# A Secure Three-Factor Multiserver Authentication Protocol against the Honest-But-Curious Servers

Authors: Hua Guo; Chen Chen; Ya Gao; Xiong Li; Jiongchao Jin
Journal: Wireless Communications and Mobile Computing
 (2018)

---

## Abstract

Three-factor multiserver authentication protocols become a prevalence in recent years. Among these protocols, almost all of them do not involve the registration center into the authentication process. To improve the protocol’s efficiency, a common secret key is shared among all severs, which leads to a serious weakness; i.e., we find that these protocols cannot resist the passive attack from the honest-but-curious servers. This paper takes Wanget al.’s protocol as an example, to exhibit how an honest-but-curious server attacks their protocol. To remedy this weakness, a novel three-factor multiserver authentication protocol is presented. By introducing the registration center into the authentication process, the new protocol can resist the passive attack from the honest-but-curious servers. Security analyses including formal and informal analyses are given, demonstrating the correctness and validity of the new protocol. Compared with related protocols, the new protocol possesses more secure properties and more practical functionalities than others at a relatively low computation cost and communication cost.


---

## Body

## 1. Introduction

Nowadays, with the rapid development of networks, remote communication becomes increasingly prevalent and provides highly useful services in many aspects. Consequently, communication security significantly attracts public’s attention. Cryptographic authentication allows users to submit their credentials and acquire authorization to access the various online services from remote networks [1–5]. Since Lamport [6] firstly proposed a password-based remote authentication protocol, great quantities of authentication protocols were proposed to make up continued emerging problems and provide authorized communication between remote entities. However, the traditional protocols gradually cannot catch up with the pace of increasing demand for more users and servers in communication. Multiserver authentication schemes became the mainstream, because most of the practical communication environments are based on several servers to alleviate the pressure of the increasing number of users.Lots of authentication protocols for multiserver environments were proposed to satisfy the security requirements and provide versatile functionalities to make the scheme more convenient and practical to utilize in real occasions [7–20]. In 2001, Liet al. [7] proposed a remote multiserver authentication protocol with no verification table, which was found insecure by Linet al. [8]. They also presented an improved protocol, while it was vulnerable to impersonation attack [9]. Juanget al. [10] adopted symmetric-key cryptosystem to propose a multiserver authentication protocol but it was cracked soon. In 2004, a novel protocol was presented by Chang and Lee [11]. However, all of them ignored user anonymity [12]. In 2009, a remote multiserver authentication scheme which satisfies anonymity property was proposed [13], but it does not have forward security [14]. Besides, Hsiang and Shih [15] presented a new protocol to resist various attacks; however some drawbacks on mutual authentication are pointed out [16]. Recently, a big breakthrough, i.e., the inner relationships of evaluation criteria for anonymous two-factor authentication protocol, is explored by Wanget al. [17]. To improve the security of remote communication, smart card gradually came into use in authentication, which made it possible for more convenient authentication and communication. Some remote authentication protocols for multiserver environment with a smart card were proposed but proved to be insecure in the end [21–23].Relying on smart card and password as the authentication method already cannot meet today’s needs. In the latest few years, more and more authentication protocols adopt biometrics messages in mutual authentication to strengthen the security and enhance the efficiency of the existing protocols. In 2010, Yanget al. [24] introduced a three-factor multiserver authentication protocol. Unfortunately, the protocol has low computation efficiency and can not resist the insider attack. Liet al. proposed an efficient protocol [25] which allows users to change the password and the calculation cost is low. However, their scheme cannot provide appropriate certification and failed to resist man-in-the-middle attack [26]. Adopting elliptic curve cryptography, Yoonet al. [27] in 2011 designed a novel protocol; unfortunately Kimet al. [28] showed that Yoonet al. [27] protocol is insecure. In 2014, Chuanget al. [29] put forward an anonymous protocol, but Mishraet al. [30] broke their protocol. Later, Luet al. [31] found that there are several weaknesses in Mishraet al.'s improved protocol, and they also presented an improved protocol which is broken by Reddyet al. [32]. Meanwhile, Wanget al. [33] also found that Mishraet al.'s improved protocol is insecure. Regrettably, some weaknesses in Wanget al.’s protocol [33] were shown by Yanget al. [24] and Reddyet al. [34] separately. Recently, Jianget al. [35] and Heet al. put forward multiserver authenticated protocols using elliptic curve cryptography(ECC), separately. Unfortunately, Odeluet al. found that there are flaws in Heet al.s protocol in login and password change phases and can not resist the impersonation attack.All of the above three-factor multiserver authentication protocols can be categorized into two classes, i.e., the protocols which implement the authentication independent of the registration center and the protocols which need the help of the registration center in the authentication phase. After carefully examining the known three-factor multiserver authentication protocols, we find that almost all of the first kind of protocols cannot resist the passive attack from an honest-but-curious server since all servers share a common secret key. More precisely, an honest-but-curious server can compute session keys which are shared between a user and other servers by eavesdropping messages transmitting between the users and other servers. In this paper, we take Wanget al.’s protocol as an example, to show how an honest-but-curious server obtains a session key which should be kept secret from him. Moreover, we find some other drawbacks in their protocol. For example, in the reregister or revocation phase, a user can still use his original password to login and send message even if he is revoked.To resist the passive attack from the honest-but-curious servers, a trivial solution is to distribute different secret keys to different severs, which would aggravate the user’s storage burden. Another method is introducing the registration center into the authentication phase to deal with secret messages. As we mentioned above, such protocols are based on either ECC or symmetric encryption cryptosystems, which heavily affect the computation efficiency. To balance the security problem brought by the honest-but-curious servers and the efficiency problem brought by involving the registration center into the authentication, we propose a novel multiserver authentication protocol. In authentication phase of new protocol, the involved registration center only adopts hash and XOR operations for the computation, instead of ECC and symmetric cryptosystem, thus greatly improving the protocol’s computation efficiency. As far as we known, this is the first time to consider the passive attack from honest-but-curious servers for multiserver authentication protocols. Moreover, the new protocol is the first protocol which only adopts hash and XOR operations for computation when involving the registration center into the authentication.The remaining of the paper is organized as follows. Section2 reviews and analyzes the security of Wanget al.'s protocol. In Section 3, we present the new three-factor multiserver authentication scheme in detail. Section 4 provides the formal and informal secure analysis of the new protocol. In Section 5, comparisons including security, functionalities, computation cost, and communication cost are conducted. The last section gives a conclusion.


## 2. Some Weakness of Wanget al.’s Scheme

We firstly give the details about Wanget al.’s protocol and then show how an honest-but-curious server attacks their protocol step by step.


### 2.1. Review of Wanget al.’s Protocol

Wanget al.’s protocol involves five phases, i.e., registration phase, login phase, authentication phase, password changing phase, and revocation/reregistration phase which are executed by the user Ui, the server Sj, and the registration center RC. The symbols and notations are listed in Table 1. Assume RC is a trusted third party which is able to register for users and servers.Table 1
Symbols and notations in Wanget al.’s scheme.
U i theith user  Sj thejth server  RC registration centre  I D i U i’s identity  A I D i U i’s dynamic identity  S I D j S j’s identity  S C i U i’s smart card  P W i U i’s password  B I O i U i’s biometrics  Ri U i’s nearly random binary string  PSK pre-shared key between server and registration centre  x master secret key between user and registration centre  ⊕ exclusive OR  h()˙ one-way hash function  | | concatenating operationRegistration Phase (i)
Registration phase of server
(a)
S j sends a request message to RC. (b)
R C authorizes Sj once it receives the message and returns PSK (preshared key) to Sj securely. (c)
S j uses PSK to check Ui’s legitimacy in authentication phase. (ii)
Registration phase of user
(a)
The new userUi inserts SCi into the card reader, inputs IDi, PWi, and imprints Bi at the sensor. After that, (Ri,Pi) is extracted from BIOi through Gen(BIOi)←(Ri,Pi). Finally Ui calculates RPWi=h(PWi∥Ri) and sends {IDiRPWi} to RC securely. (b)
R C generates <IDi,Ni=1> and stores it to the database. Note that Ni indicates the state of Ui’s account. When Ui revokes his account, RC sets Ni=0. When Ui reregisters his account, RC sets Ni=Ni+1. After that RC calculates Ai=h(IDi∥x∥Tr), Bi=RPWi⊕h(Ai), Ci=Bi⊕h(PSK), Di=PSK⊕Ai⊕h(PSK), and Vi=h(IDi∥RPWi) where Tr is the time of registration. Finally, RC sends {Bi,Ci,Di,Vi} to Ui securely. (c)
U i receives {Bi,Ci,Di,Vi} from RC, stores {Bi,Ci,Di,Vi,Pi} into SCi, and stores Pi in SCi.Login Phase (i)
U i inputs IDi and PWi with his/her smart card SCi and imprints BIOi∗ at the sensor. (ii)
S C i calculates Ri=Rep(BIOi∗,Pi) and RPWi=h(PWi∥Ri). After that, SCi checks whether h(IDi∥RPWi)=Vi holds or not. If it is right, SCi computes h(PSK)=Bi⊕Ci. (iii)
S C i calculates AIDi=h(N1)⊕IDi after choosing a random number N1. After that, SCi computes M1=RPWi⊕h(PSK)⊕N1 and M2=h(AIDi∥N1∥RPWi∥SIDj∥Ti) where Ti is a timestamp. (iv)
S C i sends {Bi,Di,M1,M2,AIDi,Ti} to Sj.Authentication Phase (i)
S j checks whether Ti-Tj≤ΔT. Note that Tj is the time that Sj receives the login message, and ΔT means the time interval. (ii)
If the verification is valid,Sj calculates Ai=PSK⊕Di⊕h(PSK), RPWi=h(Ai)⊕Bi, and N1=M1⊕RPWi⊕h(PSK) and checks whether h(AIDi∥N1∥RPWi∥SIDj∥Ti)=M2. (iii)
If this verification is valid,Sj chooses a random number N2 and calculates SKij=h(AIDi∥SIDj∥N1∥N2) as the session secret key. Then, Sj computes M3=h(PSK)⊕h(AIDi∥N1)⊕N2 and M4=h(SIDj∥N2∥AIDi). Finally Sj returns {M3M4,SIDj} to Ui. (iv)
S C i calculates N2=h(PSK)⊕h(AIDi∥N1)⊕M3 and SKij=h(AIDi∥SIDj∥N1∥N2) and checks whether h(SIDj∥N2∥AIDi)=M4. If it is valid, SCi calculates M5=h(SKij∥N1∥N2) and sends M5 to Sj. (v)
S j checks whether the condition h(SKij∥N1∥N2) matches with M5. If holds, Sj confirms the session key SKij. Otherwise, Sj terminates the session immediately.Password Change Phase (i)
U i inserts his/her smart card, inputs IDi and PWi, and imprints BIOi∗. (ii)
S C i retires Ri from Rep(BIOi∗,Pi) and computes RPWi=h(PWi∥Ri). Then SCi checks whether h(IDi∥RPWi) matches with Vi. If it holds, Ui can input the new password. (iii)
U i inputs the new password PWin and SCi calculates RPWin=h(PWin∥Ri), Bin=Bi⊕RPWi⊕RPWin, Cin=Ci⊕RPWi⊕RPWin, and Vin=h(IDi∥RPWin). (iv)
S C i displaces Bi with Bin, Ci with Cin, and Vi with Vin, respectively.Revocation and Reregistration Phase (i)
IfUi is revoked, he needs to send verification message RPWi to RC securely. (ii)
R C checks the validity of Ui. If Ui is a valid user, RC sets <IDi,Ni=0>. (iii)
R C follows the user registration phase and uses <IDi,Ni=Ni+1> to replace <IDi,Ni>.


### 2.2. Analysis of Wanget al.’s Protocol

This subsection analyzes Wanget al.’s protocol and shows how to mount a passive attack by an honest-but-curious server.


#### 2.2.1. Passive Attack from an Honest-But-Curious Server

In this attack, an honest-but-curious server (saySj) only passively eavesdrops messages between the user Ui and other servers, so that he can obtain the session keys shared by the user Ui and other servers which should be kept secret from Sj using his secret key and eavesdropping messages. More precisely, suppose a user Ui has finished the protocol with a server S1 and is running the protocol with the other server S2. Now we will show how the server S1 obtains the session key between Ui and S2 step by step.(i)
Step 1.S1 finished the protocol with Ui successfully. Thus the server has knowledge of PSK.(ii)
Step 2. During the protocol process between Ui and S2, S1 firstly intercepts {Bi,Di,M1,M2,AIDi,Ti} sent by Ui to S2. From these messages, S1 obtains N1 by calculating Ai=Di⊕PSK⊕h(PSK), RPWi=Bi⊕h(Ai), and N1=RPWi⊕M1⊕h(PSK).(iii)
Step 3. After that, S1 intercepts the messages {SIDj,M3M4} which are sent from S2 to Ui. Then the server S1 obtains N2 by calculating N2=M3⊕h(AIDi∥N1)⊕h(PSK). In this case, the server S1 acquired N1 and N2 generated in this session.(iv)
Step 4. With the intercepted AIDi and SIDj, S1 can obtain the session key SKij by calculating SKij=h(AIDi∥SIDj∥N1∥N2) successfully which should be kept secret from him.


#### 2.2.2. User’s Anonymity

User’s anonymity means that user’sIDi and other urgent information indicating user’s identity directly should be protected carefully. In Wanget al.’s scheme, an honest-but-curious server Sj can compute N1 by N1=RPWi⊕M1⊕h(PSK). At the same time, Sj receives AIDi from Ui. Sj can obtain Ui’s identity IDi by computing IDi=AIDi⊕h(N1). As a consequence, the server can obtain IDi of the user Ui. This does not guarantee the anonymity of the user’s identity.


#### 2.2.3. User Impersonation Attack

The honest-but-curious serverSj can collect Bi and Di which are sent by Ui and thus can calculate RPWi using PSK. After that, Sj can pretend to be Ui and apply authentication from other servers. Specifically, Sj randomly choose a number N1 and calculates AIDi=h(N1)⊕IDi, M1=RPWi⊕N1⊕h(PSK), and M2=h(AIDi∥N1∥RPWi∥SIDj∥Ti). Then Sj sends {Bi,Di,M1,M2,AIDi,Ti} to other servers through a public channel. In this way, Sj can disguise as Ui.


#### 2.2.4. Wrong Revocation and Reregistration

In this phase, users are allowed to revoke or reregister when he confronts the situation about losing the smart card or his account. In Wanget al.’s scheme, when a user wants to revoke his account, he has to pass the authentication. After that, RC changes Ni to 0, indicating that IDi is not available any more. In the reregistration phase, RC also changes Ni to Ni+1. However, RC is not involved in login phase and authentication phase. As a result, there is no access for RC to check whether the user’s account is revoked or not. Thus the user can access the legal servers only using his former password and his biometrics; even he already has been revoked.


### 2.3. Reasons for the Weakness

In Wanget al.’s protocol, two important temporary secret values N1 and N2 are protected by PSK. Unfortunately, all servers keep the same private key PSK. As a result, an honest-but-curious server Sj with PSK can obtain all session keys which should be kept secret from him. This attack usually exists in the multiserver environment. In the most cases, a legitimate server after registration is assumed to be completely trustworthy, without taking into account the possibility that a particular server can act as an honest-but-curious adversary.To resist this attack, it is bound to distribute different secret keys to different servers, which can be implemented by involving the registration center in the authentication process. Unfortunately, in most of this kind of protocol, authentication process is excused between the user and the server independent of the registration center. Therefore, to design a secure three-factor authentication protocol against the passive attack from an honest-but-curious server, the registration center should be introduced into the authentication process to protect the important temporary secret valuesN1 and N2.


## 2.1. Review of Wanget al.’s Protocol

Wanget al.’s protocol involves five phases, i.e., registration phase, login phase, authentication phase, password changing phase, and revocation/reregistration phase which are executed by the user Ui, the server Sj, and the registration center RC. The symbols and notations are listed in Table 1. Assume RC is a trusted third party which is able to register for users and servers.Table 1
Symbols and notations in Wanget al.’s scheme.
U i theith user  Sj thejth server  RC registration centre  I D i U i’s identity  A I D i U i’s dynamic identity  S I D j S j’s identity  S C i U i’s smart card  P W i U i’s password  B I O i U i’s biometrics  Ri U i’s nearly random binary string  PSK pre-shared key between server and registration centre  x master secret key between user and registration centre  ⊕ exclusive OR  h()˙ one-way hash function  | | concatenating operationRegistration Phase (i)
Registration phase of server
(a)
S j sends a request message to RC. (b)
R C authorizes Sj once it receives the message and returns PSK (preshared key) to Sj securely. (c)
S j uses PSK to check Ui’s legitimacy in authentication phase. (ii)
Registration phase of user
(a)
The new userUi inserts SCi into the card reader, inputs IDi, PWi, and imprints Bi at the sensor. After that, (Ri,Pi) is extracted from BIOi through Gen(BIOi)←(Ri,Pi). Finally Ui calculates RPWi=h(PWi∥Ri) and sends {IDiRPWi} to RC securely. (b)
R C generates <IDi,Ni=1> and stores it to the database. Note that Ni indicates the state of Ui’s account. When Ui revokes his account, RC sets Ni=0. When Ui reregisters his account, RC sets Ni=Ni+1. After that RC calculates Ai=h(IDi∥x∥Tr), Bi=RPWi⊕h(Ai), Ci=Bi⊕h(PSK), Di=PSK⊕Ai⊕h(PSK), and Vi=h(IDi∥RPWi) where Tr is the time of registration. Finally, RC sends {Bi,Ci,Di,Vi} to Ui securely. (c)
U i receives {Bi,Ci,Di,Vi} from RC, stores {Bi,Ci,Di,Vi,Pi} into SCi, and stores Pi in SCi.Login Phase (i)
U i inputs IDi and PWi with his/her smart card SCi and imprints BIOi∗ at the sensor. (ii)
S C i calculates Ri=Rep(BIOi∗,Pi) and RPWi=h(PWi∥Ri). After that, SCi checks whether h(IDi∥RPWi)=Vi holds or not. If it is right, SCi computes h(PSK)=Bi⊕Ci. (iii)
S C i calculates AIDi=h(N1)⊕IDi after choosing a random number N1. After that, SCi computes M1=RPWi⊕h(PSK)⊕N1 and M2=h(AIDi∥N1∥RPWi∥SIDj∥Ti) where Ti is a timestamp. (iv)
S C i sends {Bi,Di,M1,M2,AIDi,Ti} to Sj.Authentication Phase (i)
S j checks whether Ti-Tj≤ΔT. Note that Tj is the time that Sj receives the login message, and ΔT means the time interval. (ii)
If the verification is valid,Sj calculates Ai=PSK⊕Di⊕h(PSK), RPWi=h(Ai)⊕Bi, and N1=M1⊕RPWi⊕h(PSK) and checks whether h(AIDi∥N1∥RPWi∥SIDj∥Ti)=M2. (iii)
If this verification is valid,Sj chooses a random number N2 and calculates SKij=h(AIDi∥SIDj∥N1∥N2) as the session secret key. Then, Sj computes M3=h(PSK)⊕h(AIDi∥N1)⊕N2 and M4=h(SIDj∥N2∥AIDi). Finally Sj returns {M3M4,SIDj} to Ui. (iv)
S C i calculates N2=h(PSK)⊕h(AIDi∥N1)⊕M3 and SKij=h(AIDi∥SIDj∥N1∥N2) and checks whether h(SIDj∥N2∥AIDi)=M4. If it is valid, SCi calculates M5=h(SKij∥N1∥N2) and sends M5 to Sj. (v)
S j checks whether the condition h(SKij∥N1∥N2) matches with M5. If holds, Sj confirms the session key SKij. Otherwise, Sj terminates the session immediately.Password Change Phase (i)
U i inserts his/her smart card, inputs IDi and PWi, and imprints BIOi∗. (ii)
S C i retires Ri from Rep(BIOi∗,Pi) and computes RPWi=h(PWi∥Ri). Then SCi checks whether h(IDi∥RPWi) matches with Vi. If it holds, Ui can input the new password. (iii)
U i inputs the new password PWin and SCi calculates RPWin=h(PWin∥Ri), Bin=Bi⊕RPWi⊕RPWin, Cin=Ci⊕RPWi⊕RPWin, and Vin=h(IDi∥RPWin). (iv)
S C i displaces Bi with Bin, Ci with Cin, and Vi with Vin, respectively.Revocation and Reregistration Phase (i)
IfUi is revoked, he needs to send verification message RPWi to RC securely. (ii)
R C checks the validity of Ui. If Ui is a valid user, RC sets <IDi,Ni=0>. (iii)
R C follows the user registration phase and uses <IDi,Ni=Ni+1> to replace <IDi,Ni>.


## 2.2. Analysis of Wanget al.’s Protocol

This subsection analyzes Wanget al.’s protocol and shows how to mount a passive attack by an honest-but-curious server.


### 2.2.1. Passive Attack from an Honest-But-Curious Server

In this attack, an honest-but-curious server (saySj) only passively eavesdrops messages between the user Ui and other servers, so that he can obtain the session keys shared by the user Ui and other servers which should be kept secret from Sj using his secret key and eavesdropping messages. More precisely, suppose a user Ui has finished the protocol with a server S1 and is running the protocol with the other server S2. Now we will show how the server S1 obtains the session key between Ui and S2 step by step.(i)
Step 1.S1 finished the protocol with Ui successfully. Thus the server has knowledge of PSK.(ii)
Step 2. During the protocol process between Ui and S2, S1 firstly intercepts {Bi,Di,M1,M2,AIDi,Ti} sent by Ui to S2. From these messages, S1 obtains N1 by calculating Ai=Di⊕PSK⊕h(PSK), RPWi=Bi⊕h(Ai), and N1=RPWi⊕M1⊕h(PSK).(iii)
Step 3. After that, S1 intercepts the messages {SIDj,M3M4} which are sent from S2 to Ui. Then the server S1 obtains N2 by calculating N2=M3⊕h(AIDi∥N1)⊕h(PSK). In this case, the server S1 acquired N1 and N2 generated in this session.(iv)
Step 4. With the intercepted AIDi and SIDj, S1 can obtain the session key SKij by calculating SKij=h(AIDi∥SIDj∥N1∥N2) successfully which should be kept secret from him.


### 2.2.2. User’s Anonymity

User’s anonymity means that user’sIDi and other urgent information indicating user’s identity directly should be protected carefully. In Wanget al.’s scheme, an honest-but-curious server Sj can compute N1 by N1=RPWi⊕M1⊕h(PSK). At the same time, Sj receives AIDi from Ui. Sj can obtain Ui’s identity IDi by computing IDi=AIDi⊕h(N1). As a consequence, the server can obtain IDi of the user Ui. This does not guarantee the anonymity of the user’s identity.


### 2.2.3. User Impersonation Attack

The honest-but-curious serverSj can collect Bi and Di which are sent by Ui and thus can calculate RPWi using PSK. After that, Sj can pretend to be Ui and apply authentication from other servers. Specifically, Sj randomly choose a number N1 and calculates AIDi=h(N1)⊕IDi, M1=RPWi⊕N1⊕h(PSK), and M2=h(AIDi∥N1∥RPWi∥SIDj∥Ti). Then Sj sends {Bi,Di,M1,M2,AIDi,Ti} to other servers through a public channel. In this way, Sj can disguise as Ui.


### 2.2.4. Wrong Revocation and Reregistration

In this phase, users are allowed to revoke or reregister when he confronts the situation about losing the smart card or his account. In Wanget al.’s scheme, when a user wants to revoke his account, he has to pass the authentication. After that, RC changes Ni to 0, indicating that IDi is not available any more. In the reregistration phase, RC also changes Ni to Ni+1. However, RC is not involved in login phase and authentication phase. As a result, there is no access for RC to check whether the user’s account is revoked or not. Thus the user can access the legal servers only using his former password and his biometrics; even he already has been revoked.


## 2.2.1. Passive Attack from an Honest-But-Curious Server

In this attack, an honest-but-curious server (saySj) only passively eavesdrops messages between the user Ui and other servers, so that he can obtain the session keys shared by the user Ui and other servers which should be kept secret from Sj using his secret key and eavesdropping messages. More precisely, suppose a user Ui has finished the protocol with a server S1 and is running the protocol with the other server S2. Now we will show how the server S1 obtains the session key between Ui and S2 step by step.(i)
Step 1.S1 finished the protocol with Ui successfully. Thus the server has knowledge of PSK.(ii)
Step 2. During the protocol process between Ui and S2, S1 firstly intercepts {Bi,Di,M1,M2,AIDi,Ti} sent by Ui to S2. From these messages, S1 obtains N1 by calculating Ai=Di⊕PSK⊕h(PSK), RPWi=Bi⊕h(Ai), and N1=RPWi⊕M1⊕h(PSK).(iii)
Step 3. After that, S1 intercepts the messages {SIDj,M3M4} which are sent from S2 to Ui. Then the server S1 obtains N2 by calculating N2=M3⊕h(AIDi∥N1)⊕h(PSK). In this case, the server S1 acquired N1 and N2 generated in this session.(iv)
Step 4. With the intercepted AIDi and SIDj, S1 can obtain the session key SKij by calculating SKij=h(AIDi∥SIDj∥N1∥N2) successfully which should be kept secret from him.


## 2.2.2. User’s Anonymity

User’s anonymity means that user’sIDi and other urgent information indicating user’s identity directly should be protected carefully. In Wanget al.’s scheme, an honest-but-curious server Sj can compute N1 by N1=RPWi⊕M1⊕h(PSK). At the same time, Sj receives AIDi from Ui. Sj can obtain Ui’s identity IDi by computing IDi=AIDi⊕h(N1). As a consequence, the server can obtain IDi of the user Ui. This does not guarantee the anonymity of the user’s identity.


## 2.2.3. User Impersonation Attack

The honest-but-curious serverSj can collect Bi and Di which are sent by Ui and thus can calculate RPWi using PSK. After that, Sj can pretend to be Ui and apply authentication from other servers. Specifically, Sj randomly choose a number N1 and calculates AIDi=h(N1)⊕IDi, M1=RPWi⊕N1⊕h(PSK), and M2=h(AIDi∥N1∥RPWi∥SIDj∥Ti). Then Sj sends {Bi,Di,M1,M2,AIDi,Ti} to other servers through a public channel. In this way, Sj can disguise as Ui.


## 2.2.4. Wrong Revocation and Reregistration

In this phase, users are allowed to revoke or reregister when he confronts the situation about losing the smart card or his account. In Wanget al.’s scheme, when a user wants to revoke his account, he has to pass the authentication. After that, RC changes Ni to 0, indicating that IDi is not available any more. In the reregistration phase, RC also changes Ni to Ni+1. However, RC is not involved in login phase and authentication phase. As a result, there is no access for RC to check whether the user’s account is revoked or not. Thus the user can access the legal servers only using his former password and his biometrics; even he already has been revoked.


## 2.3. Reasons for the Weakness

In Wanget al.’s protocol, two important temporary secret values N1 and N2 are protected by PSK. Unfortunately, all servers keep the same private key PSK. As a result, an honest-but-curious server Sj with PSK can obtain all session keys which should be kept secret from him. This attack usually exists in the multiserver environment. In the most cases, a legitimate server after registration is assumed to be completely trustworthy, without taking into account the possibility that a particular server can act as an honest-but-curious adversary.To resist this attack, it is bound to distribute different secret keys to different servers, which can be implemented by involving the registration center in the authentication process. Unfortunately, in most of this kind of protocol, authentication process is excused between the user and the server independent of the registration center. Therefore, to design a secure three-factor authentication protocol against the passive attack from an honest-but-curious server, the registration center should be introduced into the authentication process to protect the important temporary secret valuesN1 and N2.


## 3. The New Protocol

In this section, we first discuss the threat model used in our protocol. We then give the list of notations used in our proposed scheme. Finally, we describe the different phases relate to our scheme.


### 3.1. Threat Model

In this subsection, we introduce a threat model following the definition of [36–39].(i)
The adversaryA is able to control the open communication channel completely; that is, he can intercept, modify, delete, block, and resend the messages over the open channel.(ii)
The adversaryA can list all pairs of IDi from the space of identities and PWi from the space of passwords in a polynomial time.(iii)
The adversaryA can either intercept the password of the user via the malicious device or extract the parameters from the smart card, but both methods cannot be used together. An honest-but-curious server does not have this ability.(iv)
WhenA acts as an honest-but-curious server, he can just listen the messages via the open channel.


### 3.2. The Proposed Protocol

As Wanget al.’s protocol, the new protocol also involves five phases. Table 2 lists the notations used in the new protocol.Table 2
Notations in the new protocol.
Ui,Sj ith user and jth server  RC the registration centre  IDi,AIDi,SIDj U i’s identity, dynamic identity and Sj’s identity  SCi,PWi,BIOi U i’s smart card, password and biometrics  Ri,Pi valid biometric characteristic extracted fromBIOi  PSK master secret key between server and registration centre  X master secret key between user and registration centre  h()˙,⊕,|| hash function, XOR operation and concatenating operation  xi pre-shared key betweenUi and registration centre  yj pre-shared key betweenSj and registration centre


#### 3.2.1. Registration Phase

(i)
Server registration phase During server registration,Sj communicates with RC to authenticate his validity and become a legislative server after receiving the preshared key sent from RC. The whole process of the server registration phase is shown in Figure 1.
(a)
S j sends a request message to RC. (b)
R C authorizes Sj and adds a novel entry <SIDj,yj> to the database where yj is a random number. Then h(PSK),yj is sent to Sj by applying IKEv2 securely. (c)
S j adopts PSK,yj to protect the urgent messages and generates the session key SKij. (ii)
User registration phase A user sends his personal information toRC and gets his own smart card by executing the process listed in Figure 2.
(a)
U i inputs BIOi at the sensor and can obtain {Ri,Pi} using Gen(BIOi)→(Ri,Pi). Then Ui selects IDi and PWi and calculates RPWi=h(PWi∥Ri). Ui finally sends {IDiRPWi} to RC securely. (b)
R C generates a novel entry <IDi,xi> to the database where xi is a random number that records the validity of Ui. If Ui has revoked its account or the account is not available at present, RC generates a negative random number xi; otherwise, xi is a positive random number. At the same time, xi is a preshared key. After that, RC computes Ai=h(IDi∥X∥Tr), Bi=RPWi⊕h(Ai), Ci=Bi⊕h(PSK), Di=PSK⊕Ai⊕h(PSK), Vi=h(IDi∥RPWi), Ei=RPWi⊕xi, and Fi=RPWi⊕h(X), where Tr is the registration time and X is the masker secret key between the user and the registration center. (c)
R C puts {Bi,Ci,Di,Vi,Ei,Fi} into SCi. After that, RC issues it to Ui securely. (d)
WithSCi, Ui keeps Pi into SCi and initials the authentication.Figure 1
Registration phase of server.Figure 2
Registration phase of user.


#### 3.2.2. Login Phase

A userUi tries to login to a server Sj by executing the steps shown in Figure 3.(i)
Ui inputs IDi, PWi, and BIOi∗, then his smart card can recover Ri∗ using Rep(BIOi∗,Pi)→Ri∗.(ii)
SCi computes RPWi∗=h(PWi∥Ri∗) and then checks whether h(IDi∥RPWi∗)=Vi or not. If it is true, SCi calculates h(PSK)=Bi⊕Ci, xi=RPWi⊕Ei, and h(X)=RPWi⊕Fi. Otherwise, Ui does not pass the identity authentication.(iii)
SCi generates a number N1 randomly for each session and calculates h(Ai)=RPWi⊕Bi, AIDi=IDi⊕h(X)⊕h(Ai), M1=RPWi⊕N1⊕h(PSK)⊕xi, and M2=h(AIDi∥RPWi∥SIDj∥Ti) where Ti is a timestamp.(iv)
SCi sends {AIDi,M1,M2,Bi,Di,Ti} to Sj.Figure 3
Login and authentication phase.


#### 3.2.3. Authentication Phase

This phase offers the details of mutually authentication which are indicated in Figure3.(i)
Sj receives the information from Ui and verifies whether Ti-Tj′≤ΔT holds or not. If it holds, Sj calculates Ai=PSK⊕Di⊕h(PSK) and RPWi=Bi⊕h(Ai). Otherwise, Sj will reject the login request. Then Sj checks whether M2=h(AIDi∥RPWi∥SIDj∥Ti). If it fails, the protocol would be stopped. Otherwise, the server computes AIDi′=AIDi⊕h(Ai), M3=M1⊕RPWi⊕yi, and M4=h(AIDi′∥SIDj∥yj∥Tj) and sends messages {AIDi′,SIDj,M3,M4,Tj} to RC.(ii)
RC receives the messages and verifies whether Tj-Trc≤ΔT holds or not. If it holds, RC checks whether M4=h(AIDi′∥SIDj∥yj∥Tj). If it fails, the request would be stopped. Otherwise, RC computes IDi=AIDi′⊕h(X). Then RC goes through the database <IDi,xi>,<SIDj,yj> stored in RC to get xi and yi. If xi is a negative number, the request would be stopped. After that, RC computes N1=M3⊕h(PSK)⊕xi⊕yj, M5=N1⊕yj⊕PSK, and M6=h(M5)⊕Tc where Tc is an additional timestamp. Finally, RC returns {M5,M6,Tc} to Sj.(iii)
OnceSj receives the message from RC, it verifies whether Tc-Tj∗≤ΔT holds or not. If it holds, Sj checks whether M6=h(M5)⊕Tc. If it fails, the request will be stopped. Otherwise, Sj calculates N1=M5⊕yj⊕PSK. After selecting a number N2 randomly, Sj computes SKij=h(AIDi∥SIDj∥N1∥N2), M7=N2⊕h(AIDi∥N1)⊕h(PSK), and M8=h(SIDj∥N2∥AIDi). Then, the server sends {SIDj,M7,M8} to Ui.(iv)
Ui retrieves N2 and calculates SKij by computing N2=M7⊕h(AIDi∥N1)⊕h(PSK) and SKij=h(AIDi∥SIDj∥N1∥N2). After that, Ui checks whether M8=h(SIDj∥N2∥AIDi) holds or not. If it is valid, the user calculates M9=h(SKij∥N1∥N2) and sends M9 to Sj.(v)
Finally,Sj receives M9 and checks whether the equation h(SKij∥N1∥N2)=M9 holds or not. If so, a secret session key is generated successfully and can be used in the following communication. Otherwise, Sj would reject the authentication.


#### 3.2.4. Password Change Phase

Using this phase,Ui’s password can be changed without any exchanging message from both RC and Sj.(i)
Ui inputs IDi, the old password PWi, and imprints BIOi as well and computes RPWi=h(PWi∥Ri) which is used to pass the authentication.(ii)
Ui inputs a new password PWinew. After that, Ui computes RPWinew=h(PWinew∥Ri), Binew=Bi⊕RPWi⊕RPWinew, Cinew=Binew⊕h(PSK), Vinew=h(IDi∥RPWinew), Einew=Ei⊕RPWi⊕RPWinew, and Finew=Fi⊕RPWi⊕RPWinew.(iii)
SCi replaces Bi,Ci,Ei,Fi, and Vi with Binew,Cinew,Einew,Finew, and Vinew.


#### 3.2.5. User Revocation or Reregistration Phase

This phase is used for revocation and reregistration whenUi’s smart card SCi is stolen or lost.(i)
In revocation phase,Ui sends revocation requests to RC. RC chooses a negative random number and modifies the value of xi corresponding to Ui as that random number.(ii)
In reregistration phase,Ui sends reregistration requests to RC. RC selects a positive random number and sets it as xi of Ui.


## 3.1. Threat Model

In this subsection, we introduce a threat model following the definition of [36–39].(i)
The adversaryA is able to control the open communication channel completely; that is, he can intercept, modify, delete, block, and resend the messages over the open channel.(ii)
The adversaryA can list all pairs of IDi from the space of identities and PWi from the space of passwords in a polynomial time.(iii)
The adversaryA can either intercept the password of the user via the malicious device or extract the parameters from the smart card, but both methods cannot be used together. An honest-but-curious server does not have this ability.(iv)
WhenA acts as an honest-but-curious server, he can just listen the messages via the open channel.


## 3.2. The Proposed Protocol

As Wanget al.’s protocol, the new protocol also involves five phases. Table 2 lists the notations used in the new protocol.Table 2
Notations in the new protocol.
Ui,Sj ith user and jth server  RC the registration centre  IDi,AIDi,SIDj U i’s identity, dynamic identity and Sj’s identity  SCi,PWi,BIOi U i’s smart card, password and biometrics  Ri,Pi valid biometric characteristic extracted fromBIOi  PSK master secret key between server and registration centre  X master secret key between user and registration centre  h()˙,⊕,|| hash function, XOR operation and concatenating operation  xi pre-shared key betweenUi and registration centre  yj pre-shared key betweenSj and registration centre


### 3.2.1. Registration Phase

(i)
Server registration phase During server registration,Sj communicates with RC to authenticate his validity and become a legislative server after receiving the preshared key sent from RC. The whole process of the server registration phase is shown in Figure 1.
(a)
S j sends a request message to RC. (b)
R C authorizes Sj and adds a novel entry <SIDj,yj> to the database where yj is a random number. Then h(PSK),yj is sent to Sj by applying IKEv2 securely. (c)
S j adopts PSK,yj to protect the urgent messages and generates the session key SKij. (ii)
User registration phase A user sends his personal information toRC and gets his own smart card by executing the process listed in Figure 2.
(a)
U i inputs BIOi at the sensor and can obtain {Ri,Pi} using Gen(BIOi)→(Ri,Pi). Then Ui selects IDi and PWi and calculates RPWi=h(PWi∥Ri). Ui finally sends {IDiRPWi} to RC securely. (b)
R C generates a novel entry <IDi,xi> to the database where xi is a random number that records the validity of Ui. If Ui has revoked its account or the account is not available at present, RC generates a negative random number xi; otherwise, xi is a positive random number. At the same time, xi is a preshared key. After that, RC computes Ai=h(IDi∥X∥Tr), Bi=RPWi⊕h(Ai), Ci=Bi⊕h(PSK), Di=PSK⊕Ai⊕h(PSK), Vi=h(IDi∥RPWi), Ei=RPWi⊕xi, and Fi=RPWi⊕h(X), where Tr is the registration time and X is the masker secret key between the user and the registration center. (c)
R C puts {Bi,Ci,Di,Vi,Ei,Fi} into SCi. After that, RC issues it to Ui securely. (d)
WithSCi, Ui keeps Pi into SCi and initials the authentication.Figure 1
Registration phase of server.Figure 2
Registration phase of user.


### 3.2.2. Login Phase

A userUi tries to login to a server Sj by executing the steps shown in Figure 3.(i)
Ui inputs IDi, PWi, and BIOi∗, then his smart card can recover Ri∗ using Rep(BIOi∗,Pi)→Ri∗.(ii)
SCi computes RPWi∗=h(PWi∥Ri∗) and then checks whether h(IDi∥RPWi∗)=Vi or not. If it is true, SCi calculates h(PSK)=Bi⊕Ci, xi=RPWi⊕Ei, and h(X)=RPWi⊕Fi. Otherwise, Ui does not pass the identity authentication.(iii)
SCi generates a number N1 randomly for each session and calculates h(Ai)=RPWi⊕Bi, AIDi=IDi⊕h(X)⊕h(Ai), M1=RPWi⊕N1⊕h(PSK)⊕xi, and M2=h(AIDi∥RPWi∥SIDj∥Ti) where Ti is a timestamp.(iv)
SCi sends {AIDi,M1,M2,Bi,Di,Ti} to Sj.Figure 3
Login and authentication phase.


### 3.2.3. Authentication Phase

This phase offers the details of mutually authentication which are indicated in Figure3.(i)
Sj receives the information from Ui and verifies whether Ti-Tj′≤ΔT holds or not. If it holds, Sj calculates Ai=PSK⊕Di⊕h(PSK) and RPWi=Bi⊕h(Ai). Otherwise, Sj will reject the login request. Then Sj checks whether M2=h(AIDi∥RPWi∥SIDj∥Ti). If it fails, the protocol would be stopped. Otherwise, the server computes AIDi′=AIDi⊕h(Ai), M3=M1⊕RPWi⊕yi, and M4=h(AIDi′∥SIDj∥yj∥Tj) and sends messages {AIDi′,SIDj,M3,M4,Tj} to RC.(ii)
RC receives the messages and verifies whether Tj-Trc≤ΔT holds or not. If it holds, RC checks whether M4=h(AIDi′∥SIDj∥yj∥Tj). If it fails, the request would be stopped. Otherwise, RC computes IDi=AIDi′⊕h(X). Then RC goes through the database <IDi,xi>,<SIDj,yj> stored in RC to get xi and yi. If xi is a negative number, the request would be stopped. After that, RC computes N1=M3⊕h(PSK)⊕xi⊕yj, M5=N1⊕yj⊕PSK, and M6=h(M5)⊕Tc where Tc is an additional timestamp. Finally, RC returns {M5,M6,Tc} to Sj.(iii)
OnceSj receives the message from RC, it verifies whether Tc-Tj∗≤ΔT holds or not. If it holds, Sj checks whether M6=h(M5)⊕Tc. If it fails, the request will be stopped. Otherwise, Sj calculates N1=M5⊕yj⊕PSK. After selecting a number N2 randomly, Sj computes SKij=h(AIDi∥SIDj∥N1∥N2), M7=N2⊕h(AIDi∥N1)⊕h(PSK), and M8=h(SIDj∥N2∥AIDi). Then, the server sends {SIDj,M7,M8} to Ui.(iv)
Ui retrieves N2 and calculates SKij by computing N2=M7⊕h(AIDi∥N1)⊕h(PSK) and SKij=h(AIDi∥SIDj∥N1∥N2). After that, Ui checks whether M8=h(SIDj∥N2∥AIDi) holds or not. If it is valid, the user calculates M9=h(SKij∥N1∥N2) and sends M9 to Sj.(v)
Finally,Sj receives M9 and checks whether the equation h(SKij∥N1∥N2)=M9 holds or not. If so, a secret session key is generated successfully and can be used in the following communication. Otherwise, Sj would reject the authentication.


### 3.2.4. Password Change Phase

Using this phase,Ui’s password can be changed without any exchanging message from both RC and Sj.(i)
Ui inputs IDi, the old password PWi, and imprints BIOi as well and computes RPWi=h(PWi∥Ri) which is used to pass the authentication.(ii)
Ui inputs a new password PWinew. After that, Ui computes RPWinew=h(PWinew∥Ri), Binew=Bi⊕RPWi⊕RPWinew, Cinew=Binew⊕h(PSK), Vinew=h(IDi∥RPWinew), Einew=Ei⊕RPWi⊕RPWinew, and Finew=Fi⊕RPWi⊕RPWinew.(iii)
SCi replaces Bi,Ci,Ei,Fi, and Vi with Binew,Cinew,Einew,Finew, and Vinew.


### 3.2.5. User Revocation or Reregistration Phase

This phase is used for revocation and reregistration whenUi’s smart card SCi is stolen or lost.(i)
In revocation phase,Ui sends revocation requests to RC. RC chooses a negative random number and modifies the value of xi corresponding to Ui as that random number.(ii)
In reregistration phase,Ui sends reregistration requests to RC. RC selects a positive random number and sets it as xi of Ui.


## 3.2.1. Registration Phase

(i)
Server registration phase During server registration,Sj communicates with RC to authenticate his validity and become a legislative server after receiving the preshared key sent from RC. The whole process of the server registration phase is shown in Figure 1.
(a)
S j sends a request message to RC. (b)
R C authorizes Sj and adds a novel entry <SIDj,yj> to the database where yj is a random number. Then h(PSK),yj is sent to Sj by applying IKEv2 securely. (c)
S j adopts PSK,yj to protect the urgent messages and generates the session key SKij. (ii)
User registration phase A user sends his personal information toRC and gets his own smart card by executing the process listed in Figure 2.
(a)
U i inputs BIOi at the sensor and can obtain {Ri,Pi} using Gen(BIOi)→(Ri,Pi). Then Ui selects IDi and PWi and calculates RPWi=h(PWi∥Ri). Ui finally sends {IDiRPWi} to RC securely. (b)
R C generates a novel entry <IDi,xi> to the database where xi is a random number that records the validity of Ui. If Ui has revoked its account or the account is not available at present, RC generates a negative random number xi; otherwise, xi is a positive random number. At the same time, xi is a preshared key. After that, RC computes Ai=h(IDi∥X∥Tr), Bi=RPWi⊕h(Ai), Ci=Bi⊕h(PSK), Di=PSK⊕Ai⊕h(PSK), Vi=h(IDi∥RPWi), Ei=RPWi⊕xi, and Fi=RPWi⊕h(X), where Tr is the registration time and X is the masker secret key between the user and the registration center. (c)
R C puts {Bi,Ci,Di,Vi,Ei,Fi} into SCi. After that, RC issues it to Ui securely. (d)
WithSCi, Ui keeps Pi into SCi and initials the authentication.Figure 1
Registration phase of server.Figure 2
Registration phase of user.


## 3.2.2. Login Phase

A userUi tries to login to a server Sj by executing the steps shown in Figure 3.(i)
Ui inputs IDi, PWi, and BIOi∗, then his smart card can recover Ri∗ using Rep(BIOi∗,Pi)→Ri∗.(ii)
SCi computes RPWi∗=h(PWi∥Ri∗) and then checks whether h(IDi∥RPWi∗)=Vi or not. If it is true, SCi calculates h(PSK)=Bi⊕Ci, xi=RPWi⊕Ei, and h(X)=RPWi⊕Fi. Otherwise, Ui does not pass the identity authentication.(iii)
SCi generates a number N1 randomly for each session and calculates h(Ai)=RPWi⊕Bi, AIDi=IDi⊕h(X)⊕h(Ai), M1=RPWi⊕N1⊕h(PSK)⊕xi, and M2=h(AIDi∥RPWi∥SIDj∥Ti) where Ti is a timestamp.(iv)
SCi sends {AIDi,M1,M2,Bi,Di,Ti} to Sj.Figure 3
Login and authentication phase.


## 3.2.3. Authentication Phase

This phase offers the details of mutually authentication which are indicated in Figure3.(i)
Sj receives the information from Ui and verifies whether Ti-Tj′≤ΔT holds or not. If it holds, Sj calculates Ai=PSK⊕Di⊕h(PSK) and RPWi=Bi⊕h(Ai). Otherwise, Sj will reject the login request. Then Sj checks whether M2=h(AIDi∥RPWi∥SIDj∥Ti). If it fails, the protocol would be stopped. Otherwise, the server computes AIDi′=AIDi⊕h(Ai), M3=M1⊕RPWi⊕yi, and M4=h(AIDi′∥SIDj∥yj∥Tj) and sends messages {AIDi′,SIDj,M3,M4,Tj} to RC.(ii)
RC receives the messages and verifies whether Tj-Trc≤ΔT holds or not. If it holds, RC checks whether M4=h(AIDi′∥SIDj∥yj∥Tj). If it fails, the request would be stopped. Otherwise, RC computes IDi=AIDi′⊕h(X). Then RC goes through the database <IDi,xi>,<SIDj,yj> stored in RC to get xi and yi. If xi is a negative number, the request would be stopped. After that, RC computes N1=M3⊕h(PSK)⊕xi⊕yj, M5=N1⊕yj⊕PSK, and M6=h(M5)⊕Tc where Tc is an additional timestamp. Finally, RC returns {M5,M6,Tc} to Sj.(iii)
OnceSj receives the message from RC, it verifies whether Tc-Tj∗≤ΔT holds or not. If it holds, Sj checks whether M6=h(M5)⊕Tc. If it fails, the request will be stopped. Otherwise, Sj calculates N1=M5⊕yj⊕PSK. After selecting a number N2 randomly, Sj computes SKij=h(AIDi∥SIDj∥N1∥N2), M7=N2⊕h(AIDi∥N1)⊕h(PSK), and M8=h(SIDj∥N2∥AIDi). Then, the server sends {SIDj,M7,M8} to Ui.(iv)
Ui retrieves N2 and calculates SKij by computing N2=M7⊕h(AIDi∥N1)⊕h(PSK) and SKij=h(AIDi∥SIDj∥N1∥N2). After that, Ui checks whether M8=h(SIDj∥N2∥AIDi) holds or not. If it is valid, the user calculates M9=h(SKij∥N1∥N2) and sends M9 to Sj.(v)
Finally,Sj receives M9 and checks whether the equation h(SKij∥N1∥N2)=M9 holds or not. If so, a secret session key is generated successfully and can be used in the following communication. Otherwise, Sj would reject the authentication.


## 3.2.4. Password Change Phase

Using this phase,Ui’s password can be changed without any exchanging message from both RC and Sj.(i)
Ui inputs IDi, the old password PWi, and imprints BIOi as well and computes RPWi=h(PWi∥Ri) which is used to pass the authentication.(ii)
Ui inputs a new password PWinew. After that, Ui computes RPWinew=h(PWinew∥Ri), Binew=Bi⊕RPWi⊕RPWinew, Cinew=Binew⊕h(PSK), Vinew=h(IDi∥RPWinew), Einew=Ei⊕RPWi⊕RPWinew, and Finew=Fi⊕RPWi⊕RPWinew.(iii)
SCi replaces Bi,Ci,Ei,Fi, and Vi with Binew,Cinew,Einew,Finew, and Vinew.


## 3.2.5. User Revocation or Reregistration Phase

This phase is used for revocation and reregistration whenUi’s smart card SCi is stolen or lost.(i)
In revocation phase,Ui sends revocation requests to RC. RC chooses a negative random number and modifies the value of xi corresponding to Ui as that random number.(ii)
In reregistration phase,Ui sends reregistration requests to RC. RC selects a positive random number and sets it as xi of Ui.


## 4. Security Analysis of the New Protocol

### 4.1. Verifying the New Protocol with BAN Logic

Burrows-Abadi-Needham (BAN) logic is introduced by Burrowset al. [40] and widely used to analyze the security protocol. In this subsection, BAN logic is used to prove that mutual authentication can be obtained after running the new protocol successfully. The notations and postulates in BAN logic are listed in Table 3.Table 3
BAN logic notations and postulates.
Notations and postulates Description P|≡X P believes the statement X is true  P⊲X P sees X  P|~X P once said that X or has sent a message containing X  P⇒X P has control over X  #X X is fresh  P ↔ K Q P and Q can communicate using the shared key K, onlyP,Q or a trusted third party know K  (X)k The formulaX is combined with the formula K  P | ≡ P ↔ K Q , P ⊲ { X } K P | ≡ Q | ~ X Rule(a): The message-meaning rule  P | ≡ Q ⇒ X , P | ≡ Q | ≡ X P | ≡ X Rule(b): The jurisdiction rule  P | ≡ # ( X ) , P | ≡ Q | ~ X P | ≡ Q | ≡ X Rule(c): The nonce-verification rule  P | ≡ # ( X ) P | ≡ # ( X , Y ) Rule(d): The freshness-conjuncatenation rule  P | ≡ X , P | ≡ Y P | ≡ ( X , Y ),P|≡Q|≡(X,Y)P|≡Q|≡X Rule(e): The belief ruleWe first define the test goals which the new protocol should achieve using BAN logic:(g1)Sj|≡Ui|≡Ui↔SKijSj(g2)Sj|≡Ui↔SKijSj(g3)Ui|≡Sj|≡Ui↔SKijSj(g4)Ui|≡Ui↔SKijSjSecondly, we give the idealized form of the new protocol as follows:(m1)Ui→Sj:(IDi,RPWi,Ui↔N1Sj)Ui↔xiRC(m2)Sj→RC:(AIDi′,SIDj,RPWi,Ui↔N1Sj)Sj↔yjRC(m3)RC→Sj:(Tc,Ui↔N1Sj)Sj↔yjRC(m4)Sj→Ui:(SIDj,N1,Ui↔SKijSj)Ui↔N1Sj(m5)Ui→Sj:(N1,N2,Ui↔SKijSj)Ui↔N1,N2SjNext, we list the following initiative premises of the new protocol:(p1)Ui|≡#N1.(p2)Sj|≡#N2.(p3)Ui|≡Ui↔xiRC.(p4)RC|≡Ui↔xiRC.(p5)Sj|≡Sj↔yjRC.(p6)RC|≡Sj↔yjRC.(p7)Sj|≡RC⇒Ui↔N1Sj(p8)Ui|≡Sj⇒Ui↔SKijSj(p9)Sj|≡Ui⇒Ui↔SKijSj.(p10)Ui|≡Ui↔N1Sj(p11)Sj|≡Ui↔N2Sj(p12)Sj|≡#Tc.(p13)RC|≡#Tj.Finally, we analyze the new protocol using the BAN logic rules and the assumptions.From messagem3, we obtain(S1)Sj⊲(Tc,Ui↔N1Sj)Sj↔yjRC.From (p5), (S1), and Rule(a), we get(S2)Sj|≡RC|~(Tc,Ui↔N1Sj).From (p12) and Rule(d), we get(S3)Sj|≡#(Tc,Ui↔N1Sj).From (S2), (S3), and Rule(c), we get(S4)Sj|≡RC|≡(Tc,Ui↔N1Sj).From (S4) and Rule(e), we get(S5)Sj|≡RC|≡Ui↔N1Sj.From (p7), (S5), and Rule(b), we get(S6)Sj|≡Ui↔N1Sj.From message (m4), we have(S7)Ui⊲(SIDj,N1,Ui↔SKijSj)Ui↔N1Sj.From (p10), (S7), and Rule(a), we get(S8)Ui|≡Sj|~(SIDj,N1,Ui↔SKijSj).From (p1) and Rule(d), we get(S9)Ui|≡#(SIDj,N1,Ui↔SKijSj).From (S8), (S9), and Rule(c), we get(S10)Ui|≡Sj|≡(SIDj,N1,Ui↔SKijSj).From (S10) and Rule(e), we get(S11)Ui|≡Sj|≡Ui↔SKijSj(g3).From (P8), (S11), and Rule(b), we get(S12)Ui|≡Ui↔SKijSj(g4).From message (m5), we have(S13)Sj⊲(N1,N2,Ui↔SKijSj)Ui↔N1,N2Sj.From (p11), (S6), (S13), and Rule(a), we get(S14)Sj|≡Ui|~(N1,N2,Ui↔SKijSj).From (p2) and Rule(d), we get(S15)Sj|≡#(N1,N2,Ui↔SKijSj).From (S14), (S15), and Rule(c), we get(S16)Sj|≡Ui|≡(N1,N2,Ui↔SKijSj).From (S16) and Rule(e), we get(S17)Sj|≡Ui|≡Ui↔SKijSj(g1).Finally, From (P9), (S17), and Rule(b), we get(S18)Sj|≡Ui↔SKijSj(g2).According to (g1), (g2), (g3), and (g4), we conclude that the new protocol provides the mutual authentication and a shared secret key between the user and the server after a successful running of the protocol.


### 4.2. Formal Security Analysis

Recent research has shown that user-chosen passwords follow the Zipf’s law [41], a vastly different distribution from the uniform distribution. In this subsection, we provide a formal security analysis of the new protocol with the Zipf’s law.Theorem 1.
Letl be the length of the biometric key BIOi, let |Hash| be the range space of hash function h(·), and both C and s are the Zipf’s parameters [41]. Let qsend be Send queries and qh be Hash oracle queries. For any adversary A in polynomial time t against the new protocol P in the random oracle, the advantage of A breaking the SK-security of P is (1)Advpake≤qh2Hash+C·qsends2l-1.Proof.
LetEi be the event that A guesses bit b for Gi in the test session successfully. According to the new protocol, A does not need to guess or compute the user’s identity since there is only one user. The games G0 to G3 are listed as follows.
Game G 0. This game corresponds to the real attack in the random oracle model. Hence (2)Advpake=2prE0-1.
Game G 1. We simulate A’s eavesdropping attack by querying Execute oracles. Then, A sends the Test query and decides whether the outcome of Test query matches with SK which can be calculated as SKij=h(AIDi∥SIDj∥N1∥N2). A cannot get the message about PSK, h(X). and AIDi, due to the security of Sj’s PSK and Ui’s h(X). Thus A cannot increase the chance of winning game G1. Hence we have (3)prE0=prE1.
Game G 2. We simulate A’s active attack by querying Send and Hash oracles. A will manage to find the collisions of Hash in the way of make queries, but it is impossible for him to know the message of both {AIDi,M1,M2,Bi,Di,Ti} and {SIDj,M7,M8} without the knowledge of Ti, N1, and N2. Hence there is no collision when querying Send oracles. Using the birthday paradox, we obtain (4)prE2-prE1=qh22.Hash.
Game G 3. This game simulates the smart card lost attack by querying CorruptSC oracle. If A wants to obtain the secret information of users, he tries online dictionary attack due to the low entropy of password or other computing modes to get Pi which is used as the biometrics key with the message from SCi. Unfortunately, A has to know Ri∈{0,1}l with the probability approximated as 1/2l, because we use fuzzy extractor function to extract at most l nearly random bits of Ri. Even if using the Zipf’s law on passwords, we still have (5)prE3-prE2≤C·qsends2l.
Moreover,A cannot get any useful messages about the value of c because of the independence and randomness of each session key. Thus, we have (6)prE3=12.
Combined the above steps, we can get the result as follows:(7)Advpake≤qh2Hash+C·qsends2l-1


### 4.3. Informal Security Analysis

In this subsection, informal security analysis is conducted to show that the new protocol can withstand various attacks.Replay Attack. If A replays a former piece of user’s messages to server, he will not success since a timestamp is used in each session to guarantee the freshness of time. If the information in a previous session is replayed, the interval between Tj and Ti will not be in an endurable range. Therefore, in the authentication phase A cannot pass the authentication in the first step. Hence, the new protocol can resist the replay attack.Modification Attack. It is assumed that an adversary A intercepts the information transmitted on the public channel and intends to modify the information to pass the authentication. Unfortunately, the integrity of the transmitted messages in the new scheme is protected by using one-way hash function. Moreover, A cannot retrieve N1 and N2 from the intercepted messages, thus he cannot generate a legitimate authentication message. Therefore the new protocol can resist the modification attack.Server Session Key Attack. In our proposed scheme, on one hand, session key SKij contains N1, N2, AIDi, SIDj, N1, and N2 which are different in every session and thus cannot be retrieved directly by a malicious adversary A. On the other hand, our scheme provides mutual authentication in the authentication phase and makes an improvement, i.e., both of the user and the server know whether SKij has already been generated by each other. If the server S1 wants to obtain the session key SKij by calculation, he has to obtain y2 since N1=M5⊕y2⊕PSK. Unfortunately, the specific value of y2 is known only to S2 and RC. After receiving the messages transmitted from the user, the server calculates M9=h(SKij∥N1∥N2) which means that the authentication is passed and valid session key has already be generated by each other. Therefore our scheme holds the security of session Key.User Impersonation Attack. If A is going to impersonate a valid user, A has to retrieve BIOi, PWi, and IDi of Ui to pass the authentication in calculating h(IDi′∥RPWi′)=Vi in login phase. It is impossible for him to make it as a result of our perfect user anonymity and the uniqueness of biometric message. If the adversary wants to get access to Sj as a valid user with the messages AIDi, Ti, Bi, Di, M1, and M2, he cannot pass the check M2=h(AIDi∥RPWi∥SIDj∥Ti) and form a session key with the server he communicates with.Forgery Attack. The forgery attack refers to the existence of a legitimate but malicious user A who attempts to falsify the identity information of another legitimate user to login and authenticate. In the communication between the legal server Sj and the user Ui, the real identity IDi of Ui is protected by AIDi, i.e., AIDi=IDi⊕h(X)⊕h(Ai). In addition, the identity Ai is different for each user. Therefore, the malicious user A cannot obtain the real identity IDi of another legitimate user. Therefore, our scheme can prevent forgery attack.Masquerade Attack. Under this attack, A can authenticate with the server Sj as a legal user and attempt to acquire the session key SK using the information transmitted at the authentication phase. In order to resist this attack, all messages transmitted in the public channel contain the destination or source information, such as M2=h(AIDi∥RPWi∥SIDj∥Ti) and M4=h(AIDi′∥SIDj∥yj∥Tj) with AID or SID. So that Ui and Sj verify whether one wants to be authenticated by the other. Therefore our protocol can resist the masquerade attack.Smart Card Attack. If the user’s smart card is stolen or lost and all the messages stored have been divulged by the adversary, there still no way for him to pass the authentication. At first, after acquiring Bi, Di, Vi, Ei, and Fi, A still cannot get IDi and RPWi. So A is not capable of forging a valid user Ui. Also, A cannot get any useful messages such as RPWi, Ai, and PSK using the messages stored in a smart card. Therefore, the new protocol is resistant to the stolen or lost smart card attack.Offline Guessing Attack. A may get Bi, Ci, Di, Ei, Fi, and Vi by side channel attack such as SPA and DPA. However, he cannot change the user’s password without BIOi, h(PSK), X, or xi during the offline environment. In addition, one-way hash function is adopted to protect user’s password. Since it is impossible for different user to own the same biometric template, offline guessing attack can be avoided in the new protocol.DoS Attack. DoS attack can seriously affect the efficiency of the server, causing the server to lose availability. However, all messages transmitted to the server and RC would be time stamped. With the help of the timestamp, the server and RC would verify the freshness and legitimacy of the message by checking M2, M4, and M6. In addition, login operations require a fuzzy extractor to meet the biometric requirements. Therefore, our scheme can resist DoS attack.Server Spoofing Attack. If A attempts to imitate a valid server, he is supposed to have the preshared key, a long-term secret key shared between RC and Sj. In the new protocol, h(PSK) and yj function as the preshared key which are transmitted through a secure channel and is unavailable to anyone other than RC and servers. Without yj, it is impossible for the adversary to calculate N1 in the authentication phase since N1=M5⊕yj. And also, without h(PSK) and N1, the adversary cannot get N2 since N2=M7⊕h(AIDi∥N1)∥h(PSK). Thus the adversary cannot imitate a valid server.User Anonymity. The users real identity is protected by replacing IDi with AIDi where AIDi=IDi⊕h(X)⊕h(Ai). Also, due to the hash function and the secret key, either an outside adversary A or an honest-but-curious server cannot figure out IDi through AIDi. Thus the weak anonymity of the user is guaranteed.Regrettably, the anonymity of the new scheme is not perfect. For example, assuming that the server cooperates with a malicious user, the malicious user providesh(X) by calculating h(X)=RPWi⊕Fi, and the server calculates Ai through Ai=PSK⊕Di⊕h(PSK), then the server can calculate IDi by calculating IDi=AIDi⊕h(X)⊕h(Ai). Moreover, an adversary A with Ui’s lost smart card can also compute Ui’s identity. Therefore, our scheme just provides the weak anonymity.


## 4.1. Verifying the New Protocol with BAN Logic

Burrows-Abadi-Needham (BAN) logic is introduced by Burrowset al. [40] and widely used to analyze the security protocol. In this subsection, BAN logic is used to prove that mutual authentication can be obtained after running the new protocol successfully. The notations and postulates in BAN logic are listed in Table 3.Table 3
BAN logic notations and postulates.
Notations and postulates Description P|≡X P believes the statement X is true  P⊲X P sees X  P|~X P once said that X or has sent a message containing X  P⇒X P has control over X  #X X is fresh  P ↔ K Q P and Q can communicate using the shared key K, onlyP,Q or a trusted third party know K  (X)k The formulaX is combined with the formula K  P | ≡ P ↔ K Q , P ⊲ { X } K P | ≡ Q | ~ X Rule(a): The message-meaning rule  P | ≡ Q ⇒ X , P | ≡ Q | ≡ X P | ≡ X Rule(b): The jurisdiction rule  P | ≡ # ( X ) , P | ≡ Q | ~ X P | ≡ Q | ≡ X Rule(c): The nonce-verification rule  P | ≡ # ( X ) P | ≡ # ( X , Y ) Rule(d): The freshness-conjuncatenation rule  P | ≡ X , P | ≡ Y P | ≡ ( X , Y ),P|≡Q|≡(X,Y)P|≡Q|≡X Rule(e): The belief ruleWe first define the test goals which the new protocol should achieve using BAN logic:(g1)Sj|≡Ui|≡Ui↔SKijSj(g2)Sj|≡Ui↔SKijSj(g3)Ui|≡Sj|≡Ui↔SKijSj(g4)Ui|≡Ui↔SKijSjSecondly, we give the idealized form of the new protocol as follows:(m1)Ui→Sj:(IDi,RPWi,Ui↔N1Sj)Ui↔xiRC(m2)Sj→RC:(AIDi′,SIDj,RPWi,Ui↔N1Sj)Sj↔yjRC(m3)RC→Sj:(Tc,Ui↔N1Sj)Sj↔yjRC(m4)Sj→Ui:(SIDj,N1,Ui↔SKijSj)Ui↔N1Sj(m5)Ui→Sj:(N1,N2,Ui↔SKijSj)Ui↔N1,N2SjNext, we list the following initiative premises of the new protocol:(p1)Ui|≡#N1.(p2)Sj|≡#N2.(p3)Ui|≡Ui↔xiRC.(p4)RC|≡Ui↔xiRC.(p5)Sj|≡Sj↔yjRC.(p6)RC|≡Sj↔yjRC.(p7)Sj|≡RC⇒Ui↔N1Sj(p8)Ui|≡Sj⇒Ui↔SKijSj(p9)Sj|≡Ui⇒Ui↔SKijSj.(p10)Ui|≡Ui↔N1Sj(p11)Sj|≡Ui↔N2Sj(p12)Sj|≡#Tc.(p13)RC|≡#Tj.Finally, we analyze the new protocol using the BAN logic rules and the assumptions.From messagem3, we obtain(S1)Sj⊲(Tc,Ui↔N1Sj)Sj↔yjRC.From (p5), (S1), and Rule(a), we get(S2)Sj|≡RC|~(Tc,Ui↔N1Sj).From (p12) and Rule(d), we get(S3)Sj|≡#(Tc,Ui↔N1Sj).From (S2), (S3), and Rule(c), we get(S4)Sj|≡RC|≡(Tc,Ui↔N1Sj).From (S4) and Rule(e), we get(S5)Sj|≡RC|≡Ui↔N1Sj.From (p7), (S5), and Rule(b), we get(S6)Sj|≡Ui↔N1Sj.From message (m4), we have(S7)Ui⊲(SIDj,N1,Ui↔SKijSj)Ui↔N1Sj.From (p10), (S7), and Rule(a), we get(S8)Ui|≡Sj|~(SIDj,N1,Ui↔SKijSj).From (p1) and Rule(d), we get(S9)Ui|≡#(SIDj,N1,Ui↔SKijSj).From (S8), (S9), and Rule(c), we get(S10)Ui|≡Sj|≡(SIDj,N1,Ui↔SKijSj).From (S10) and Rule(e), we get(S11)Ui|≡Sj|≡Ui↔SKijSj(g3).From (P8), (S11), and Rule(b), we get(S12)Ui|≡Ui↔SKijSj(g4).From message (m5), we have(S13)Sj⊲(N1,N2,Ui↔SKijSj)Ui↔N1,N2Sj.From (p11), (S6), (S13), and Rule(a), we get(S14)Sj|≡Ui|~(N1,N2,Ui↔SKijSj).From (p2) and Rule(d), we get(S15)Sj|≡#(N1,N2,Ui↔SKijSj).From (S14), (S15), and Rule(c), we get(S16)Sj|≡Ui|≡(N1,N2,Ui↔SKijSj).From (S16) and Rule(e), we get(S17)Sj|≡Ui|≡Ui↔SKijSj(g1).Finally, From (P9), (S17), and Rule(b), we get(S18)Sj|≡Ui↔SKijSj(g2).According to (g1), (g2), (g3), and (g4), we conclude that the new protocol provides the mutual authentication and a shared secret key between the user and the server after a successful running of the protocol.


## 4.2. Formal Security Analysis

Recent research has shown that user-chosen passwords follow the Zipf’s law [41], a vastly different distribution from the uniform distribution. In this subsection, we provide a formal security analysis of the new protocol with the Zipf’s law.Theorem 1.
Letl be the length of the biometric key BIOi, let |Hash| be the range space of hash function h(·), and both C and s are the Zipf’s parameters [41]. Let qsend be Send queries and qh be Hash oracle queries. For any adversary A in polynomial time t against the new protocol P in the random oracle, the advantage of A breaking the SK-security of P is (1)Advpake≤qh2Hash+C·qsends2l-1.Proof.
LetEi be the event that A guesses bit b for Gi in the test session successfully. According to the new protocol, A does not need to guess or compute the user’s identity since there is only one user. The games G0 to G3 are listed as follows.
Game G 0. This game corresponds to the real attack in the random oracle model. Hence (2)Advpake=2prE0-1.
Game G 1. We simulate A’s eavesdropping attack by querying Execute oracles. Then, A sends the Test query and decides whether the outcome of Test query matches with SK which can be calculated as SKij=h(AIDi∥SIDj∥N1∥N2). A cannot get the message about PSK, h(X). and AIDi, due to the security of Sj’s PSK and Ui’s h(X). Thus A cannot increase the chance of winning game G1. Hence we have (3)prE0=prE1.
Game G 2. We simulate A’s active attack by querying Send and Hash oracles. A will manage to find the collisions of Hash in the way of make queries, but it is impossible for him to know the message of both {AIDi,M1,M2,Bi,Di,Ti} and {SIDj,M7,M8} without the knowledge of Ti, N1, and N2. Hence there is no collision when querying Send oracles. Using the birthday paradox, we obtain (4)prE2-prE1=qh22.Hash.
Game G 3. This game simulates the smart card lost attack by querying CorruptSC oracle. If A wants to obtain the secret information of users, he tries online dictionary attack due to the low entropy of password or other computing modes to get Pi which is used as the biometrics key with the message from SCi. Unfortunately, A has to know Ri∈{0,1}l with the probability approximated as 1/2l, because we use fuzzy extractor function to extract at most l nearly random bits of Ri. Even if using the Zipf’s law on passwords, we still have (5)prE3-prE2≤C·qsends2l.
Moreover,A cannot get any useful messages about the value of c because of the independence and randomness of each session key. Thus, we have (6)prE3=12.
Combined the above steps, we can get the result as follows:(7)Advpake≤qh2Hash+C·qsends2l-1


## 4.3. Informal Security Analysis

In this subsection, informal security analysis is conducted to show that the new protocol can withstand various attacks.Replay Attack. If A replays a former piece of user’s messages to server, he will not success since a timestamp is used in each session to guarantee the freshness of time. If the information in a previous session is replayed, the interval between Tj and Ti will not be in an endurable range. Therefore, in the authentication phase A cannot pass the authentication in the first step. Hence, the new protocol can resist the replay attack.Modification Attack. It is assumed that an adversary A intercepts the information transmitted on the public channel and intends to modify the information to pass the authentication. Unfortunately, the integrity of the transmitted messages in the new scheme is protected by using one-way hash function. Moreover, A cannot retrieve N1 and N2 from the intercepted messages, thus he cannot generate a legitimate authentication message. Therefore the new protocol can resist the modification attack.Server Session Key Attack. In our proposed scheme, on one hand, session key SKij contains N1, N2, AIDi, SIDj, N1, and N2 which are different in every session and thus cannot be retrieved directly by a malicious adversary A. On the other hand, our scheme provides mutual authentication in the authentication phase and makes an improvement, i.e., both of the user and the server know whether SKij has already been generated by each other. If the server S1 wants to obtain the session key SKij by calculation, he has to obtain y2 since N1=M5⊕y2⊕PSK. Unfortunately, the specific value of y2 is known only to S2 and RC. After receiving the messages transmitted from the user, the server calculates M9=h(SKij∥N1∥N2) which means that the authentication is passed and valid session key has already be generated by each other. Therefore our scheme holds the security of session Key.User Impersonation Attack. If A is going to impersonate a valid user, A has to retrieve BIOi, PWi, and IDi of Ui to pass the authentication in calculating h(IDi′∥RPWi′)=Vi in login phase. It is impossible for him to make it as a result of our perfect user anonymity and the uniqueness of biometric message. If the adversary wants to get access to Sj as a valid user with the messages AIDi, Ti, Bi, Di, M1, and M2, he cannot pass the check M2=h(AIDi∥RPWi∥SIDj∥Ti) and form a session key with the server he communicates with.Forgery Attack. The forgery attack refers to the existence of a legitimate but malicious user A who attempts to falsify the identity information of another legitimate user to login and authenticate. In the communication between the legal server Sj and the user Ui, the real identity IDi of Ui is protected by AIDi, i.e., AIDi=IDi⊕h(X)⊕h(Ai). In addition, the identity Ai is different for each user. Therefore, the malicious user A cannot obtain the real identity IDi of another legitimate user. Therefore, our scheme can prevent forgery attack.Masquerade Attack. Under this attack, A can authenticate with the server Sj as a legal user and attempt to acquire the session key SK using the information transmitted at the authentication phase. In order to resist this attack, all messages transmitted in the public channel contain the destination or source information, such as M2=h(AIDi∥RPWi∥SIDj∥Ti) and M4=h(AIDi′∥SIDj∥yj∥Tj) with AID or SID. So that Ui and Sj verify whether one wants to be authenticated by the other. Therefore our protocol can resist the masquerade attack.Smart Card Attack. If the user’s smart card is stolen or lost and all the messages stored have been divulged by the adversary, there still no way for him to pass the authentication. At first, after acquiring Bi, Di, Vi, Ei, and Fi, A still cannot get IDi and RPWi. So A is not capable of forging a valid user Ui. Also, A cannot get any useful messages such as RPWi, Ai, and PSK using the messages stored in a smart card. Therefore, the new protocol is resistant to the stolen or lost smart card attack.Offline Guessing Attack. A may get Bi, Ci, Di, Ei, Fi, and Vi by side channel attack such as SPA and DPA. However, he cannot change the user’s password without BIOi, h(PSK), X, or xi during the offline environment. In addition, one-way hash function is adopted to protect user’s password. Since it is impossible for different user to own the same biometric template, offline guessing attack can be avoided in the new protocol.DoS Attack. DoS attack can seriously affect the efficiency of the server, causing the server to lose availability. However, all messages transmitted to the server and RC would be time stamped. With the help of the timestamp, the server and RC would verify the freshness and legitimacy of the message by checking M2, M4, and M6. In addition, login operations require a fuzzy extractor to meet the biometric requirements. Therefore, our scheme can resist DoS attack.Server Spoofing Attack. If A attempts to imitate a valid server, he is supposed to have the preshared key, a long-term secret key shared between RC and Sj. In the new protocol, h(PSK) and yj function as the preshared key which are transmitted through a secure channel and is unavailable to anyone other than RC and servers. Without yj, it is impossible for the adversary to calculate N1 in the authentication phase since N1=M5⊕yj. And also, without h(PSK) and N1, the adversary cannot get N2 since N2=M7⊕h(AIDi∥N1)∥h(PSK). Thus the adversary cannot imitate a valid server.User Anonymity. The users real identity is protected by replacing IDi with AIDi where AIDi=IDi⊕h(X)⊕h(Ai). Also, due to the hash function and the secret key, either an outside adversary A or an honest-but-curious server cannot figure out IDi through AIDi. Thus the weak anonymity of the user is guaranteed.Regrettably, the anonymity of the new scheme is not perfect. For example, assuming that the server cooperates with a malicious user, the malicious user providesh(X) by calculating h(X)=RPWi⊕Fi, and the server calculates Ai through Ai=PSK⊕Di⊕h(PSK), then the server can calculate IDi by calculating IDi=AIDi⊕h(X)⊕h(Ai). Moreover, an adversary A with Ui’s lost smart card can also compute Ui’s identity. Therefore, our scheme just provides the weak anonymity.


## 5. Efficiency Analysis

Efficiency analysis is conducted in this section to evaluate the new protocol. The comparisons including the resistance, functionality, and performance are summarized. In Table5, let (S1) denote Chuanget al.’s protocol [29], (S2) denote Wanget al.’s protocol [33], (S3) denote Yanget al.’s protocol [24], (S4) denote Reddyet al.’s protocol [34], (S5) denote HE-WANG’s protocol [42], and (S6) denote Odeluet al.’s protocol [43]. The following notations are defined in Table 4.Table 4
Notations in security comparison table.
R 1 resistance to replay attack  R2 resistance to modification attack  R3 resistance to Server session key attack  R4 resistance to user impersonate attack  R5 resistance to forgery attack  R6 resistance to masquerade attack  R7 resistance to smart card attack  R8 resistance to off-line guessing attack  R9 resistance to Dos attack  R10 resistance to server spoofing attackTable 5
The security comparison.
S1 S2 S3 S4 S5 S6 our scheme R1 No Yes Yes Yes No Yes Yes  R2 Yes Yes Yes / Yes Yes Yes  R3 No No / / No Yes Yes  R4 No No Yes Yes No Yes Yes  R5 Yes Yes / / Yes Yes Yes  R6 No No / / Yes Yes Yes  R7 No No Yes Yes Yes Yes Yes  R8 Yes Yes Yes Yes Yes Yes Yes  R9 No Yes Yes Yes Yes Yes Yes  R10 No Yes Yes / Yes Yes YesSecurity comparison is offered by Table5. In Table 5, “/” denotes that the security has not been analyzed until now. From Table 5, it is easy to see that protocols of (S1), (S2), (S3), and (S4), which do not include the registration center into the authentication phase, can not resist the passive attack from an honest-but-curious server. Although (S5) is resistant to above attack, it can not resist the user impersonate attack and smart card attack. The new protocol, together with (S6), achieves all resistance requirements, since they implement the authentication with the help of the authentication center. Thus they are more secure than the first five protocols.Functionalities comparison is listed in Table7. The notations that appear in Table 7 are lists in Table 6. It can be seen that (S1), (S2), (S3), and (S4) do not provide user revocation/reregistration functionality, and (S5) does not offer anonymity property. Only our new protocol and (S6) provide all five basic functionality requirements.Table 6
Notations in functionality comparison table.
F 1 anonymity  F2 mutual authentication  F3 session key agreement  F4 perfect forward secrecy  F5 user revocation/re-registrationTable 7
The functionality comparison.
S1 S2 S3 S4 S5 S6 our scheme F1 Yes Yes Yes Yes No Yes Yes  F2 No Yes Yes Yes Yes Yes Yes  F3 Yes Yes Yes Yes Yes Yes Yes  F4 No Yes Yes Yes Yes Yes Yes  F5 No No Yes Yes Yes Yes YesNow we conduct the efficiency analysis including computation overhead and communication overhead. To compare with other related works, only login and authentication phase are considered.Tables9 and 10 list the computation cost comparisons from different aspects. The notations that appear in Table 9 are listed in Table 8. For the computation efficiency, we only calculate the number of hash functions, while ignore Exclusive OR operation and concatenating operation since they require little computational cost. Let Tω denote the computation time for symmetric-key encryption/decryption which is known as about 0.005ms, Th denote the computation time for one-way hash function which is known as about 0.002ms, and Tm denote the computation time for elliptic curve point multiplication which is known as about 2.226ms.Table 8
Notations in computation comparison table.
C 1 computation overhead in the login phase  C2 execution overhead in the login phase  C3 computation overhead in the authentication phase  C4 execution overhead in the authentication phase  C5 total execution overheadTable 9
Computation cost comparison in different phase.
S1 S2 S3 S4 S5 S6 our scheme C1 4Th 4Th 5Th 6Th+1Tm 3Th+2Tm 5Th+2Tm+1Tω 3Th  C2 0.008ms 0.008ms 0.01ms 2.238ms 4.458ms 4.467ms 0.006ms  C3 13Th 11Th 13Th 9Th+3Tm 18Th+6Tm 19Th+4Tm+5Tω 17Th  C4 0.026ms 0.022ms 0.026ms 6.696ms 13.392ms 8.967ms 0.034ms  C5 0.034ms 0.03ms 0.036ms 8.934ms 17.85ms 13.434ms 0.04msTable 10
Computation cost comparison in different participants.
S1 S2 S3 S4 S5 S6 our scheme Usercost 9Th 8Th 9Th 9Th+2Tm 7Th+3Tm 7Th+3Tm+1Tω 7Th  Usertime 0.018ms 0.016ms 0.018ms 4.47ms 6.692ms 6.697ms 0.014ms  Servercost 8Th 7Th 9Th 6Th+2Tm 5Th+3Tm 6Th+2Tm+2Tω 9Th  Servertime 0.016ms 0.014ms 0.018ms 4.464ms 6.688ms 4.474ms 0.018ms  RCcost / / / / 9Th+2Tm 11Th+1Tm+3Tω 4Th  RCtime / / / / 4.47ms 2.263ms 0.008ms  Totalcost 17Th 15Th 18Th 15Th+4Tm 21Th+8Tm 24Th+6Tm+6Tω 20Th  Totaltime 0.034ms 0.03ms 0.036ms 8.934ms 17.85ms 13.434ms 0.04msTable9 compares the computation time according to protocol’s different phase. From Table 9, we can find that the new protocols, together with (S1), (S2), (S3), and (S4), spend almost the same time since only hash function contributes to computation cost. On the other hand, (S5) and (S6) take more time for computation due to the expensive elliptic curve point multiplication operations.Table10 compares the computation time according to different participants. The user’s executing time in the new protocol only needs 0.014ms, which proves that the new protocol provides the most efficient use’s computation. In terms of server’s executing time, the new protocol spends almost the same time as that of the most efficient protocols, i.e., (S1), (S2), and (S3). To resist the passive attack from the honest-but-curious servers, (S5), (S6), and the new protocol introduce the registration center into the authentication phase, which would bring extra burden for the trusty registration center. As shown in Table 10, RC needs extra 4.47ms for (S5) and extra 2.263ms for (S6). In the new protocol, RC is only used to transmit the secret information instead of authenticating user and server. As a result, the extra executing time for RC in the new protocol is only 0.008ms, which is much less than that of (S5) and (S6). Therefore, the new protocol is the most efficient one among the second kind of multiserver authentication protocols. In conclusion, among all of the multiserver protocols against the passive attack from an honest-but-curious attack, the new protocol is the most computational efficient one.Table12 lists the new protocol’s communication cost together with the other related protocols. Suppose the random number xi is 160 bits, the length of the user identity is 160 bits, the length of the timestamp is 16 bits, and the output length of one-way hash function is 160 bits if SHA-1 is adopted. Table 11 shows the notations that appear in Table 12. In the new protocol, when Ui logs in, he has to transmit M1, AIDi, M2, Ti, Bi, and Di; thus the length of these messages is (160∗5+16)/8 = 102 bytes. In the authentication phase, we introduce the registration center, so the communication cost is a little more than (S1), (S3), and (S4), about 180 bytes or so. Among all of the multiserver protocols against the passive attack from an honest-but-curious attack, the new protocol has the high communication efficient.Table 11
Notations in communication comparison table.
C O M 1 communication cost in login phase  COM2 communication cost in authentication and key agreement phase  COM3 total communication costTable 12
Communication cost comparison table.
S1 S2 S3 S4 S5 S6 our scheme COM1 80 Bytes 102 Bytes 102 Bytes 80 Bytes 64 Bytes 108 Bytes 102 Bytes  COM2 80 Bytes 80 Bytes 60 Bytes 80 Bytes 376 Bytes 260 Bytes 180 Bytes  COM3 160 Bytes 182 Bytes 162 Bytes 160 Bytes 440 Bytes 368 Bytes 282 BytesCombined with the security properties and the functionalities, we conclude that the new protocol and (S6) achieve all basic security properties and satisfy all functionalities. In terms of efficiency, (S6) spends much more computation time, bandwidth, and storage space compared with the new protocol. In conclusion, the new protocol is the most efficient multiserver authentication protocol which satisfies all basic security properties and functionalities.


## 6. Conclusion

In this paper, we found that a kind of multifactor multiserver authentication protocols can not resist the passive attack from an honest-but-curious servers. We took Wanget al.’s protocol as an example, to exhibit how an honest-but-curious server step by step obtained a session key which should be kept secret from him. Moreover, we observed that the revocation and reregistration process in their protocol is incorrect. To remedy these weaknesses, this paper proposed a novel multiserver authentication protocol. The new protocol satisfies comprehensive demands of security and provides versatile and practical functionalities. Compared with the related protocols in computation cost and communication cost, the new protocol is the most efficient multiserver authentication protocol which satisfies all basic security properties and functionalities. Therefore, the new protocol is secure and relatively efficient in the remote distributed authentication networks. We have noticed that this kind of attack may also exist in other likewise environment, such as the multifactor multigateway authentication protocol in the wireless sensor networks. As a future work, we would apply the passive attack from an honest-but-curious gateway to the multifactor multigateway authentication protocol in the wireless sensor network and try to design secure protocols for multigateway wireless sensor network.



---

*Source: 3284324-2018-09-13.xml*