# A Provably Secure Biometrics-Based Authentication Scheme for Multiserver Environment

Authors: Feifei Wang; Guoai Xu; Chenyu Wang; Junhao Peng
Journal: Security and Communication Networks
 (2019)

---

## Abstract

With the rapid development of mobile services, multiserver authentication protocol with its high efficiency has emerged as an indispensable security mechanism for mobile services. Recently, Ali et al. introduced a biometric-based multiserver authentication scheme and claimed the scheme is resistant to various attacks. However, after a careful examination, we find that Ali et al.’s scheme is vulnerable to various security attacks, such as user impersonation attack, server impersonation attack, privileged insider attack, denial of service attack, fails to provide forward secrecy and three-factor secrecy. To overcome these weaknesses, we propose an improved biometric-based multiserver authentication scheme using elliptic curve cryptosystem. Formal security analysis under the random oracle model proves that our scheme is provably secure. Furthermore, BAN (Burrows-Abadi-Needham) logic analysis demonstrates our scheme achieves mutual authentication and session key agreement. In addition, the informal analysis proves that our scheme is secure against all current known attacks and achieves desirable features. Besides, the performance and security comparison shows that our scheme is superior to related schemes.


---

## Body

## 1. Introduction

Nowadays, millions of people enjoy various mobile services such as mobile shopping, mobile entertainment, and mobile learning, by using various mobile devices. Due to the openness of mobile network, when the users are enjoying great conveniences brought by mobile services, they simultaneously face a great deal of security threatens, such as diverse network attacks and privacy leaks. Authentication protocol plays a great role in protecting the security and privacy of users as an indispensable security mechanism for various mobile services. It provides mutual authentication, user anonymity, and establishes secure session key for server and users [1].With the continuous expansion of the scale of mobile services, multiserver mode has been widely adopted by numerous mobile service application systems [2]. When the traditional single-server authentication schemes are applied to multiserver environment, it is extremely inconvenient for user to register himself with every server and keep many pairs of identity and password. To overcome this problem, multiserver authentication schemes have been introduced [3–10]. These schemes make the user registers once with registration center and keeps one pair of identity and password to obtain all the services. Multiserver authentication schemes are more attractive as high efficiency and convenience. But on the other hand, multiserver authentication schemes have more requirements for security. The user employs the same authentication information to access diverse servers. If the authentication information is compromised, it will bring tremendous damage to user’s assets. Besides, the malicious server may masquerade another server to defraud the user or impersonate user to access server based on the secret it has. This privileged insider attack should be overcome.In the past 20 years, many multiserver authentication schemes using password and smart card have been put forward [11–16]. However, the smart card may be lost or stolen, and the malicious attacker can retrieve the data in smart card by side channel attack. It increases the risk of security breach [17]. To overcome this weakness, biometric authentication element has been added in authentication schemes in recent years because of its good characteristics. Three-factor authentication schemes that adopt password, smart card, and biometric facilitate better security.Recently, some three-factor multiserver authentication schemes have been introduced. In 2010, Yoon et al. [18] introduced an efficient biometric-based multiserver authentication scheme using elliptic curve cryptosystem (ECC). Later on, Kim et al. [19] pointed out Yoon et al.’s scheme cannot resist smart card loss attack, forgery attack, and fails to provide forward secrecy. In 2015, Amin et al. [20] proposed a three-factor multiserver authentication scheme using bilinear pairing. Afterwards, Chandrakar et al. [21] proved Amin et al.’s scheme is susceptible to offline password guessing attack, impersonation attack, and fails to achieve user anonymity. He et al. [22] introduced a biometric-based multiserver authentication scheme using fuzzy extractor and ECC and claimed their scheme achieves intrinsically three-factor secrecy. But we observed He et al.’s scheme is susceptible to known session-specific temporary information attack and cannot detect wrong password and biometric immediately. In 2016, Wang et al. [23] presented a three-factor multiserver authentication scheme using hash function and fuzzy extractor. But Yang et al. [24] pointed out Wang et al.’s scheme cannot resist user impersonation attack and fails to achieve forward secrecy. In 2017, Kumari et al. [25] proposed a biometric-based multi-cloud-server authentication scheme using ECC and bio-hash function. However, Feng et al. [26] demonstrated that Kumari et al.’s scheme suffers from server impersonation attack and introduced an enhanced scheme. Unfortunately, we found Feng et al.’s scheme fails to achieve three-factor secrecy and suffers from known session-specific temporary information attack. Ali et al. [27] introduced a three-factor multiserver authentication scheme using symmetric encryption and ECC and claimed their scheme is resistant to a variety of security attacks. However, we found that Ali et al.’s scheme is not as secure as it claimed by demonstrating their scheme is vulnerable to a variety of serious security attacks.Either the existing three-factor multiserver authentication schemes [18–30] have more or less vulnerabilities, or their communication and computation costs need to be improved. This moves us to design a secure three-factor multiserver authentication scheme with higher efficiency. Our contributions are summed up as follows.(1)
We prove that Ali et al.’s scheme suffers from user impersonation attack, privileged insider attack, server impersonation attack, denial of service attack, and known session-specific temporary information attack. Besides, the scheme fails to achieve forward secrecy and three-factor secrecy.(2)
We propose a novel biometric-based multiserver authentication scheme using ECC. Formal security analysis under the random oracle model proves our scheme is provably secure. BAN logic proof proves the completeness of our scheme. Moreover, informal analysis demonstrates our scheme achieves various desirable features and is resistant to all known attacks.(3)
In addition, the performance and security comparison shows that our scheme achieves superior security properties. Moreover, our scheme has the least communication overhead and computation cost.


### 1.1. Adversary Model

When evaluating a three-factor multiserver authentication scheme, the capacities of adversaryA are described as follows.(1)
A may be an external attacker or a privileged insider.(2)
A can fully control the public channel; namely, A is able to interrupt, eavesdrop, forge, and modify the messages transmitted via public channel.(3)
A is able to enumerate all the values in DPW∗DID in polynomial time, where DPW denotes the password space and DID denotes the identity space [31].(4)
A is able to get user’s password by shoulder surfing. A can retrieve the data in smart card by power consumption analysis. A is able to get the biometric of user by a malicious terminal [32].(5)
When evaluating three-factor secrecy,A is able to get any two kinds of authentication elements at the same time but cannot get all [26].(6)
When evaluating forward secrecy,A can get the master key ofRCor the secret key of server.The user tends to choose an easy-to-remember password with low strength. The user identity usually is based on the predefined format. The identity and password may be of low entropy and can be easily guessed. According to the adversary model presented by Wang et al. [31], we assume the adversary A is able to enumerate all the values in DPW∗DID in polynomial time.Three-factor secrecy denotes that if any two kinds of authentication elements are compromised, the attacker still cannot breach the other one and damage the security of the system [26]. Such a consideration is of practical significance. The adversary may get user’s password by shoulder surfing or the data in smart card via side channel attack. Moreover, the adversary is able to obtain the biometric of user by a malicious biometric-based terminal.


### 1.2. The Organization of Paper

The structure of this paper is arranged as follows. We brief review and cryptanalyze Ali et al.’s scheme in Sections2 and 3. Section 4 introduces a novel biometric-based authentication scheme for multiserver environment. We give the security proof and informal security analysis of the proposed scheme in Sections 5 and 6. Section 7 is security and performance comparison of the relevant schemes. Section 8 concludes the paper. In addition, we sum up the notations of this paper in Table 1.Table 1
Notations.
Symbols Description U i i t h user S j ServerSj RC Registration center A Malicious adversary x Master key ofRC I D i, PWi, bi Identity, password and biometric ofUi S I D j Identity ofSj P A generator of elliptic curve groupEq E K e y ( ) / D K e y ( ) Symmetric encryption/decryption algorithm with keyKey S K Session key betweenUi and Sj ∥ The string concatenation operation ⊕ The bitwise XOR operation H 1 ( ) Hash function H 2 ( ) Bio-hash function, it maps the biometricbi and a tokenised random number to a random binary string


## 1.1. Adversary Model

When evaluating a three-factor multiserver authentication scheme, the capacities of adversaryA are described as follows.(1)
A may be an external attacker or a privileged insider.(2)
A can fully control the public channel; namely, A is able to interrupt, eavesdrop, forge, and modify the messages transmitted via public channel.(3)
A is able to enumerate all the values in DPW∗DID in polynomial time, where DPW denotes the password space and DID denotes the identity space [31].(4)
A is able to get user’s password by shoulder surfing. A can retrieve the data in smart card by power consumption analysis. A is able to get the biometric of user by a malicious terminal [32].(5)
When evaluating three-factor secrecy,A is able to get any two kinds of authentication elements at the same time but cannot get all [26].(6)
When evaluating forward secrecy,A can get the master key ofRCor the secret key of server.The user tends to choose an easy-to-remember password with low strength. The user identity usually is based on the predefined format. The identity and password may be of low entropy and can be easily guessed. According to the adversary model presented by Wang et al. [31], we assume the adversary A is able to enumerate all the values in DPW∗DID in polynomial time.Three-factor secrecy denotes that if any two kinds of authentication elements are compromised, the attacker still cannot breach the other one and damage the security of the system [26]. Such a consideration is of practical significance. The adversary may get user’s password by shoulder surfing or the data in smart card via side channel attack. Moreover, the adversary is able to obtain the biometric of user by a malicious biometric-based terminal.


## 1.2. The Organization of Paper

The structure of this paper is arranged as follows. We brief review and cryptanalyze Ali et al.’s scheme in Sections2 and 3. Section 4 introduces a novel biometric-based authentication scheme for multiserver environment. We give the security proof and informal security analysis of the proposed scheme in Sections 5 and 6. Section 7 is security and performance comparison of the relevant schemes. Section 8 concludes the paper. In addition, we sum up the notations of this paper in Table 1.Table 1
Notations.
Symbols Description U i i t h user S j ServerSj RC Registration center A Malicious adversary x Master key ofRC I D i, PWi, bi Identity, password and biometric ofUi S I D j Identity ofSj P A generator of elliptic curve groupEq E K e y ( ) / D K e y ( ) Symmetric encryption/decryption algorithm with keyKey S K Session key betweenUi and Sj ∥ The string concatenation operation ⊕ The bitwise XOR operation H 1 ( ) Hash function H 2 ( ) Bio-hash function, it maps the biometricbi and a tokenised random number to a random binary string


## 2. Review of Ali et al.’s Scheme

Ali et al.’s scheme consists of four phases: initial phase, server registration phase, user registration phase, login and authentication phase.


### 2.1. Initial Phase

RC chooses its master keyx. ThenRC selects an elliptic curve group Eq and a generator P of Eq.


### 2.2. Server Registration Phase

S j enrolls withRC in the following steps.Step 1.
The server picks its identitySIDj and sends {SIDj} as a registration request toRC through the reliable channel.Step 2.
Upon receiving{SIDj} from Sj,RC computes SMj=H1(SIDj∥x) and returns {SMj} to Sj through the reliable channel.Step 3.
S j keeps SMj as secret.


### 2.3. User Registration Phase

U i enrolls withRC in the following steps.Step 1.
U i picks his identity IDi and password PWi freely and imprints his biometric bi. Ui sends the registration request {IDi,H2(bi)} toRC through the reliable channel.Step 2.
Upon receiving{IDi,H2(bi)} from Ui,RC computes DIDi=EH1(x)(IDi∥N1), Ai=H1(IDi∥x)P, Bi=H2(bi)P, Ei=Ai+Bi, where N1 is a random number.RC stores {DIDi,Ei,P,EKey()} in a smart card and transmits it to Ui through the reliable channel.Step 3.
U i calculates Vi=H1(IDi∥PWi∥H2(bi)) and stores Vi in his smart card.


### 2.4. Login and Authentication Phase

U i and Sj authenticate each other and establish a session key drawing support fromRC as shown in Figure 1.Figure 1
Login and authentication phase of Ali et al.’s scheme.Step 1.
U i attaches the smart card to a terminal, inputs IDi∗ and PWi∗, and imprints bi∗. The smart card calculates Vi∗=H1(IDi∗∥PWi∗∥H2(bi∗)) and checks if Vi∗=Vi. If the equation holds, proceed to the next step.Step 2.
U i computes Ri=riP, Bi∗=H2bi∗P, Ci=Ri+Bi∗, Di=H1(IDi∗∥Ri∥SIDj∥Ei), where ri is a random number. Ui sends {DIDi,Ei,Ci,Di} toRC through the public communication channel.Step 3.
After receiving{DIDi,Ei,Ci,Di},RC computes IDi∥N1=DH1x(DIDi), Ai′=H1(IDi∥x)P, Bi′=Ei-Ai′, Ri′=Ci-Bi′, Di′=H1(IDi∥Ri′∥SIDj∥Ei) and compares Di′ with Di. If they are equal, proceed to the next step.Step 4.
RC computes DIDinew=EH1(x)(IDi∥rRC), Fi=EH1SIDj∥x(IDi∥Ri′∥H2(bi)), RRC=rRCP, Ki=RRC+H2(bi)P, Li=H1RRC∥DIDinew∥IDi∥SIDj, whererRC is a random number.RC sends {DIDinew,Ki,Li,Fi} to Sj.Step 5.
Upon receiving{DIDinew,Ki,Li,Fi}, Sj computes (IDi∥Ri′′∥H2(bi)′)=DSMj(Fi), RRC′=Ki-H2(bi)′P, Li′=H1(RRC′∥DIDinew∥IDi∥SIDj) and checks if Li′=Li. If it holds, Sj computes RS=rSP, Qi=RS+Ri′′, Mi=H1(DIDinew∥RS∥RRC′∥H2(bi)′P), where rS is a random number. Sj sends {DIDinew,Qi,Mi,Ki} to Ui.Step 6.
Upon receiving{DIDinew,Qi,Mi,Ki}, Ui computes RS′=Qi-Ri, RRC′′=Ki-Bi∗, Mi′=H1(DIDinew∥RS′∥RRC′′∥Bi∗) and checks if Mi′=Mi. If the equation holds, Ui computes SK=H1(Ri∥RS′∥RRC′′), Zi=SK·P+H1(IDi∥H2(bi∗))·P. Ui replaces DIDi with DIDinew in his smart card and sends {Zi} to Sj.Step 7.
Upon receiving{Zi}, Sj computes SK=H1(Ri′′∥RS∥RRC′), Zi′=SK·P+H1IDi∥H2(bi)′·P and checks if Zi′=Zi. If the equation holds, Sj and Ui authenticate each other and establish a session key SK successfully.


## 2.1. Initial Phase

RC chooses its master keyx. ThenRC selects an elliptic curve group Eq and a generator P of Eq.


## 2.2. Server Registration Phase

S j enrolls withRC in the following steps.Step 1.
The server picks its identitySIDj and sends {SIDj} as a registration request toRC through the reliable channel.Step 2.
Upon receiving{SIDj} from Sj,RC computes SMj=H1(SIDj∥x) and returns {SMj} to Sj through the reliable channel.Step 3.
S j keeps SMj as secret.


## 2.3. User Registration Phase

U i enrolls withRC in the following steps.Step 1.
U i picks his identity IDi and password PWi freely and imprints his biometric bi. Ui sends the registration request {IDi,H2(bi)} toRC through the reliable channel.Step 2.
Upon receiving{IDi,H2(bi)} from Ui,RC computes DIDi=EH1(x)(IDi∥N1), Ai=H1(IDi∥x)P, Bi=H2(bi)P, Ei=Ai+Bi, where N1 is a random number.RC stores {DIDi,Ei,P,EKey()} in a smart card and transmits it to Ui through the reliable channel.Step 3.
U i calculates Vi=H1(IDi∥PWi∥H2(bi)) and stores Vi in his smart card.


## 2.4. Login and Authentication Phase

U i and Sj authenticate each other and establish a session key drawing support fromRC as shown in Figure 1.Figure 1
Login and authentication phase of Ali et al.’s scheme.Step 1.
U i attaches the smart card to a terminal, inputs IDi∗ and PWi∗, and imprints bi∗. The smart card calculates Vi∗=H1(IDi∗∥PWi∗∥H2(bi∗)) and checks if Vi∗=Vi. If the equation holds, proceed to the next step.Step 2.
U i computes Ri=riP, Bi∗=H2bi∗P, Ci=Ri+Bi∗, Di=H1(IDi∗∥Ri∥SIDj∥Ei), where ri is a random number. Ui sends {DIDi,Ei,Ci,Di} toRC through the public communication channel.Step 3.
After receiving{DIDi,Ei,Ci,Di},RC computes IDi∥N1=DH1x(DIDi), Ai′=H1(IDi∥x)P, Bi′=Ei-Ai′, Ri′=Ci-Bi′, Di′=H1(IDi∥Ri′∥SIDj∥Ei) and compares Di′ with Di. If they are equal, proceed to the next step.Step 4.
RC computes DIDinew=EH1(x)(IDi∥rRC), Fi=EH1SIDj∥x(IDi∥Ri′∥H2(bi)), RRC=rRCP, Ki=RRC+H2(bi)P, Li=H1RRC∥DIDinew∥IDi∥SIDj, whererRC is a random number.RC sends {DIDinew,Ki,Li,Fi} to Sj.Step 5.
Upon receiving{DIDinew,Ki,Li,Fi}, Sj computes (IDi∥Ri′′∥H2(bi)′)=DSMj(Fi), RRC′=Ki-H2(bi)′P, Li′=H1(RRC′∥DIDinew∥IDi∥SIDj) and checks if Li′=Li. If it holds, Sj computes RS=rSP, Qi=RS+Ri′′, Mi=H1(DIDinew∥RS∥RRC′∥H2(bi)′P), where rS is a random number. Sj sends {DIDinew,Qi,Mi,Ki} to Ui.Step 6.
Upon receiving{DIDinew,Qi,Mi,Ki}, Ui computes RS′=Qi-Ri, RRC′′=Ki-Bi∗, Mi′=H1(DIDinew∥RS′∥RRC′′∥Bi∗) and checks if Mi′=Mi. If the equation holds, Ui computes SK=H1(Ri∥RS′∥RRC′′), Zi=SK·P+H1(IDi∥H2(bi∗))·P. Ui replaces DIDi with DIDinew in his smart card and sends {Zi} to Sj.Step 7.
Upon receiving{Zi}, Sj computes SK=H1(Ri′′∥RS∥RRC′), Zi′=SK·P+H1IDi∥H2(bi)′·P and checks if Zi′=Zi. If the equation holds, Sj and Ui authenticate each other and establish a session key SK successfully.


## 3. Cryptanalysis of Ali et al.’s Scheme

In this section, we demonstrate that Ali et al.’s scheme is susceptible to several security attacks. Note that, we cryptanalyze Ali et al.’s scheme on the basis of the adversary capacities mentioned in Section1.


### 3.1. Forward Secrecy

The adversaryA compromises the master keyx, and intercepts {DIDinew,Ki,Li,Fi} and {DIDinew,Qi,Mi,Ki} from public channel. Then A is able to retrieve the session key in the following steps.Step 1.
ComputeSMj=H1(SIDj∥x), (IDi∥Ri′∥H2(bi)′)=DSMj(Fi).Step 2.
ComputeRS′=Qi-Ri′.Step 3.
ComputeRRC′=Ki-H2(bi)′P.Step 4.
ComputeSK=H1(Ri′∥RS′∥RRC′).


### 3.2. User Impersonation Attack

The adversaryA gets Ui’s identity IDi by shoulder surfing and Ui’s biometric bi by a malicious terminal and intercepts {DIDi,Ei,Ci,Di} from public channel. Then A performs user impersonation attack in the following steps.Step 1.
A computesRia=riaP, Bi=H2(bi)P, Ca=Ria+Bi, Da=H1(IDi∥Ria∥SIDj∥Ei), where ria is a random number. A sends {DIDi,Ei,Ca,Da} toRC.Step 2.
Upon receiving{DIDi,Ei,Ca,Da},RC computes IDi∥N1=DH1(x)(DIDi), Bi′=Ei-H1(IDi∥x)P, Ria′=Ca-Bi′, Da′=H1(IDi∥Ria′∥SIDj∥Ei), obviously Da′=Da. ThenRC computes DIDinew=EH1(x)(IDi∥rRC), Fa=EH1SIDj∥x(IDi∥Ria′∥H2(bi)), RRC=rRCP, Ki=RRC+H2(bi)P, Li=H1RRC∥DIDinew∥IDi∥SIDj, whererRC is a random number.RC sends {DIDinew,Ki,Li,Fa} to Sj.Step 3.
Upon receiving{DIDinew,Ki,Li,Fa}, Sjcomputes (IDi∥Ria′′∥H2(bi)′)=DSMj(Fa), RRC′=Ki-H2(bi)′P, Li′=H1(RRC′∥DIDinew∥IDi∥SIDj), obviously Li′=Li. Then Sj computes RS=rSP, Qa=RS+Ria′′, Mi=H1(DIDinew∥RS∥RRC′∥H2(bi)′P), where rS is a random number. Sj sends {DIDinew,Qa,Mi,Ki} to A.Step 4.
Upon receiving{DIDinew,Qa,Ma,Ki}, A computes RS′=Qa-Ria, RRC′′=Ki-Bi, SK=H1(Ria∥RS′∥RRC′′), Za=SK·P+H1(IDi∥H2(bi))·P and sends {Za} to Sj.Step 5.
Upon receiving{Za}, Sj computes SK=H1(Ria′′∥RS∥RRC′), Za′=SK·P+H1(IDi∥H2(bi)′)·P, obviously Za′=Za. Sj regards A as legitimate user Ui.


### 3.3. Server Impersonation Attack

The adversaryA obtains Ui’s biometric bi and intercepts {DIDi,Ei,Ci,Di} from public channel. Afterwards, A performs server impersonation attack in the following steps.Step 1.
A chooses two random numbers rSa,rRCa and computes RSa=rSaP, RRCa=rRCaP, Bi=H2(bi)P, Ri′=Ci-Bi, Qa=RSa+Ri′, Ka=RRCa+Bi, Ma=H1(DIDia∥RSa∥RRCa∥Bi), where DIDia is a random binary string whose length is equal with DIDi. A sends {DIDia,Qa,Ma,Ka} to Ui.Step 2.
Upon receiving{DIDia,Qa,Ma,Ka}, Ui computes RSa′=Qa-Ri, RRCa′=Ka-Bi∗, Ma′=H1(DIDia∥RSa′∥RRCa′∥Bi∗), obviously Ma′=Ma; Ui regards A as the server Sj. Ui computes SK=H1(Ri∥RSa′∥RRCa′), Za=SK·P+H1(IDi∥H2(bi∗))·P. Ui replaces DIDi with DIDia in his smart card, sends {Za} to A.Step 3.
Upon receiving{Za}, A computes SK=H1(Ri′∥RSa∥RRCa). A establishes a session key SK with Ui successfully.


### 3.4. Denial of Service Attack

In the process of server impersonation attack, the adversaryA delivers a forged dynamic identity DIDia to Ui. Ui believes its validity and stores it in the smart card. When Ui intends to access the server, Ui sends a login request with DIDia toRC. As DIDia is a random binary string rather than the encryption results of IDi and a random number,RC rejects the login request. In addition, Ui cannot login any server, unless Ui reregister withRC.


### 3.5. Privileged Insider Attack

In authentication phase of Ali et al.’s scheme,H2(bi) and new dynamic identity DIDinew is exposed to Sj. With H2(bi) and DIDinew, Sj who acts as a privileged insider can masquerade user Ui to access server or impersonate the other server to defraud Ui. As their attack procedures are the same with aforementioned user impersonation attack and server impersonation attack, we omit it.


### 3.6. Known Session-Specific Temporary Information Attack

Known session-specific temporary information attack is a cryptanalysis under the circumstance the temporary secret value such as random number is leaked and the adversary tries to breach the current session key. Suppose thatA obtains Ui’s biometric bi and intercepts {DIDinew,Qi,Mi,Ki} from public channel. In the case that random number ri is compromised. A can get the session key in the following steps.Step 1.
ComputeRi=riP.Step 2.
ComputeBi=H2(bi)P.Step 3.
ComputeRRC=Ki-Bi.Step 4.
ComputeRS=Qi-Ri.Step 5.
ComputeSK=H1(Ri∥RS∥RRC).


### 3.7. Three-Factor Secrecy

In case thatUi’s smart card {DIDi,Ei,P,EKey(),Vi} and biometric bi are breached, the adversary is able to acquire Ui’s password via the following steps.Step 1.
Guess the value ofIDi to be IDi∗ from identity dictionary space; guess the value of PWi to be PWi∗ from identity dictionary space.Step 2.
ComputeVi∗=H1(IDi∗∥PWi∗∥H2bi); check if Vi∗=Vi. If the equation holds, it shows that IDi∗ is Ui’s real identity and PWi∗ is Ui’s correct password.Step 3.
Repeat Steps 1 and 2, untilA finds the correct IDi and PWi.When the smart card and biometric of user are compromised, the attacker is able to breach the password. On the other hand,A is able to impersonate user successfully as long as he gets the biometric of user. Ali et al.’s scheme fails to achieve three-factor secrecy.


## 3.1. Forward Secrecy

The adversaryA compromises the master keyx, and intercepts {DIDinew,Ki,Li,Fi} and {DIDinew,Qi,Mi,Ki} from public channel. Then A is able to retrieve the session key in the following steps.Step 1.
ComputeSMj=H1(SIDj∥x), (IDi∥Ri′∥H2(bi)′)=DSMj(Fi).Step 2.
ComputeRS′=Qi-Ri′.Step 3.
ComputeRRC′=Ki-H2(bi)′P.Step 4.
ComputeSK=H1(Ri′∥RS′∥RRC′).


## 3.2. User Impersonation Attack

The adversaryA gets Ui’s identity IDi by shoulder surfing and Ui’s biometric bi by a malicious terminal and intercepts {DIDi,Ei,Ci,Di} from public channel. Then A performs user impersonation attack in the following steps.Step 1.
A computesRia=riaP, Bi=H2(bi)P, Ca=Ria+Bi, Da=H1(IDi∥Ria∥SIDj∥Ei), where ria is a random number. A sends {DIDi,Ei,Ca,Da} toRC.Step 2.
Upon receiving{DIDi,Ei,Ca,Da},RC computes IDi∥N1=DH1(x)(DIDi), Bi′=Ei-H1(IDi∥x)P, Ria′=Ca-Bi′, Da′=H1(IDi∥Ria′∥SIDj∥Ei), obviously Da′=Da. ThenRC computes DIDinew=EH1(x)(IDi∥rRC), Fa=EH1SIDj∥x(IDi∥Ria′∥H2(bi)), RRC=rRCP, Ki=RRC+H2(bi)P, Li=H1RRC∥DIDinew∥IDi∥SIDj, whererRC is a random number.RC sends {DIDinew,Ki,Li,Fa} to Sj.Step 3.
Upon receiving{DIDinew,Ki,Li,Fa}, Sjcomputes (IDi∥Ria′′∥H2(bi)′)=DSMj(Fa), RRC′=Ki-H2(bi)′P, Li′=H1(RRC′∥DIDinew∥IDi∥SIDj), obviously Li′=Li. Then Sj computes RS=rSP, Qa=RS+Ria′′, Mi=H1(DIDinew∥RS∥RRC′∥H2(bi)′P), where rS is a random number. Sj sends {DIDinew,Qa,Mi,Ki} to A.Step 4.
Upon receiving{DIDinew,Qa,Ma,Ki}, A computes RS′=Qa-Ria, RRC′′=Ki-Bi, SK=H1(Ria∥RS′∥RRC′′), Za=SK·P+H1(IDi∥H2(bi))·P and sends {Za} to Sj.Step 5.
Upon receiving{Za}, Sj computes SK=H1(Ria′′∥RS∥RRC′), Za′=SK·P+H1(IDi∥H2(bi)′)·P, obviously Za′=Za. Sj regards A as legitimate user Ui.


## 3.3. Server Impersonation Attack

The adversaryA obtains Ui’s biometric bi and intercepts {DIDi,Ei,Ci,Di} from public channel. Afterwards, A performs server impersonation attack in the following steps.Step 1.
A chooses two random numbers rSa,rRCa and computes RSa=rSaP, RRCa=rRCaP, Bi=H2(bi)P, Ri′=Ci-Bi, Qa=RSa+Ri′, Ka=RRCa+Bi, Ma=H1(DIDia∥RSa∥RRCa∥Bi), where DIDia is a random binary string whose length is equal with DIDi. A sends {DIDia,Qa,Ma,Ka} to Ui.Step 2.
Upon receiving{DIDia,Qa,Ma,Ka}, Ui computes RSa′=Qa-Ri, RRCa′=Ka-Bi∗, Ma′=H1(DIDia∥RSa′∥RRCa′∥Bi∗), obviously Ma′=Ma; Ui regards A as the server Sj. Ui computes SK=H1(Ri∥RSa′∥RRCa′), Za=SK·P+H1(IDi∥H2(bi∗))·P. Ui replaces DIDi with DIDia in his smart card, sends {Za} to A.Step 3.
Upon receiving{Za}, A computes SK=H1(Ri′∥RSa∥RRCa). A establishes a session key SK with Ui successfully.


## 3.4. Denial of Service Attack

In the process of server impersonation attack, the adversaryA delivers a forged dynamic identity DIDia to Ui. Ui believes its validity and stores it in the smart card. When Ui intends to access the server, Ui sends a login request with DIDia toRC. As DIDia is a random binary string rather than the encryption results of IDi and a random number,RC rejects the login request. In addition, Ui cannot login any server, unless Ui reregister withRC.


## 3.5. Privileged Insider Attack

In authentication phase of Ali et al.’s scheme,H2(bi) and new dynamic identity DIDinew is exposed to Sj. With H2(bi) and DIDinew, Sj who acts as a privileged insider can masquerade user Ui to access server or impersonate the other server to defraud Ui. As their attack procedures are the same with aforementioned user impersonation attack and server impersonation attack, we omit it.


## 3.6. Known Session-Specific Temporary Information Attack

Known session-specific temporary information attack is a cryptanalysis under the circumstance the temporary secret value such as random number is leaked and the adversary tries to breach the current session key. Suppose thatA obtains Ui’s biometric bi and intercepts {DIDinew,Qi,Mi,Ki} from public channel. In the case that random number ri is compromised. A can get the session key in the following steps.Step 1.
ComputeRi=riP.Step 2.
ComputeBi=H2(bi)P.Step 3.
ComputeRRC=Ki-Bi.Step 4.
ComputeRS=Qi-Ri.Step 5.
ComputeSK=H1(Ri∥RS∥RRC).


## 3.7. Three-Factor Secrecy

In case thatUi’s smart card {DIDi,Ei,P,EKey(),Vi} and biometric bi are breached, the adversary is able to acquire Ui’s password via the following steps.Step 1.
Guess the value ofIDi to be IDi∗ from identity dictionary space; guess the value of PWi to be PWi∗ from identity dictionary space.Step 2.
ComputeVi∗=H1(IDi∗∥PWi∗∥H2bi); check if Vi∗=Vi. If the equation holds, it shows that IDi∗ is Ui’s real identity and PWi∗ is Ui’s correct password.Step 3.
Repeat Steps 1 and 2, untilA finds the correct IDi and PWi.When the smart card and biometric of user are compromised, the attacker is able to breach the password. On the other hand,A is able to impersonate user successfully as long as he gets the biometric of user. Ali et al.’s scheme fails to achieve three-factor secrecy.


## 4. The Proposed Scheme

In this section, we present a biometric-based remote user authentication scheme for multiserver environment. The proposed scheme includes the following five phases.


### 4.1. Initial Phase

RC chooses an elliptic curve group Eq of orderpand a generator P of Eq.RC generates a random number x and computes Ppub=xP.RC publishes {Eq,P,Ppub,H1(),H2()} and keeps x as secret.


### 4.2. Server Registration Phase

The serverSj registers withRC in the following steps.Step 1.
S j picks its identity SIDj freely and delivers {SIDj} toRC through the reliable channel.Step 2.
Upon receiving{SIDj},RC calculates SMj=H1(SIDj∥x) and returns SMj to Sj via the reliable channel.Step 3.
S j keeps SMj as secret.


### 4.3. User Registration Phase

The userUi registers withRC in the following steps. As described in Figure 2.Figure 2
User registration phase of the proposed scheme.Step 1.
U i chooses his identity IDi and password PWi freely and imprints his biometric bi. Ui calculates Pi=H1(PWi∥H2bi∥ri), where ri is a random number. Afterwards, {IDi,Pi} is transmitted toRC through the reliable channel.Step 2.
Upon receiving{IDi,Pi},RC computes Ai=H1(x∥IDi), Bi=Ai⨁Pi, Vi=H1(Pi⨁H1IDi)modn, where 24≤n≤28.RC stores {Bi,Vi,EKey(),P,Ppub,n} in a smart card and transmits it to Ui via the reliable communication channel.Step 3.
U i stores ri in the smart card.


### 4.4. Login and Authentication Phase

The userUi and the server Sj authenticate each other and establish a session key by the aide ofRC in the following steps. As shown in Figure 3.Figure 3
Login and authentication phase of the proposed scheme.Step 1.
U i attaches the smart card to a terminal, enters IDi∗ and PWi∗, and imprints bi∗. Then the smart card calculates Pi∗=H1(PWi∗∥H2bi∗∥ri), Vi∗=H1Pi∗⨁H1IDi∗modn and checks if Vi∗=Vi. If this equation holds, the smart card computes Ai∗=Bi⊕Pi∗, Ri=N1P, Ci=H1(N1Ppub), Li=ECi(IDi∗∥Ai∗∥SIDj), where N1 is a random number. {Ri,Li} is transmitted toRCvia the public channel.Step 2.
After receiving{Ri,Li},RC computes Ci′=H1(xRi), IDi′∥Ai′∥SIDj′=DCi′(Li), Ai=H1(x∥IDi′) and checks if Ai=Ai′. If the equation holds,RC computes SMj=H1(SIDj′∥x), Yi=H1(SIDj′∥SMj), Mi=ESMj(IDi′∥Ri∥Yi∥H1Ai∥Ci′). {Mi} is transmitted to Sj.Step 3.
After receiving{Mi}, Sj computes (IDi′′∥Ri′∥Yi′∥H1Ai∥Ci′′)=DSMj(Mi), Yi′′=H1(SIDj∥SMj) and checks if Yi′′ is equal to Yi′. If it holds, Sj computes RS=N2P, Ei=N2·Ri, SK=H1(Ei∥H1Ai∥Ci′′), Fi=H1(IDi′′∥SK∥RS∥SIDj), where N2 is a random number. {RS,Fi} is transmitted to Ui.Step 4.
After receiving{RS,Fi}, Ui computes Ei′=N1·RS, SK=H1(Ei′∥H1Ai∗∥Ci), Fi′=H1(IDi∗∥SK∥RS∥SIDj) and checks if Fi′=Fi. If the equation holds, Ui computes Qi=H1(SK∥RS) and sends {Qi} to Sj.Step 5.
After receiving{Qi}, Sj computes Qi′=H1(SK∥RS) and checks if Qi′=Qi. If the equation holds, Sj establishes a session key SK with Ui successfully.


### 4.5. Password Update Phase

U i changes his original password to a new one in the following steps. As described in Figure 4.Figure 4
Password update phase.Step 1.
U i attaches his smart card to a terminal, enters IDi∗ and PWi∗, and imprints bi∗. The smart card calculates Pi∗=H1(PWi∗∥H2(bi∗)∥ri), Vi∗=H1(Pi∗⨁H1IDi∗)modn and checks Vi∗≟Vi. If it holds, the smart card asks the user to input a new password.Step 2.
U i enters his new password PWinew. Then the smart card calculates Pi′=H1(PWinew∥H2(bi∗)∥ri), Bi′=Bi⨁Pi∗⨁Pi′, Vi′=H1(Pi′⨁H1IDi∗)modn. The smart card stores Bi′,Vi′ in the smart card and removes Bi,Vi.


## 4.1. Initial Phase

RC chooses an elliptic curve group Eq of orderpand a generator P of Eq.RC generates a random number x and computes Ppub=xP.RC publishes {Eq,P,Ppub,H1(),H2()} and keeps x as secret.


## 4.2. Server Registration Phase

The serverSj registers withRC in the following steps.Step 1.
S j picks its identity SIDj freely and delivers {SIDj} toRC through the reliable channel.Step 2.
Upon receiving{SIDj},RC calculates SMj=H1(SIDj∥x) and returns SMj to Sj via the reliable channel.Step 3.
S j keeps SMj as secret.


## 4.3. User Registration Phase

The userUi registers withRC in the following steps. As described in Figure 2.Figure 2
User registration phase of the proposed scheme.Step 1.
U i chooses his identity IDi and password PWi freely and imprints his biometric bi. Ui calculates Pi=H1(PWi∥H2bi∥ri), where ri is a random number. Afterwards, {IDi,Pi} is transmitted toRC through the reliable channel.Step 2.
Upon receiving{IDi,Pi},RC computes Ai=H1(x∥IDi), Bi=Ai⨁Pi, Vi=H1(Pi⨁H1IDi)modn, where 24≤n≤28.RC stores {Bi,Vi,EKey(),P,Ppub,n} in a smart card and transmits it to Ui via the reliable communication channel.Step 3.
U i stores ri in the smart card.


## 4.4. Login and Authentication Phase

The userUi and the server Sj authenticate each other and establish a session key by the aide ofRC in the following steps. As shown in Figure 3.Figure 3
Login and authentication phase of the proposed scheme.Step 1.
U i attaches the smart card to a terminal, enters IDi∗ and PWi∗, and imprints bi∗. Then the smart card calculates Pi∗=H1(PWi∗∥H2bi∗∥ri), Vi∗=H1Pi∗⨁H1IDi∗modn and checks if Vi∗=Vi. If this equation holds, the smart card computes Ai∗=Bi⊕Pi∗, Ri=N1P, Ci=H1(N1Ppub), Li=ECi(IDi∗∥Ai∗∥SIDj), where N1 is a random number. {Ri,Li} is transmitted toRCvia the public channel.Step 2.
After receiving{Ri,Li},RC computes Ci′=H1(xRi), IDi′∥Ai′∥SIDj′=DCi′(Li), Ai=H1(x∥IDi′) and checks if Ai=Ai′. If the equation holds,RC computes SMj=H1(SIDj′∥x), Yi=H1(SIDj′∥SMj), Mi=ESMj(IDi′∥Ri∥Yi∥H1Ai∥Ci′). {Mi} is transmitted to Sj.Step 3.
After receiving{Mi}, Sj computes (IDi′′∥Ri′∥Yi′∥H1Ai∥Ci′′)=DSMj(Mi), Yi′′=H1(SIDj∥SMj) and checks if Yi′′ is equal to Yi′. If it holds, Sj computes RS=N2P, Ei=N2·Ri, SK=H1(Ei∥H1Ai∥Ci′′), Fi=H1(IDi′′∥SK∥RS∥SIDj), where N2 is a random number. {RS,Fi} is transmitted to Ui.Step 4.
After receiving{RS,Fi}, Ui computes Ei′=N1·RS, SK=H1(Ei′∥H1Ai∗∥Ci), Fi′=H1(IDi∗∥SK∥RS∥SIDj) and checks if Fi′=Fi. If the equation holds, Ui computes Qi=H1(SK∥RS) and sends {Qi} to Sj.Step 5.
After receiving{Qi}, Sj computes Qi′=H1(SK∥RS) and checks if Qi′=Qi. If the equation holds, Sj establishes a session key SK with Ui successfully.


## 4.5. Password Update Phase

U i changes his original password to a new one in the following steps. As described in Figure 4.Figure 4
Password update phase.Step 1.
U i attaches his smart card to a terminal, enters IDi∗ and PWi∗, and imprints bi∗. The smart card calculates Pi∗=H1(PWi∗∥H2(bi∗)∥ri), Vi∗=H1(Pi∗⨁H1IDi∗)modn and checks Vi∗≟Vi. If it holds, the smart card asks the user to input a new password.Step 2.
U i enters his new password PWinew. Then the smart card calculates Pi′=H1(PWinew∥H2(bi∗)∥ri), Bi′=Bi⨁Pi∗⨁Pi′, Vi′=H1(Pi′⨁H1IDi∗)modn. The smart card stores Bi′,Vi′ in the smart card and removes Bi,Vi.


## 5. Security Proof

### 5.1. Formal Security Analysis

We describe the formal security model for three-factor multiserver authentication schemes proposed by Feng at al. [26] and prove the proposed scheme is provably secure in this model.


#### 5.1.1. Security Model

Participants. There are three types of principals in multiserver authentication scheme, that is, the user Ui, the server Sj, and the registration centerRC. Every kind of participant has many instances.We use Uia, Sja, and RCa denote them.Queries. The abilities of adversary are modeled by asking the following queries.Execute ( U i a , S j a , R C a ). The query simulates the eavesdropping attack. It returns the transcripts of the transmitted messages in public channel to the adversary.Send ( U i a / S j a / R C a ,  m ). It allows the adversary masquerades as a principal to send a message m. The oracle handles the message and gives a response to the adversary.Reveal ( U i a , S j a ) . This query discloses the session key of instance Uia or Sja to the adversary. However, if instance Uia or Sja does not establish a session key, it returns an invalid symbol ⊥.Corrupt ( U i a ,  z). This query reveals one or two authentication factors of user to the adversary. Note that the adversary cannot get all the three authentication factors at the same time, as he has no difference with a legitimate user.Whenz=1, it returns the password of Uia to the adversary.Whenz=2, it returns the data in Uia’s smart card.Whenz=3, it returns the biometric of Uia.Corrupt ( S j a , R C a ). This query simulates the forward secrecy attack; it answers the master keyx or the secret key SMj to the adversary.Test ( U i a , S j a ). The query is used to evaluate the semantic security of session key. The adversary is allowed to make the query no more than once. If the instance Uia or Sja is fresh (see below), the oracle flips a coin b. If b=1, it returns the session key to the adversary. If b=0, it returns a random string of the same size to the adversary.Freshness. The instanceUia or Sja is fresh, if the following conditions are satisfied.(1)
The instance is accepted and establishes a session key.(2)
The instance and its partner that belongs to the same session are never made a reveal query.(3)
The adversary never asks the Corrupt (Uia,z=1,2,3) query.(4)
The adversary never makes a Corrupt (Sja,RCa) query.Semantic Security. The adversary makes a series of aforementioned queries in polynomial time. Eventually, the adversary deduces the value of b involved in test query to be b′. We denote the advantage that the adversary breaches the semantic security of our scheme as (1)AdvPakeA=2Pr⁡b′=b-1Our protocol is secure, if for any adversary the advantage is negligible.


#### 5.1.2. Formal Security Proof

The formal security proof of the proposed scheme relies on the presumed hardness of the elliptic curve Diffie–Hellman problem defined below.The Elliptic Curve Diffie–Hellman Problem (ECDHP). Let Eq be an elliptic curve group of orderp. AndP is a generator of Eq. For given R1,R2∈Ep, where R1=N1P, R2=N2P, it is infeasible to compute N1N2P in polynomial time.Theorem 1.
We useP to denote the proposed scheme. There is an adversary A who tries to break the semantic security of our scheme. We assume that A is able to make at most qs Send-queries, qe Execute queries, qh Hash queries, qb Bio-hash queries, and qε Encryption/Decryption queries in polynomial timet. Then we have(2)AdvPakeA≤qh2+6qs2l1+qb2+2qs2l2+qε22l3+qs+qe2p+2qsY+2qhAdvPECDHP
wherel1 is the bit length of hash output. l2 is the bit length of Bio-hash output. l3 is the bit length of symmetric encryption output. The password dictionary space is Y.AdvPECDHP is the probability that the adversary solves the ECDHP in polynomial timet.The Proof. The advantage of breaking our scheme is deduced via a series of games from G0 to G7. Si denotes the event that the adversary correctly guesses the value of b involved in test query in game Gi. And Pr⁡[Si] is the probability of the event Si.G 0: it represents the real attack; obviously, we have(3)AdvPakeA=2Pr⁡S0-1By a further transformation, we have(4)2Pr⁡S0-1=2Pr⁡S0-Pr⁡S6+2Pr⁡S6-1=2Pr⁡S6-1+2∑i=05Pr⁡Si-Pr⁡Si+1G 1: in this game, the hash oracle, bio-hash oracle, and encryption/decryption oracle are simulated by maintaining a hash list ΛH, a bio-hash list ΛbH,and an encryption/ decryption list Λε. For a hash query H1α, if there is an item (α,β) in ΛH, the oracle returns β to the adversary. Otherwise, the oracle chooses a random number β, returns β to the adversary, and adds the item (α,β) to ΛH. The bio-hash oracle is simulated in the same way. For an encryption query Ekstr, if there is an item (k,str,γ) in Λε, the oracle returns γ to the adversary. Otherwise, the oracle chooses a value γ from cipher text space, returns γ to the adversary, and adds the item (k,str,γ) to Λε. For a decryption query Dkγ, if there is an item (k,str,γ) in Λε, the oracle returns str to the adversary. Otherwise, the oracle chooses a value str from plaintext space, returns str to the adversary, and adds the item (k,str,γ) to Λε. Besides, all oracles involved in security model are simulated in this game. Obviously, this game has no difference with G0. We have(5)Pr⁡S0-Pr⁡S1=0G 2: we avoid the occurrence of some collisions in this game. G2 is indistinguishable from G1,unless the following conditions occur.(1)
A collision happens in the output of hash function; the probability is less thanqh2/2l1+1.(2)
A collision happens in the output of bio-hash; the probability is no more thanqb2/2l2+1.(3)
A collision happens in the output of symmetric encryption; the probability is less thanqε2/2l3+1.(4)
A collision happens onRi or RS; the probability is no more than qs+qe2/2p.So we have(6)Pr⁡S1-Pr⁡S2≤qh22l1+1+qb22l2+1+qε22l3+1+qs+qe22pG 3: in this game, we avoid the situation that the adversary correctly guesses Fi or Qi without making the corresponding hash query. The probability is at most qs/2l1. Thus,(7)Pr⁡S2-Pr⁡S3≤qs2l1.G 4: this game averts the execution when the adversary correctly guesses the authentication value Ai directly. The probability is at most qs/2l1. We get(8)Pr⁡S3-Pr⁡S4≤qs2l1.G 5: in this game, we avoid the occurrence that the adversary has computed the authentication value Ai with the help of Corrupt (Uia,z). The following three cases are included.Case 1.
The adversary queries Corrupt (Uia,1) and Corrupt (Uia,2). To derive Ai, the adversary still needs to get the biometric. The probability that he correctly guesses the biometric is at most qs/2l2Case 2.
The adversary queries Corrupt (Uia,2) and Corrupt (Uia,3). The probability that he correctly guesses the password is less than qs/Y.Case 3.
The adversary queries Corrupt (Uia,1) and Corrupt (Uia,3). The probability that he correctly guesses the parameter Bi is no more than qs/2l1.The probability that the adversary getsAi is less than qs∗(1/Y+1/2l1+1/2l2). We have(9)Pr⁡S4-Pr⁡S5≤qs∗1Y+12l1+12l2G 6: in this game, we compute the session key SK using the private oracles H1′ instead of the hash oracle H1. As the private oracles H1′ is unknown to the adversary. We have(10)Pr⁡S6=12G 6 has no difference with G5, unless the adversary makes a hash query H1(Ei∥H1Ai∥Ci; we denote the event as Λ1. We have (11)Pr⁡S5-Pr⁡S6≤Pr⁡Λ1G 7: we simulate the random self-reducibility of ECDHP in this game. For Ri=N1P,RS=N2P, through selecting randomly in ΛH, we can obtain the item containing Ei=N1N2P with the probability 1/qh. Since the event Λ1 denotes that the adversary makes a hash query H1(Ei∥H1Ai∥Ci. We have(12)Pr⁡Λ1≤qhAdvPECDHPThrough the series of games above, we have(13)AdvPakeA≤qh2+6qs2l1+qb2+2qs2l2+qε22l3+qs+qe2p+2qsY+2qhAdvPECDHP


### 5.2. Security Proof Using BAN Logic

In this section, we use BAN logic [33] to prove that our scheme achieves mutual authentication and establishes a secure session key. Table 2 describes the symbols and rules of BAN logic.Table 2
The notations and rules of BAN logic.
P , Q A principal X , Y A statement K A key P ⊲ X P sees X, P receives a message containing X P | ∼ X P said X, P sent a message including X P | ≡ X P believes X is true P ⇔ Y Q P and Qshare a secret Y # ( X ) Xis fresh P ↔ K Q PandQ share a keyK { X } K X is encrypted under the key K < X > Y Xis combined with a secret Y P ⇒ X P has jurisdiction over X  Message meaning rule P | ≡ P ↔ K Q , P ⊲ { X } K P | ≡ Q | ∼ X or P|≡P⇔YQ,P⊲<X>YP|≡Q|∼X  Belief rule P | ≡ X , P | ≡ Y P | ≡ ( X , Y )  Nonce-verification rule P | ≡ # ( X ) , P | ≡ Q | ∼ X P | ≡ Q | ≡ X  Jurisdiction rule P|≡Q⇒X,P|≡Q|≡XP|≡XThe goals that our scheme should achieve are as follows.Goal 1:Ui|≡Sj|≡(Sj↔SKUi)Goal 2:Ui|≡(Sj↔SKUi)Goal 3:Sj|≡Ui|≡(Sj↔SKUi)Goal 4:Sj|≡(Sj↔SKUi)We idealized the proposed scheme as follows.M1:Ui→RC<N1P,Ui⇔CiRC>Ui⇔AiRCM2:RC→Sj{N1P,Ui⇔H1Ai∥CiSj}SMjM3:Sj→Ui<N1RS,RS,Ui↔SKSj>H1Ai∥CiM4:Sj→Ui<N2P,Ui↔SKSj>H1Ai∥CiThe initiative assumption of our scheme is given as follows.S1:RC|≡Ui⇔AiRCS2:RC≡#(N1)S3:RC≡Ui⇒(Ui⇔CiRC)S4:Sj|≡RC↔SMjSjS5:Sj|≡#(N1)S6:Sj|≡RC|⇒(Ui⇔H1Ai∥CiSj)S7:Ui|≡Ui⇔H1Ai∥CiSjS8:Ui|≡#(N1)S9:Ui|≡Sj⇒(Ui↔SKSj)S10:Sj|≡#(N2)S11:Sj|≡Ui⇒(Ui↔SKSj)The proof of our scheme is performed as follows.From M1, we have(1)
RC⊲<N1P,Ui⇔CiRC>Ui⇔AiRCAccording to S1, (1) and message meaning rule, we obtain(2)
RC|≡Ui|~<N1P,Ui⇔CiRC>According to S2, (2) and nonce-verification rule, we obtain(3)
RC|≡Ui|≡<N1P,Ui⇔CiRC>According to S3, (3) and jurisdiction rule, we obtain(4)
RC|≡Ui⇔CiRCFrom M2, we have(5)
Sj⊲{N1P,Ui⇔H1Ai∥CiSj}SMjAccording to S4, (5) and message meaning rule, we obtain(6)
Sj≡RC~{N1P,Ui⇔H1Ai∥CiSj}According to S5, (6) and nonce-verification rule, we obtain(7)
Sj|≡RC|≡{N1P,Ui⇔H1Ai∥CiSj}According to S6, (7) and jurisdiction rule, we obtain(8)
Sj|≡Ui⇔H1Ai∥CiSjFrom M3, we have(9)
Ui⊲<N1RS,RS,Ui↔SKSj>H1Ai∥CiAccording to S7, (9) and message meaning rule, we obtain(10)
Ui≡Sj~<N1RS,RS,Ui↔SKSj>According to S8, (10) and nonce-verification rule, we obtain(11)
Ui|≡Sj|≡Ui↔SKSj(Goal 1)According to S9, (11) and jurisdiction rule, we obtain(12)
Ui|≡Ui↔SKSj(Goal 2)From M4, we have(13)
Sj⊲<N2P,Ui↔SKSj>H1Ai∥CiAccording to (8), (13) and message meaning rule, we obtain(14)
Sj≡Ui~<N2P,Ui↔SKSj>According to S10, (14) and nonce-verification rule, we obtain(15)
Sj|≡Ui|≡Ui↔SKSj(Goal 3)According to S11, (15) and jurisdiction rule, we obtain(16)
Sj|≡Ui↔SKSj(Goal 4)


## 5.1. Formal Security Analysis

We describe the formal security model for three-factor multiserver authentication schemes proposed by Feng at al. [26] and prove the proposed scheme is provably secure in this model.


### 5.1.1. Security Model

Participants. There are three types of principals in multiserver authentication scheme, that is, the user Ui, the server Sj, and the registration centerRC. Every kind of participant has many instances.We use Uia, Sja, and RCa denote them.Queries. The abilities of adversary are modeled by asking the following queries.Execute ( U i a , S j a , R C a ). The query simulates the eavesdropping attack. It returns the transcripts of the transmitted messages in public channel to the adversary.Send ( U i a / S j a / R C a ,  m ). It allows the adversary masquerades as a principal to send a message m. The oracle handles the message and gives a response to the adversary.Reveal ( U i a , S j a ) . This query discloses the session key of instance Uia or Sja to the adversary. However, if instance Uia or Sja does not establish a session key, it returns an invalid symbol ⊥.Corrupt ( U i a ,  z). This query reveals one or two authentication factors of user to the adversary. Note that the adversary cannot get all the three authentication factors at the same time, as he has no difference with a legitimate user.Whenz=1, it returns the password of Uia to the adversary.Whenz=2, it returns the data in Uia’s smart card.Whenz=3, it returns the biometric of Uia.Corrupt ( S j a , R C a ). This query simulates the forward secrecy attack; it answers the master keyx or the secret key SMj to the adversary.Test ( U i a , S j a ). The query is used to evaluate the semantic security of session key. The adversary is allowed to make the query no more than once. If the instance Uia or Sja is fresh (see below), the oracle flips a coin b. If b=1, it returns the session key to the adversary. If b=0, it returns a random string of the same size to the adversary.Freshness. The instanceUia or Sja is fresh, if the following conditions are satisfied.(1)
The instance is accepted and establishes a session key.(2)
The instance and its partner that belongs to the same session are never made a reveal query.(3)
The adversary never asks the Corrupt (Uia,z=1,2,3) query.(4)
The adversary never makes a Corrupt (Sja,RCa) query.Semantic Security. The adversary makes a series of aforementioned queries in polynomial time. Eventually, the adversary deduces the value of b involved in test query to be b′. We denote the advantage that the adversary breaches the semantic security of our scheme as (1)AdvPakeA=2Pr⁡b′=b-1Our protocol is secure, if for any adversary the advantage is negligible.


### 5.1.2. Formal Security Proof

The formal security proof of the proposed scheme relies on the presumed hardness of the elliptic curve Diffie–Hellman problem defined below.The Elliptic Curve Diffie–Hellman Problem (ECDHP). Let Eq be an elliptic curve group of orderp. AndP is a generator of Eq. For given R1,R2∈Ep, where R1=N1P, R2=N2P, it is infeasible to compute N1N2P in polynomial time.Theorem 1.
We useP to denote the proposed scheme. There is an adversary A who tries to break the semantic security of our scheme. We assume that A is able to make at most qs Send-queries, qe Execute queries, qh Hash queries, qb Bio-hash queries, and qε Encryption/Decryption queries in polynomial timet. Then we have(2)AdvPakeA≤qh2+6qs2l1+qb2+2qs2l2+qε22l3+qs+qe2p+2qsY+2qhAdvPECDHP
wherel1 is the bit length of hash output. l2 is the bit length of Bio-hash output. l3 is the bit length of symmetric encryption output. The password dictionary space is Y.AdvPECDHP is the probability that the adversary solves the ECDHP in polynomial timet.The Proof. The advantage of breaking our scheme is deduced via a series of games from G0 to G7. Si denotes the event that the adversary correctly guesses the value of b involved in test query in game Gi. And Pr⁡[Si] is the probability of the event Si.G 0: it represents the real attack; obviously, we have(3)AdvPakeA=2Pr⁡S0-1By a further transformation, we have(4)2Pr⁡S0-1=2Pr⁡S0-Pr⁡S6+2Pr⁡S6-1=2Pr⁡S6-1+2∑i=05Pr⁡Si-Pr⁡Si+1G 1: in this game, the hash oracle, bio-hash oracle, and encryption/decryption oracle are simulated by maintaining a hash list ΛH, a bio-hash list ΛbH,and an encryption/ decryption list Λε. For a hash query H1α, if there is an item (α,β) in ΛH, the oracle returns β to the adversary. Otherwise, the oracle chooses a random number β, returns β to the adversary, and adds the item (α,β) to ΛH. The bio-hash oracle is simulated in the same way. For an encryption query Ekstr, if there is an item (k,str,γ) in Λε, the oracle returns γ to the adversary. Otherwise, the oracle chooses a value γ from cipher text space, returns γ to the adversary, and adds the item (k,str,γ) to Λε. For a decryption query Dkγ, if there is an item (k,str,γ) in Λε, the oracle returns str to the adversary. Otherwise, the oracle chooses a value str from plaintext space, returns str to the adversary, and adds the item (k,str,γ) to Λε. Besides, all oracles involved in security model are simulated in this game. Obviously, this game has no difference with G0. We have(5)Pr⁡S0-Pr⁡S1=0G 2: we avoid the occurrence of some collisions in this game. G2 is indistinguishable from G1,unless the following conditions occur.(1)
A collision happens in the output of hash function; the probability is less thanqh2/2l1+1.(2)
A collision happens in the output of bio-hash; the probability is no more thanqb2/2l2+1.(3)
A collision happens in the output of symmetric encryption; the probability is less thanqε2/2l3+1.(4)
A collision happens onRi or RS; the probability is no more than qs+qe2/2p.So we have(6)Pr⁡S1-Pr⁡S2≤qh22l1+1+qb22l2+1+qε22l3+1+qs+qe22pG 3: in this game, we avoid the situation that the adversary correctly guesses Fi or Qi without making the corresponding hash query. The probability is at most qs/2l1. Thus,(7)Pr⁡S2-Pr⁡S3≤qs2l1.G 4: this game averts the execution when the adversary correctly guesses the authentication value Ai directly. The probability is at most qs/2l1. We get(8)Pr⁡S3-Pr⁡S4≤qs2l1.G 5: in this game, we avoid the occurrence that the adversary has computed the authentication value Ai with the help of Corrupt (Uia,z). The following three cases are included.Case 1.
The adversary queries Corrupt (Uia,1) and Corrupt (Uia,2). To derive Ai, the adversary still needs to get the biometric. The probability that he correctly guesses the biometric is at most qs/2l2Case 2.
The adversary queries Corrupt (Uia,2) and Corrupt (Uia,3). The probability that he correctly guesses the password is less than qs/Y.Case 3.
The adversary queries Corrupt (Uia,1) and Corrupt (Uia,3). The probability that he correctly guesses the parameter Bi is no more than qs/2l1.The probability that the adversary getsAi is less than qs∗(1/Y+1/2l1+1/2l2). We have(9)Pr⁡S4-Pr⁡S5≤qs∗1Y+12l1+12l2G 6: in this game, we compute the session key SK using the private oracles H1′ instead of the hash oracle H1. As the private oracles H1′ is unknown to the adversary. We have(10)Pr⁡S6=12G 6 has no difference with G5, unless the adversary makes a hash query H1(Ei∥H1Ai∥Ci; we denote the event as Λ1. We have (11)Pr⁡S5-Pr⁡S6≤Pr⁡Λ1G 7: we simulate the random self-reducibility of ECDHP in this game. For Ri=N1P,RS=N2P, through selecting randomly in ΛH, we can obtain the item containing Ei=N1N2P with the probability 1/qh. Since the event Λ1 denotes that the adversary makes a hash query H1(Ei∥H1Ai∥Ci. We have(12)Pr⁡Λ1≤qhAdvPECDHPThrough the series of games above, we have(13)AdvPakeA≤qh2+6qs2l1+qb2+2qs2l2+qε22l3+qs+qe2p+2qsY+2qhAdvPECDHP


## 5.1.1. Security Model

Participants. There are three types of principals in multiserver authentication scheme, that is, the user Ui, the server Sj, and the registration centerRC. Every kind of participant has many instances.We use Uia, Sja, and RCa denote them.Queries. The abilities of adversary are modeled by asking the following queries.Execute ( U i a , S j a , R C a ). The query simulates the eavesdropping attack. It returns the transcripts of the transmitted messages in public channel to the adversary.Send ( U i a / S j a / R C a ,  m ). It allows the adversary masquerades as a principal to send a message m. The oracle handles the message and gives a response to the adversary.Reveal ( U i a , S j a ) . This query discloses the session key of instance Uia or Sja to the adversary. However, if instance Uia or Sja does not establish a session key, it returns an invalid symbol ⊥.Corrupt ( U i a ,  z). This query reveals one or two authentication factors of user to the adversary. Note that the adversary cannot get all the three authentication factors at the same time, as he has no difference with a legitimate user.Whenz=1, it returns the password of Uia to the adversary.Whenz=2, it returns the data in Uia’s smart card.Whenz=3, it returns the biometric of Uia.Corrupt ( S j a , R C a ). This query simulates the forward secrecy attack; it answers the master keyx or the secret key SMj to the adversary.Test ( U i a , S j a ). The query is used to evaluate the semantic security of session key. The adversary is allowed to make the query no more than once. If the instance Uia or Sja is fresh (see below), the oracle flips a coin b. If b=1, it returns the session key to the adversary. If b=0, it returns a random string of the same size to the adversary.Freshness. The instanceUia or Sja is fresh, if the following conditions are satisfied.(1)
The instance is accepted and establishes a session key.(2)
The instance and its partner that belongs to the same session are never made a reveal query.(3)
The adversary never asks the Corrupt (Uia,z=1,2,3) query.(4)
The adversary never makes a Corrupt (Sja,RCa) query.Semantic Security. The adversary makes a series of aforementioned queries in polynomial time. Eventually, the adversary deduces the value of b involved in test query to be b′. We denote the advantage that the adversary breaches the semantic security of our scheme as (1)AdvPakeA=2Pr⁡b′=b-1Our protocol is secure, if for any adversary the advantage is negligible.


## 5.1.2. Formal Security Proof

The formal security proof of the proposed scheme relies on the presumed hardness of the elliptic curve Diffie–Hellman problem defined below.The Elliptic Curve Diffie–Hellman Problem (ECDHP). Let Eq be an elliptic curve group of orderp. AndP is a generator of Eq. For given R1,R2∈Ep, where R1=N1P, R2=N2P, it is infeasible to compute N1N2P in polynomial time.Theorem 1.
We useP to denote the proposed scheme. There is an adversary A who tries to break the semantic security of our scheme. We assume that A is able to make at most qs Send-queries, qe Execute queries, qh Hash queries, qb Bio-hash queries, and qε Encryption/Decryption queries in polynomial timet. Then we have(2)AdvPakeA≤qh2+6qs2l1+qb2+2qs2l2+qε22l3+qs+qe2p+2qsY+2qhAdvPECDHP
wherel1 is the bit length of hash output. l2 is the bit length of Bio-hash output. l3 is the bit length of symmetric encryption output. The password dictionary space is Y.AdvPECDHP is the probability that the adversary solves the ECDHP in polynomial timet.The Proof. The advantage of breaking our scheme is deduced via a series of games from G0 to G7. Si denotes the event that the adversary correctly guesses the value of b involved in test query in game Gi. And Pr⁡[Si] is the probability of the event Si.G 0: it represents the real attack; obviously, we have(3)AdvPakeA=2Pr⁡S0-1By a further transformation, we have(4)2Pr⁡S0-1=2Pr⁡S0-Pr⁡S6+2Pr⁡S6-1=2Pr⁡S6-1+2∑i=05Pr⁡Si-Pr⁡Si+1G 1: in this game, the hash oracle, bio-hash oracle, and encryption/decryption oracle are simulated by maintaining a hash list ΛH, a bio-hash list ΛbH,and an encryption/ decryption list Λε. For a hash query H1α, if there is an item (α,β) in ΛH, the oracle returns β to the adversary. Otherwise, the oracle chooses a random number β, returns β to the adversary, and adds the item (α,β) to ΛH. The bio-hash oracle is simulated in the same way. For an encryption query Ekstr, if there is an item (k,str,γ) in Λε, the oracle returns γ to the adversary. Otherwise, the oracle chooses a value γ from cipher text space, returns γ to the adversary, and adds the item (k,str,γ) to Λε. For a decryption query Dkγ, if there is an item (k,str,γ) in Λε, the oracle returns str to the adversary. Otherwise, the oracle chooses a value str from plaintext space, returns str to the adversary, and adds the item (k,str,γ) to Λε. Besides, all oracles involved in security model are simulated in this game. Obviously, this game has no difference with G0. We have(5)Pr⁡S0-Pr⁡S1=0G 2: we avoid the occurrence of some collisions in this game. G2 is indistinguishable from G1,unless the following conditions occur.(1)
A collision happens in the output of hash function; the probability is less thanqh2/2l1+1.(2)
A collision happens in the output of bio-hash; the probability is no more thanqb2/2l2+1.(3)
A collision happens in the output of symmetric encryption; the probability is less thanqε2/2l3+1.(4)
A collision happens onRi or RS; the probability is no more than qs+qe2/2p.So we have(6)Pr⁡S1-Pr⁡S2≤qh22l1+1+qb22l2+1+qε22l3+1+qs+qe22pG 3: in this game, we avoid the situation that the adversary correctly guesses Fi or Qi without making the corresponding hash query. The probability is at most qs/2l1. Thus,(7)Pr⁡S2-Pr⁡S3≤qs2l1.G 4: this game averts the execution when the adversary correctly guesses the authentication value Ai directly. The probability is at most qs/2l1. We get(8)Pr⁡S3-Pr⁡S4≤qs2l1.G 5: in this game, we avoid the occurrence that the adversary has computed the authentication value Ai with the help of Corrupt (Uia,z). The following three cases are included.Case 1.
The adversary queries Corrupt (Uia,1) and Corrupt (Uia,2). To derive Ai, the adversary still needs to get the biometric. The probability that he correctly guesses the biometric is at most qs/2l2Case 2.
The adversary queries Corrupt (Uia,2) and Corrupt (Uia,3). The probability that he correctly guesses the password is less than qs/Y.Case 3.
The adversary queries Corrupt (Uia,1) and Corrupt (Uia,3). The probability that he correctly guesses the parameter Bi is no more than qs/2l1.The probability that the adversary getsAi is less than qs∗(1/Y+1/2l1+1/2l2). We have(9)Pr⁡S4-Pr⁡S5≤qs∗1Y+12l1+12l2G 6: in this game, we compute the session key SK using the private oracles H1′ instead of the hash oracle H1. As the private oracles H1′ is unknown to the adversary. We have(10)Pr⁡S6=12G 6 has no difference with G5, unless the adversary makes a hash query H1(Ei∥H1Ai∥Ci; we denote the event as Λ1. We have (11)Pr⁡S5-Pr⁡S6≤Pr⁡Λ1G 7: we simulate the random self-reducibility of ECDHP in this game. For Ri=N1P,RS=N2P, through selecting randomly in ΛH, we can obtain the item containing Ei=N1N2P with the probability 1/qh. Since the event Λ1 denotes that the adversary makes a hash query H1(Ei∥H1Ai∥Ci. We have(12)Pr⁡Λ1≤qhAdvPECDHPThrough the series of games above, we have(13)AdvPakeA≤qh2+6qs2l1+qb2+2qs2l2+qε22l3+qs+qe2p+2qsY+2qhAdvPECDHP


## 5.2. Security Proof Using BAN Logic

In this section, we use BAN logic [33] to prove that our scheme achieves mutual authentication and establishes a secure session key. Table 2 describes the symbols and rules of BAN logic.Table 2
The notations and rules of BAN logic.
P , Q A principal X , Y A statement K A key P ⊲ X P sees X, P receives a message containing X P | ∼ X P said X, P sent a message including X P | ≡ X P believes X is true P ⇔ Y Q P and Qshare a secret Y # ( X ) Xis fresh P ↔ K Q PandQ share a keyK { X } K X is encrypted under the key K < X > Y Xis combined with a secret Y P ⇒ X P has jurisdiction over X  Message meaning rule P | ≡ P ↔ K Q , P ⊲ { X } K P | ≡ Q | ∼ X or P|≡P⇔YQ,P⊲<X>YP|≡Q|∼X  Belief rule P | ≡ X , P | ≡ Y P | ≡ ( X , Y )  Nonce-verification rule P | ≡ # ( X ) , P | ≡ Q | ∼ X P | ≡ Q | ≡ X  Jurisdiction rule P|≡Q⇒X,P|≡Q|≡XP|≡XThe goals that our scheme should achieve are as follows.Goal 1:Ui|≡Sj|≡(Sj↔SKUi)Goal 2:Ui|≡(Sj↔SKUi)Goal 3:Sj|≡Ui|≡(Sj↔SKUi)Goal 4:Sj|≡(Sj↔SKUi)We idealized the proposed scheme as follows.M1:Ui→RC<N1P,Ui⇔CiRC>Ui⇔AiRCM2:RC→Sj{N1P,Ui⇔H1Ai∥CiSj}SMjM3:Sj→Ui<N1RS,RS,Ui↔SKSj>H1Ai∥CiM4:Sj→Ui<N2P,Ui↔SKSj>H1Ai∥CiThe initiative assumption of our scheme is given as follows.S1:RC|≡Ui⇔AiRCS2:RC≡#(N1)S3:RC≡Ui⇒(Ui⇔CiRC)S4:Sj|≡RC↔SMjSjS5:Sj|≡#(N1)S6:Sj|≡RC|⇒(Ui⇔H1Ai∥CiSj)S7:Ui|≡Ui⇔H1Ai∥CiSjS8:Ui|≡#(N1)S9:Ui|≡Sj⇒(Ui↔SKSj)S10:Sj|≡#(N2)S11:Sj|≡Ui⇒(Ui↔SKSj)The proof of our scheme is performed as follows.From M1, we have(1)
RC⊲<N1P,Ui⇔CiRC>Ui⇔AiRCAccording to S1, (1) and message meaning rule, we obtain(2)
RC|≡Ui|~<N1P,Ui⇔CiRC>According to S2, (2) and nonce-verification rule, we obtain(3)
RC|≡Ui|≡<N1P,Ui⇔CiRC>According to S3, (3) and jurisdiction rule, we obtain(4)
RC|≡Ui⇔CiRCFrom M2, we have(5)
Sj⊲{N1P,Ui⇔H1Ai∥CiSj}SMjAccording to S4, (5) and message meaning rule, we obtain(6)
Sj≡RC~{N1P,Ui⇔H1Ai∥CiSj}According to S5, (6) and nonce-verification rule, we obtain(7)
Sj|≡RC|≡{N1P,Ui⇔H1Ai∥CiSj}According to S6, (7) and jurisdiction rule, we obtain(8)
Sj|≡Ui⇔H1Ai∥CiSjFrom M3, we have(9)
Ui⊲<N1RS,RS,Ui↔SKSj>H1Ai∥CiAccording to S7, (9) and message meaning rule, we obtain(10)
Ui≡Sj~<N1RS,RS,Ui↔SKSj>According to S8, (10) and nonce-verification rule, we obtain(11)
Ui|≡Sj|≡Ui↔SKSj(Goal 1)According to S9, (11) and jurisdiction rule, we obtain(12)
Ui|≡Ui↔SKSj(Goal 2)From M4, we have(13)
Sj⊲<N2P,Ui↔SKSj>H1Ai∥CiAccording to (8), (13) and message meaning rule, we obtain(14)
Sj≡Ui~<N2P,Ui↔SKSj>According to S10, (14) and nonce-verification rule, we obtain(15)
Sj|≡Ui|≡Ui↔SKSj(Goal 3)According to S11, (15) and jurisdiction rule, we obtain(16)
Sj|≡Ui↔SKSj(Goal 4)


## 6. Informal Security Analysis

In this section, we demonstrate that our scheme achieves user anonymity, forward secrecy, and three-factor secrecy and is resistant to several known attacks.


### 6.1. User Anonymity

In our scheme, user’s identityIDi is protected with symmetric encryption. As the key Ci and SMj is unavailable. A cannot get any information about IDi from the transmitted messages in public channel. In addition, A cannot link two distinct messages to one user due to the existence of random number. Our scheme achieves user anonymity.


### 6.2. Forward Secrecy

Suppose thatA compromises the master key ofRC and intercepts {Ri,Li}, {RS,Fi} from public channel. Then A tries to compute the session key SK=H1(Ei∥H1Ai∥Ci). A can get Ci and Ai by computing Ci=H1(xRi), (IDi′∥Ai′∥SIDj′)=DCi(Li). To get Ei, A needs to derive Ei from Ri,RS. It means that A has to solve the elliptic curve Diffie–Hellman problem. It is absolutely impossible. Our scheme achieves forward secrecy.


### 6.3. Offline Password Guessing Attack

In the case thatA extracts {Bi,Vi,EKey(),P,Ppub,n,ri} from Ui’s smart card and obtains Ui’s biometric bi, A tries to acquire the password of Ui in the following steps.Step 1.
Choose an identityIDi∗ from identity dictionary space and a password PWi∗ from password dictionary space.Step 2.
ComputePi∗=H1PWi∗∥H2bi∗∥ri,Vi∗=H1(Pi∗⨁H1IDi∗)modn. Check Vi∗≟Vi.Step 3.
Repeat Steps 1 and 2, untilA finds a pair of <IDi∗,PWi∗> satisfying Vi∗=Vi.However, even ifA finds a pair of <IDi∗,PWi∗> satisfying Vi∗=Vi, he cannot determine whether they are the real identity and password of Ui. The proposed scheme employs the fuzzy validation of inputted authentication information. When n=28 and the identity and password both are 64 bits, there will be 264∗264/28 pairs of identity and password satisfying Vi∗=Vi. The probability that each candidate is equal to the pair of identity and password of Ui is 28/264∗264, this is negligible. In our scheme, it is unable to reveal the identity and password of user even if both the smart card and biometric are compromised.


### 6.4. User Impersonation Attack

Assume thatA tries to impersonate user and forge a login requested message {Ri,Li}. A computes Ria=N1aP, where N1a is a random number. To compute Li, A needs to know Ai. However, A cannot get any information about Ai from the transmitted messages in public channel, as Ai is protected with symmetric encryption and hash function. In the case that the smart card is compromised, A tries to retrieve Ai from Bi. As Ai=Bi⊕Pi, A needs to get Pi at first. To compute Pi, A requires ri,bi,PWi. That is to say, A cannot get Ai, unless he obtains all the three authentication factors at the same time. This is beyond the capacity of A. The proposed scheme is secure against user impersonate attack.


### 6.5. Server Impersonation Attack

Suppose thatA intercepts {Ri,Li} and {Mi} from public channel and tries to masquerade as the server Sj by sending a forged message {RS,Fi} to Ui. At first, A generates a random number N2a and computes RSa=N2aP, Ei=N2a∗Ri. Next, to compute SK=H1(Ei∥H1Ai∥Ci, A still needs Ai and Ci. As analyzed above, A cannot obtain Ai. To derive Ci, the adversary needs to compromise the master keyx or break the elliptic curve Diffie–Hellman problem. It is beyond the capacity of A. Our scheme is secure against server impersonation attack.


### 6.6. Replay Attack

In our scheme, we adopt random numbers instead of timestamp to guarantee the freshness of exchanged messages. It decreases the communication overhead and avoids clock synchronization problem. In the following four cases, we demonstrate that our scheme is resistant to replay attack.Case 1.
Suppose that the adversaryA intercepts {Ri,Li} from public channel and sends it toRC as a new login request.RC and Sj deal with this message and return {Mi} to A. Then A needs to generate a response message {Qi} and sends it to Sj. As N1,Ai are unavailable, the adversary is unable to return a valid {Qi} to Sj. The protocol finally aborts.Case 2.
In caseA replays {Mi} to Sj, as A is unable to return a valid {Qi} to Sj, the protocol finally aborts.Case 3.
IfA intercepts {Mi} from public channel and replays {RS,Fi} to Ui. The user deals with this message and finds that Fi′≠Fi. The protocol aborts.Case 4.
Assume thatA intercepts {RS,Fi} from public channel and replays {Qi} to Sj. The server deals with this message and finds that Qi′≠Qi. The protocol aborts.


### 6.7. Known Session-Specific Temporary Information Attack

Suppose that random numberN1 or N2 is compromised; the adversary computes Ei=N1∗RS or Ei=N2∗Ri. It still requires Ai and Ci to compute the session key SK. However, Ai,Ci are unavailable. It is unable to compromise the session key in our scheme.


### 6.8. Privileged Insider Attack

On one hand, the password and biometric ofUi are protected with hash function in registration phase. On the other hand, the user never reveals any authentication information (password, biometric, or the parameters of smart card) toRC or server in login and authentication phase. Hence, our scheme is resistant to privileged insider attack.


### 6.9. Three-Factor Secrecy

As analyzed above, in the absence of any one authentication factor,A cannot impersonate user successfully. In the following three cases, we demonstrate that if any two authentication factors of user are compromised, the adversary cannot breach the other one.Case 1.
Suppose thatUi’s smart card and biometric are compromised. As analyzed above, the adversary cannot reveal Ui’s password via offline password guessing attack.Case 2.
Suppose thatUi’s smart card and password are compromised. As the biometric bi is protected by means of hash function, A is unable to retrieve bi from Vi.Case 3.
Suppose thatUi’s biometric and password are compromised. The adversary tries to reveal the parameters {Bi,Vi,ri} stored in the smart card, where ri is a random number, Bi=Ai⨁Pi, Pi=H1(PWi∥H2bi∥ri), Vi=H1(Pi⨁H2IDi)modn. As ri,Ai are unavailable. The adversary is unable to reveal any data of smart card.


## 6.1. User Anonymity

In our scheme, user’s identityIDi is protected with symmetric encryption. As the key Ci and SMj is unavailable. A cannot get any information about IDi from the transmitted messages in public channel. In addition, A cannot link two distinct messages to one user due to the existence of random number. Our scheme achieves user anonymity.


## 6.2. Forward Secrecy

Suppose thatA compromises the master key ofRC and intercepts {Ri,Li}, {RS,Fi} from public channel. Then A tries to compute the session key SK=H1(Ei∥H1Ai∥Ci). A can get Ci and Ai by computing Ci=H1(xRi), (IDi′∥Ai′∥SIDj′)=DCi(Li). To get Ei, A needs to derive Ei from Ri,RS. It means that A has to solve the elliptic curve Diffie–Hellman problem. It is absolutely impossible. Our scheme achieves forward secrecy.


## 6.3. Offline Password Guessing Attack

In the case thatA extracts {Bi,Vi,EKey(),P,Ppub,n,ri} from Ui’s smart card and obtains Ui’s biometric bi, A tries to acquire the password of Ui in the following steps.Step 1.
Choose an identityIDi∗ from identity dictionary space and a password PWi∗ from password dictionary space.Step 2.
ComputePi∗=H1PWi∗∥H2bi∗∥ri,Vi∗=H1(Pi∗⨁H1IDi∗)modn. Check Vi∗≟Vi.Step 3.
Repeat Steps 1 and 2, untilA finds a pair of <IDi∗,PWi∗> satisfying Vi∗=Vi.However, even ifA finds a pair of <IDi∗,PWi∗> satisfying Vi∗=Vi, he cannot determine whether they are the real identity and password of Ui. The proposed scheme employs the fuzzy validation of inputted authentication information. When n=28 and the identity and password both are 64 bits, there will be 264∗264/28 pairs of identity and password satisfying Vi∗=Vi. The probability that each candidate is equal to the pair of identity and password of Ui is 28/264∗264, this is negligible. In our scheme, it is unable to reveal the identity and password of user even if both the smart card and biometric are compromised.


## 6.4. User Impersonation Attack

Assume thatA tries to impersonate user and forge a login requested message {Ri,Li}. A computes Ria=N1aP, where N1a is a random number. To compute Li, A needs to know Ai. However, A cannot get any information about Ai from the transmitted messages in public channel, as Ai is protected with symmetric encryption and hash function. In the case that the smart card is compromised, A tries to retrieve Ai from Bi. As Ai=Bi⊕Pi, A needs to get Pi at first. To compute Pi, A requires ri,bi,PWi. That is to say, A cannot get Ai, unless he obtains all the three authentication factors at the same time. This is beyond the capacity of A. The proposed scheme is secure against user impersonate attack.


## 6.5. Server Impersonation Attack

Suppose thatA intercepts {Ri,Li} and {Mi} from public channel and tries to masquerade as the server Sj by sending a forged message {RS,Fi} to Ui. At first, A generates a random number N2a and computes RSa=N2aP, Ei=N2a∗Ri. Next, to compute SK=H1(Ei∥H1Ai∥Ci, A still needs Ai and Ci. As analyzed above, A cannot obtain Ai. To derive Ci, the adversary needs to compromise the master keyx or break the elliptic curve Diffie–Hellman problem. It is beyond the capacity of A. Our scheme is secure against server impersonation attack.


## 6.6. Replay Attack

In our scheme, we adopt random numbers instead of timestamp to guarantee the freshness of exchanged messages. It decreases the communication overhead and avoids clock synchronization problem. In the following four cases, we demonstrate that our scheme is resistant to replay attack.Case 1.
Suppose that the adversaryA intercepts {Ri,Li} from public channel and sends it toRC as a new login request.RC and Sj deal with this message and return {Mi} to A. Then A needs to generate a response message {Qi} and sends it to Sj. As N1,Ai are unavailable, the adversary is unable to return a valid {Qi} to Sj. The protocol finally aborts.Case 2.
In caseA replays {Mi} to Sj, as A is unable to return a valid {Qi} to Sj, the protocol finally aborts.Case 3.
IfA intercepts {Mi} from public channel and replays {RS,Fi} to Ui. The user deals with this message and finds that Fi′≠Fi. The protocol aborts.Case 4.
Assume thatA intercepts {RS,Fi} from public channel and replays {Qi} to Sj. The server deals with this message and finds that Qi′≠Qi. The protocol aborts.


## 6.7. Known Session-Specific Temporary Information Attack

Suppose that random numberN1 or N2 is compromised; the adversary computes Ei=N1∗RS or Ei=N2∗Ri. It still requires Ai and Ci to compute the session key SK. However, Ai,Ci are unavailable. It is unable to compromise the session key in our scheme.


## 6.8. Privileged Insider Attack

On one hand, the password and biometric ofUi are protected with hash function in registration phase. On the other hand, the user never reveals any authentication information (password, biometric, or the parameters of smart card) toRC or server in login and authentication phase. Hence, our scheme is resistant to privileged insider attack.


## 6.9. Three-Factor Secrecy

As analyzed above, in the absence of any one authentication factor,A cannot impersonate user successfully. In the following three cases, we demonstrate that if any two authentication factors of user are compromised, the adversary cannot breach the other one.Case 1.
Suppose thatUi’s smart card and biometric are compromised. As analyzed above, the adversary cannot reveal Ui’s password via offline password guessing attack.Case 2.
Suppose thatUi’s smart card and password are compromised. As the biometric bi is protected by means of hash function, A is unable to retrieve bi from Vi.Case 3.
Suppose thatUi’s biometric and password are compromised. The adversary tries to reveal the parameters {Bi,Vi,ri} stored in the smart card, where ri is a random number, Bi=Ai⨁Pi, Pi=H1(PWi∥H2bi∥ri), Vi=H1(Pi⨁H2IDi)modn. As ri,Ai are unavailable. The adversary is unable to reveal any data of smart card.


## 7. Security and Performance Comparison

We compare our scheme with other biometric-based multiserver authentication schemes using ECC [22, 25–27]. The results of comparison indicate that our scheme satisfies all the security requirements, while it requires the minimum communication and computation overhead.Table3 shows the results of security analysis. It indicates that only our scheme is secure against various known attacks and provides desirable security properties such as forward secrecy, user anonymity, three-factor secrecy, and efficient wrong password and biometric detection. The other schemes [22, 25–27] suffer from more or less security vulnerabilities.Table 3
Results of security analysis of related schemes.
Security properties He [22] Kumari [25] Feng [26] Ali [27] Our scheme Resist offline password guessing attack √ √ √ √ √ User anonymity √ √ √ √ √ Resist denial of service attack √ √ √ × √ Resist user impersonation attack √ √ √ × √ Resist server impersonation attack √ × √ × √ Forward secrecy √ √ √ × √ Resist known session-specific temporary information attack × × × × √ Efficient wrong password and biometric detection × √ √ √ √ Resist privileged insider attack √ √ √ × √ Three-factor secrecy √ × × × √Table4 gives the computation costs of related schemes at login and authentication phase. More specifically, TH denotes computing a hash function. TE denotes one symmetric encryption. TD denotes one symmetric decryption. TP denotes one point multiplication on elliptic curve group. The computing overhead of lightweight operation “XOR” is negligible compared with other operations. Our scheme requires 3TP+1TE+7TH in user end, requires 1TP+1TD+1TE+5TH inRC, and requires 2TP+1TD+4TH in server end. And the total computation cost of our scheme is 6TP+2TD+2TE+16TH. The total computation costs of related schemes [22, 25–27] are 8TP+22TH, 8TP+16TH, 8TP+24TH, 7TP+2TD+2TE+12TH, respectively.Table 4
Computation cost of related schemes.
Schemes User RC Server Total cost He [22] 3 T P + 7 T H 2 T P + 10 T H 3 T P + 5 T H 8 T P + 22 T H Kumari [25] 3 T P + 5 T H 2 T P + 6 T H 3 T P + 5 T H 8 T P + 16 T H Feng [26] 3 T P + 7 T H 2 T P + 10 T H 3 T P + 7 T H 8 T P + 24 T H Ali [27] 3 T P + 5 T H 1 T P + 1 T D + 2 T E + 3 T H 3 T P + 1 T D + 4 T H 7 T P + 2 T D + 2 T E + 12 T H Our protocol 3 T P + 1 T E + 7 T H 1 T P + 1 T D + 1 T E + 5 T H 2 T P + 1 T D + 4 T H 6 T P + 2 T D + 2 T E + 16 T HTable5 summarizes the computing time of different cryptographic operations [34]. The hash function SHA-256 and SHA-512, the symmetric algorithm AES-128 and AES-256, the elliptic curve cryptosystem using P521, and Curve-25519, respectively, are employed to estimate the running time of related schemes. We compare our scheme with related schemes for two scenarios as shown in Figure 5. The Scenario 1 adopts the comparatively efficient algorithms, that is, SHA-256, AES-128 encryption/decryption, and elliptic curve cryptosystem using Curve25519. In this scenario, our scheme requires 432.57 ms; the related schemes [22, 25–27] require 576.286 ms, 576.208 ms, 576.312 ms, and 504.518 ms, respectively. Scenario 2 uses the comparatively time-consuming algorithms, that is, SHA-512, AES-256 encryption/decryption, and elliptic curve cryptosystem using P521. In this scenario, our scheme requires 6319.022 ms; the related schemes [22, 25–27] require 8424.704 ms, 8424.512 ms, 8424.768 ms, and 7371.894 ms, respectively. The computation overhead of our scheme is superior to other schemes in both scenarios.Table 5
Computing time of cryptographic operations.
Operations Computing time SHA-256 13μs SHA-512 32μs AES-128 Encryption 64μs AES-128 Decryption 117μs AES-256 Encryption 90μs AES-256 Decryption 165μs Curve25519 Point Multiplication 72 ms P521 Point Multiplication 1053 msFigure 5
Running time of related schemes.Figure6 illustrates the communication overheads of related schemes. To evaluate the communication overhead, we suppose that the identity of user, timestamp, random number are 64 bits; a point on Ep is 160 bits. When using the hash function SHA-256 and the symmetric algorithm AES-128, the communication overhead of our scheme is 2112 bits; the communication overheads of relevant schemes [22, 25–27] are 4224 bits, 3392 bits, 4224 bits, and 2624 bits, respectively. When adopting the hash function SHA-512 and the symmetric algorithm AES-256, the communication overhead of our scheme is 3392 bits; the communication overheads of relevant schemes [22, 25–27] are 7808 bits, 5696 bits, 7808 bits, and 3392 bits, respectively. Our scheme has the lowest communication overhead compared with other schemes.Figure 6
Communication overhead of related schemes.


## 8. Conclusions

In this paper, we prove that Ali et al.’s scheme is susceptible to various security threats, such as impersonation attack, denial of service attack, and known session-specific temporary information attack. Furthermore, we propose an efficient ECC-based three-factor authentication scheme for multiserver environment. BAN logic proof and the formal security analysis under random oracle model are used to prove the completeness and security of the proposed scheme. Besides, the informal analysis demonstrates that our scheme surmount the vulnerabilities in Ali et al.’s scheme and provides desirable attributes like forward secrecy and three-factor secrecy. In addition, the performance and security comparison shows that our scheme provides strong security, while it has minimal communication overhead and computation cost.



---

*Source: 2838615-2019-06-25.xml*