack
◯
×
◯
◯
(A5) Forgery attack
◯
×
◯
◯
(A6) Insider attack
×
×
◯
◯
(A7) Masquerade attack
×
×
×
◯
(A8) Smart card attack
◯
×
×
◯
(A9) User impersonation attack
◯
◯
×
◯
(A10) DoS attack
×
×
×
◯


## 6.3.  Efficiency

The efficiency measures include single registration, simple and secure password modification, fast error detection, and low computational cost. In performance, the proposed scheme has similar computational with Chuang and Chen’s scheme. Chuang and Chen’s scheme has slightly lower computational cost than the proposed scheme, but it is vulnerable to various attacks. The proposed scheme has a little higher computational cost, but it is more secure than Chuang and Chen’s scheme. In other words, the proposed scheme solves security problems using similar computational cost as compared with Chuang and Chen’s scheme.(E1)
Single registration: in the proposed scheme, a user can be authenticated with various servers. However, the user does not need to register with every servers. To use the server’s services, the user registers only one time with the registration center. The proposed scheme provides single registration so the user can anonymously use multiserver system using one registration.
(E2)
Simple and secure password modification: in the proposed scheme, the user can change the user’s password conveniently so that it is easy for the user to change the password anytime. And, the password change phase does not need any communication with the RC. Moreover, an adversary cannot change the password even though the adversary can obtain the smart card and the user’s password. This is because that the smart card can check the incorrect biometric information using P
W
i, BI
O
i, C
i, and B
i. The smart card verifies whether h
(
P
W
i
⊕
BI
O
i
)
⊕
C
i is the same to B
i as follows:
(21)
checks
B
i
=
h
(
P
W
i
⊕
BI
O
i
)
⊕
C
i
.
(E3)
Fast error detection: during the login and password change phases, the smart card detects the error or mistake immediately when the adversary inputs the wrong identification, password, and biometrics information. The smart card can check the error or mistake without the RC’s assistance. Therefore the proposed scheme provides fast error detection.In Table3, we use the following notations: “·”: that there is no computational cost in that phase, n: the number of users, m: the number of application servers, C
h: executing time of one-way hash function, C
F: executing time of the fuzzy extractor, C
ECC: executing time of the elliptic curve encryption or decryption operation, and C
EXP: executing time of the exponential operation. C
EXP is higher than C
ECC. And C
EXP and C
ECC are considerably higher than C
h. Therefore, the comparison of computational cost on above-mentioned operations is as follows:
(22)
C
EXP
>
C
ECC
>
C
h
.
And the hash function is generally executed quickly, so it is about 1000 times faster than asymmetric encryption. In D. Yang and B. Yang’s scheme, the exponential operation is executed. In Yoon and Yoo’s scheme, the elliptic curve encryption or decryption operation is executed. But in Chuang and Chen’s scheme and proposed scheme, they use only one-way hash function. Therefore, Chuang and Chen’s scheme and proposed scheme are faster than both D. Yang and B. Yang’s scheme and Yoon and Yoo’s scheme. And our proposed scheme adds only one C
h on RC’s operation in the registration phase and also adds only one C
h on server’s operation in authentication phase in comparison with Chuang and Chen’s scheme. C
h has a little computational cost. Therefore, our proposed scheme has similar computational cost as compared with Chuang and Chen’s scheme, but Chuang and Chen’s scheme has security vulnerabilities on the masquerade attack, smart card attack, user impersonation attack, and DoS attack as well as no perfect forward secrecy. Our proposed scheme similarly maintains the computational performance and solves the security problems of Chuang and Chen’s scheme. Therefore, the proposed scheme is the security enhanced anonymous multiserver authenticated key agreement scheme using the smart card and biometrics.Table 3
Comparison of efficiency measures.
Efficiency measures
D. Yang and B. Yang scheme [10]
Yoon and Yoo scheme [11]
Chuang and Chen scheme [13]
Our scheme
(E1) Single registration
◯
◯
◯
◯
(E2) S/S PW modification
◯
◯
◯
◯
(E3) Fast error detection
◯
◯
◯
◯
(E4) Low computational cost
Registration user
·
C
h
C
h
C
h
Registration server
·
·
·
·
Registration RC
n
(
3
C
h
+
C
EXP
+
C
F)
(
n
+
m
)
C
h
n
(
2
C
h
)
n
(
2
C
h
)
+
C
h
Login user
4
C
h
+
C
EXP
+
C
F
2
C
h
+
C
ECC
4
C
h
4
C
h
Login server
·
·
·
·
Authentication user
C
h
+
C
EXP
3
C
h
+
C
ECC
5
C
h
5
C
h
Authentication server
3
C
h
+
2
C
EXP
5
C
h
+
2
C
ECC
8
C
h
9
C
h
Authentication RC
·
7
C
h
·
·
PW change user
3
C
h
+
C
F
2
C
h
3
C
h
3
C
h
PW change RC
·
·
·
·


## 7.  Conclusion

Chuang and Chen proposed an anonymous multiserver authenticated key agreement scheme. This scheme is efficient in that it only requires users to perform hash function evaluations but has various security vulnerabilities. So, we show that this scheme is vulnerable to a masquerade attack, a smart card attack, a user impersonation attack, and a DoS attack and does not achieve perfect forward secrecy. To solve the security problems of Chuang and Chen’s scheme, we propose a security enhanced anonymous multiserver authenticated key agreement scheme using smart cards and biometrics. And also, we show how the security weaknesses of Chuang and Chen’s scheme are addressed in our scheme and lastly analyze our scheme in terms of both security and efficiency.



---

*Source: 281305-2014-09-08.xml*