# A Robust IoT-Based Three-Factor Authentication Scheme for Cloud Computing Resistant to Session Key Exposure

Authors: Feifei Wang; Guosheng Xu; Guoai Xu; Yuejie Wang; Junhao Peng
Journal: Wireless Communications and Mobile Computing
 (2020)

---

## Abstract

With the development of Internet of Things (IoT) technologies, Internet-enabled devices have been widely used in our daily lives. As a new service paradigm, cloud computing aims at solving the resource-constrained problem of Internet-enabled devices. It is playing an increasingly important role in resource sharing. Due to the complexity and openness of wireless networks, the authentication protocol is crucial for secure communication and user privacy protection. In this paper, we discuss the limitations of a recently introduced IoT-based authentication scheme for cloud computing. Furthermore, we present an enhanced three-factor authentication scheme using chaotic maps. The session key is established based on Chebyshev chaotic-based Diffie–Hellman key exchange. In addition, the session key involves a long-term secret. It ensures that our scheme is secure against all the possible session key exposure attacks. Besides, our scheme can effectively update user password locally. Burrows–Abadi–Needham logic proof confirms that our scheme provides mutual authentication and session key agreement. The formal analysis under random oracle model proves the semantic security of our scheme. The informal analysis shows that our scheme is immune to diverse attacks and has desired features such as three-factor secrecy. Finally, the performance comparisons demonstrate that our scheme provides optimal security features with an acceptable computation and communication overheads.


---

## Body

## 1. Introduction

With the rapid growth of Internet of Things (IoT) technologies, Internet-enabled devices have had a tremendous impact on people’s works and lives [1–3]. However, the Internet-enabled devices have limited storage, computing power, and communication ability. To solve this limitation, cloud computing emerged as a new service paradigm [4]. It provides a new method with high efficiency and convenience to realize information and resource sharing. The users are able to access the resources, services, or applications that are deployed in distributed cloud servers by utilizing a handheld device anywhere and anytime. And the control server is in charge of authorizing the users and distributed servers.As the communication channel is open and unprotected, there are diverse and severe security threats for stealing sensitive data and resource in cloud computing environment [5, 6]. An authentication protocol is indispensable to prevent unauthorized access and protect the sensitive data and user privacy. From the first smart card-based authentication protocol [7] introduced by Yang and Shieh in 1999, there have been a large number of enhanced schemes proposed [2, 8–13]. Based on the authentication factors the user employs, the authentication schemes are divided into two-factor authentication schemes and three-factor authentication schemes. Based on the cryptosystem the authentication scheme adopts, the authentication schemes are divided into hash-based schemes, symmetric cryptosystem-based schemes, and public key cryptosystem-based schemes.


### 1.1. Related Works

In terms of authentication schemes for cloud computing, some proposals have been presented one after another to improve the security and efficiency [14–17]. In 2015, Tsai and Lo [18] put forward an anonymous authentication protocol using bilinear pairing, in which the user can directly login the distributed server without the help of control server. Afterwards, He et al. [19] revealed that their scheme is not resistant to server impersonation attack and put forward an enhanced scheme. In 2017, Kumari et al. [20] presented a biometric-based authentication protocol employing elliptic curve cryptosystem (ECC). However, their scheme cannot withstand known session-specific temporary information attack and fails to preserve three-factor secrecy. In 2018, Amin et al. [21] pointed out that two anonymous authentication schemes [22, 23] have weaknesses like forgery attack and session key disclosure attack and introduced a hash-based two-factor authentication scheme. Unfortunately, Wang et al. [24] revealed that their scheme still cannot resist session key disclosure attack. In 2019, Mo et al. [25] introduced an ECC-based single-server two-factor authentication protocol. But this protocol is not resistant to stolen-verifier attack. In the same year, Zhou et al. [26] put forward a two-factor authentication scheme employing hash function. But we observe that their scheme suffers from forgery attack and replay attack and does not preserve forward secrecy. For better understanding, we summarize these schemes in Table 1.Table 1
Related authentication schemes for cloud computing.
Category
Schemes
Authentication factors
Cryptographic primitive
Security limitations
Public key cryptosystem-based schemes
Tsai and Lo [18]
Three-factor
Bilinear pairing
Server impersonation attack
He et al. [19]
Two-factor
Bilinear pairing
Inefficient typo detection
Kumari et al. [20]
Three-factor
Elliptic curve cryptosystem
Known session-specific temporary information attackFails to preserve three-factor secrecy
Mo et al. [25]
Two-factor
Elliptic curve cryptosystem
Stolen-verifier attackForgery attackReplay attackKnown session-specific temporary information attack
Hash-based schemes
Amin et al. [21]
Two-factor
Hash function
Off-line guessing attackSession key disclosure attackFails to preserve forward secrecyKnown session-specific temporary information attack
Xue et al. [22]
Two-factor
Hash function
User anonymityPrivileged insider attackOff-line password guessing attackFails to preserve forward secrecy
Chuang and Chen [23]
Three-factor
Hash function
User impersonation attackSession key discloser attackFails to preserve forward secrecy
Zhou et al. [26]
Two-factor
Hash function
Forgery attackReplay attackFails to preserve forward secrecyKnown session-specific temporary information attackAmong these schemes, the hash-based schemes [21–23, 26] are highly efficient, but they have diverse vulnerabilities, such as desynchronization attack, forgery attack, and failure to achieve forward secrecy and user anonymity. Wang et al. [27, 28] have demonstrated that public key technique is essential for achieving some security attributes such as user anonymity. However, the existing public key cryptosystem-based schemes [18, 20, 25] still have more or less security vulnerabilities due to design deficiencies. Besides, they have high computation overhead as time-consuming operations such as bilinear pairing and scalar multiplication are involved.In addition, the security of the session key is a noteworthy issue. The existing schemes are not secure against various session key exposure attacks. A great many schemes such as the schemes in [20, 21, 25, 26] cannot withstand known session-specific temporary information attack. And many schemes such as the schemes in [21–23, 26] cannot provide forward secrecy. Besides, in some schemes like the scheme of Amin et al. [21], the attacker can even reveal the session key when he obtains the smart card [29].


### 1.2. Motivation and Contributions

The existing schemes suffer from various security defects or involve high computation overhead. The security attributes or the efficiency needs to be improved. In particular, the great majority of schemes fail to guarantee the security of session key, as they are subjected to various session key exposure attacks. It motivates us to present an enhanced authentication scheme that can meet the security requirements at minimum cost and be secure against all the possible session key exposure attacks. We sum up the contributions of the paper as below:(1)
We reveal that Zhou et al.’s scheme [26] does not consider impersonation attack, known session-specific temporary information attack, and forward secrecy.(2)
We put forward an enhanced three-factor authentication scheme using chaotic maps. The session key comprises of a long-term secret value and the secret key generated by Chebyshev chaotic-based Diffie–Hellman key exchange. It can prevent all kinds of session key exposure attacks. The use of Chebyshev chaotic maps contributes to the establishment of secure session key and simultaneously reduces the computation cost.(3)
The Burrows–Abadi–Needham logic proof confirms the completeness of our scheme. The formal analysis under the random oracle model proves the semantic security of session key. And the informal analysis shows that our scheme can resist all kinds of potential attacks and provide desired properties like three-factor secrecy. The performance comparisons demonstrate that our scheme has high security, and its computation and communication overheads are acceptable.


### 1.3. Organization of the Paper

The rest of the paper is formed as below. We give some background materials in Section2. We reveal the security defects of Zhou et al.’s scheme in Section 3. We present the enhanced three-factor authentication scheme in Section 4. We discuss the security of our scheme using several widely accepted security analysis methods in Section 5. We present the performance comparisons of our scheme and related schemes in Section 6. The conclusion is given in Section 7.


## 1.1. Related Works

In terms of authentication schemes for cloud computing, some proposals have been presented one after another to improve the security and efficiency [14–17]. In 2015, Tsai and Lo [18] put forward an anonymous authentication protocol using bilinear pairing, in which the user can directly login the distributed server without the help of control server. Afterwards, He et al. [19] revealed that their scheme is not resistant to server impersonation attack and put forward an enhanced scheme. In 2017, Kumari et al. [20] presented a biometric-based authentication protocol employing elliptic curve cryptosystem (ECC). However, their scheme cannot withstand known session-specific temporary information attack and fails to preserve three-factor secrecy. In 2018, Amin et al. [21] pointed out that two anonymous authentication schemes [22, 23] have weaknesses like forgery attack and session key disclosure attack and introduced a hash-based two-factor authentication scheme. Unfortunately, Wang et al. [24] revealed that their scheme still cannot resist session key disclosure attack. In 2019, Mo et al. [25] introduced an ECC-based single-server two-factor authentication protocol. But this protocol is not resistant to stolen-verifier attack. In the same year, Zhou et al. [26] put forward a two-factor authentication scheme employing hash function. But we observe that their scheme suffers from forgery attack and replay attack and does not preserve forward secrecy. For better understanding, we summarize these schemes in Table 1.Table 1
Related authentication schemes for cloud computing.
Category
Schemes
Authentication factors
Cryptographic primitive
Security limitations
Public key cryptosystem-based schemes
Tsai and Lo [18]
Three-factor
Bilinear pairing
Server impersonation attack
He et al. [19]
Two-factor
Bilinear pairing
Inefficient typo detection
Kumari et al. [20]
Three-factor
Elliptic curve cryptosystem
Known session-specific temporary information attackFails to preserve three-factor secrecy
Mo et al. [25]
Two-factor
Elliptic curve cryptosystem
Stolen-verifier attackForgery attackReplay attackKnown session-specific temporary information attack
Hash-based schemes
Amin et al. [21]
Two-factor
Hash function
Off-line guessing attackSession key disclosure attackFails to preserve forward secrecyKnown session-specific temporary information attack
Xue et al. [22]
Two-factor
Hash function
User anonymityPrivileged insider attackOff-line password guessing attackFails to preserve forward secrecy
Chuang and Chen [23]
Three-factor
Hash function
User impersonation attackSession key discloser attackFails to preserve forward secrecy
Zhou et al. [26]
Two-factor
Hash function
Forgery attackReplay attackFails to preserve forward secrecyKnown session-specific temporary information attackAmong these schemes, the hash-based schemes [21–23, 26] are highly efficient, but they have diverse vulnerabilities, such as desynchronization attack, forgery attack, and failure to achieve forward secrecy and user anonymity. Wang et al. [27, 28] have demonstrated that public key technique is essential for achieving some security attributes such as user anonymity. However, the existing public key cryptosystem-based schemes [18, 20, 25] still have more or less security vulnerabilities due to design deficiencies. Besides, they have high computation overhead as time-consuming operations such as bilinear pairing and scalar multiplication are involved.In addition, the security of the session key is a noteworthy issue. The existing schemes are not secure against various session key exposure attacks. A great many schemes such as the schemes in [20, 21, 25, 26] cannot withstand known session-specific temporary information attack. And many schemes such as the schemes in [21–23, 26] cannot provide forward secrecy. Besides, in some schemes like the scheme of Amin et al. [21], the attacker can even reveal the session key when he obtains the smart card [29].


## 1.2. Motivation and Contributions

The existing schemes suffer from various security defects or involve high computation overhead. The security attributes or the efficiency needs to be improved. In particular, the great majority of schemes fail to guarantee the security of session key, as they are subjected to various session key exposure attacks. It motivates us to present an enhanced authentication scheme that can meet the security requirements at minimum cost and be secure against all the possible session key exposure attacks. We sum up the contributions of the paper as below:(1)
We reveal that Zhou et al.’s scheme [26] does not consider impersonation attack, known session-specific temporary information attack, and forward secrecy.(2)
We put forward an enhanced three-factor authentication scheme using chaotic maps. The session key comprises of a long-term secret value and the secret key generated by Chebyshev chaotic-based Diffie–Hellman key exchange. It can prevent all kinds of session key exposure attacks. The use of Chebyshev chaotic maps contributes to the establishment of secure session key and simultaneously reduces the computation cost.(3)
The Burrows–Abadi–Needham logic proof confirms the completeness of our scheme. The formal analysis under the random oracle model proves the semantic security of session key. And the informal analysis shows that our scheme can resist all kinds of potential attacks and provide desired properties like three-factor secrecy. The performance comparisons demonstrate that our scheme has high security, and its computation and communication overheads are acceptable.


## 1.3. Organization of the Paper

The rest of the paper is formed as below. We give some background materials in Section2. We reveal the security defects of Zhou et al.’s scheme in Section 3. We present the enhanced three-factor authentication scheme in Section 4. We discuss the security of our scheme using several widely accepted security analysis methods in Section 5. We present the performance comparisons of our scheme and related schemes in Section 6. The conclusion is given in Section 7.


## 2. Preliminaries

### 2.1. Chebyshev Chaotic Maps

According to Zhang [30], the enhanced Chebyshev polynomial is defined as Tnx=2xTn−1x−Tn−2xmodp, where n≥2, x∈−∞,+∞, and p is a big prime. The Chebyshev polynomials satisfy commutative law, i.e., TaTbx≡TbTaxmodp.There is a hard mathematical problem on Chebyshev polynomials:(i)
Chebyshev chaotic Diffie–Hellman problem (CHDHP): for givenTax, Tbx, and x, the computation of Tabx≡TaTbx≡TbTaxmodp is infeasible.


### 2.2. Adversary Model

Based on [31], the abilities of adversary are summarized as below:(i)
The adversary can eavesdrop, replay, block, or alter the transmitted messages in open channel(ii)
When testing forward secrecy, the adversary can obtain control server’s master key or cloud server’s secret key(iii)
The adversary can disclose the password or the parameters of smart card(iv)
When testing three-factor secrecy, the adversary is capable of obtaining any two kinds of authentication factors


### 2.3. Notations

The notations of the paper are presented in Table2.Table 2
Notations.
Symbols
Description
CS
Control server
ID
CS
Identity of control server
s
Master key of CS
y
Secret value of CS
U
i
User
ID
i, PWi, bi
Identity, password, biometric of user
PID
i
Pseudoidentity of user
S
j
Cloud server
SID
j
Identity of cloud server
s
m
j
Secret key of cloud server
T
1
,
T
2
,
T
3
,
T
4
Timestamps
SK
Session key
E
k
/
D
k
Symmetric encryption/decryption algorithm with keyk
The string concatenation operation
⊕
The bitwise XOR operation
H
1
Hash function
H
2
Biohash function, on the basis of user’s biometricBi, along with a tokenized random number, it outputs a random string


## 2.1. Chebyshev Chaotic Maps

According to Zhang [30], the enhanced Chebyshev polynomial is defined as Tnx=2xTn−1x−Tn−2xmodp, where n≥2, x∈−∞,+∞, and p is a big prime. The Chebyshev polynomials satisfy commutative law, i.e., TaTbx≡TbTaxmodp.There is a hard mathematical problem on Chebyshev polynomials:(i)
Chebyshev chaotic Diffie–Hellman problem (CHDHP): for givenTax, Tbx, and x, the computation of Tabx≡TaTbx≡TbTaxmodp is infeasible.


## 2.2. Adversary Model

Based on [31], the abilities of adversary are summarized as below:(i)
The adversary can eavesdrop, replay, block, or alter the transmitted messages in open channel(ii)
When testing forward secrecy, the adversary can obtain control server’s master key or cloud server’s secret key(iii)
The adversary can disclose the password or the parameters of smart card(iv)
When testing three-factor secrecy, the adversary is capable of obtaining any two kinds of authentication factors


## 2.3. Notations

The notations of the paper are presented in Table2.Table 2
Notations.
Symbols
Description
CS
Control server
ID
CS
Identity of control server
s
Master key of CS
y
Secret value of CS
U
i
User
ID
i, PWi, bi
Identity, password, biometric of user
PID
i
Pseudoidentity of user
S
j
Cloud server
SID
j
Identity of cloud server
s
m
j
Secret key of cloud server
T
1
,
T
2
,
T
3
,
T
4
Timestamps
SK
Session key
E
k
/
D
k
Symmetric encryption/decryption algorithm with keyk
The string concatenation operation
⊕
The bitwise XOR operation
H
1
Hash function
H
2
Biohash function, on the basis of user’s biometricBi, along with a tokenized random number, it outputs a random string


## 3. Cryptanalysis of Zhou et al.’s Scheme

We briefly review Zhou et al.’s scheme [26] and point out its limitations in this section. In their scheme, the attacker can perform impersonation attack by replaying the intercepted message. Besides, their scheme is vulnerable to two kinds of session key exposure attacks.


### 3.1. Review of Zhou et al.’s Scheme

#### 3.1.1. User Registration Phase

U
i delivers an enrollment request to CS in this phase.Step 1:Ui picks his identity IDi, pseudoidentity PIDi, and password PWi. Then Ui selects a random number ri and calculates Pi=H1PWiri. Afterwards, Ui delivers the registration request IDi,PIDi to CS via the secure channel.Step 2: after gettingIDi,PIDi, CS checks if IDi is valid. If it holds, CS computes Ai=H1PIDiIDCSs and Bi=H1IDis. CS saves IDi in its database and returns Ai,Bi,IDCS to Ui via the secure channel.Step 3: after receivingAi,Bi,IDCS, Ui computes Ci=Ai⊕Pi, Di=Bi⊕H1IDiPi, and Ei=ri⊕H1IDiPWi. Then, Ui stores Ci,Di,Ei,PIDi,IDCS in the memory of a smart card.


#### 3.1.2. Cloud Server Registration Phase

CS distributes the secret key toSj in this phase.Step 1:Sj chooses its identity SIDj and pseudoidentity PSIDj and delivers SIDj,PSIDj to CS via the secure channel.Step 2: after gettingSIDj,PSIDj, CS computes sm1=H1PSIDjIDCSs and sm2=H1SIDjs. CS delivers sm1,sm2,IDCS to Sj via the secure channel.Step 3:Sj keeps sm1,sm2,IDCS as secret.


#### 3.1.3. Login and Authentication Phase

U
i and Sj authenticate each other in the assistance of CS as shown in Figure 1.Step 1:Ui inputs IDi∗ and PWi∗. The smart card picks a new pseudoidentity PIDinew, computes ri∗=Ei⊕H1IDi∗PWi∗, Pi∗=H1PWi∗ri∗, Ai∗=Ci⊕Pi∗, Bi∗=Di⊕H1IDiPi∗, f1=Ai∗⊕α, f2=H1αPIDiIDCS⊕IDi, f3=Bi∗⊕PIDinew⊕H1αIDi, and f4=H1IDiPIDiPIDinewαf3, where α is a nonce. The smart card delivers the login request PIDi,f1,f2,f3,f4 to Sj via the public channel.Step 2: upon receivingPIDi,f1,f2,f3,f4, Sj picks a new pseudoidentity PSIDjnew. Sj computes f5=sm1⊕β, f6=H1βPSIDjIDCS⊕SIDj, f7=sm2⊕PSIDjnew⊕H1βSIDj, and f8=H1SIDjPSIDjPSIDjnewβf7, where β is a random number. Sj sends PIDi,f1,f2,f3,f4,PSIDj,f5,f6,f7,f8 to CS via the public channel.Step 3: after receivingPIDi,f1,f2,f3,f4,PSIDj,f5,f6,f7,f8, CS computes α=f1⊕H1PIDiIDCSs, IDi=f2⊕H1αPIDiIDCS, PIDinew=f3⊕H1IDis⊕H1αIDi, and f4′=H1IDiPIDiPIDinewαf3, and verifies if f4′=f4. If the equation holds, CS computes β=f5⊕H1PSIDjIDCSs, SIDj=f6⊕H1βPSIDjIDCS, PSIDjnew=f7⊕H1SIDjs⊕H1βSIDj, and f8′=H1SIDjPSIDjPSIDjnewβf7, and verifies if f8′=f8. If it holds, proceed next step, otherwise, the protocol aborts.Step 4: CS computesSK=H1α⊕β⊕γ, f9=H1PSIDjnewIDCSs⊕H1βPSIDjnew, f10=H1PSIDjnewβPSIDj⊕α⊕γ, f11=H1SKf9f10H1SIDjs, f12=H1PIDinewIDCSsH1αPIDinew, f13=H1PIDinewαPIDi⊕β⊕γ, and f14=H1SKf12f13H1IDis, where γ is a nonce. CS sends {f9,f10,f11,f12,f13,f14} to Sj.Step 5: after receivingf9,f10,f11,f12,f13,f14, Sj computes α⊕γ=f10⊕H1PSIDjnewβPSIDj, SK=H1α⊕γ⊕β, f11′=H1SKf9f10sm2 and verifies if f11′=f11. If it holds, Sj computes sm1new=f9⊕H1βPSIDjnew. Sj keeps sm1new,PSIDjnew as secret and removes sm1,PSIDj. Sj delivers f12,f13,f14 to Ui.Step 6: after receiving {f12,f13,f14}, the smart card computes β⊕γ=f13⊕H1PIDinewαPIDi, SK=H1α⊕β⊕γ, f14′=H1SKf12f13Bi∗ and checks if f14′=f14. If they are equal, the smart card calculates Cinew=f12⊕H1αPIDinew⊕Pi, stores Cinew,PIDinew, and removes Ci,PIDi.Figure 1
Login and authentication phase of Zhou et al.’s scheme.


### 3.2. Cryptanalysis of Zhou et al.’s Scheme

In this section, we reveal that Zhou et al.’s scheme suffers from replay attack, user impersonation attack, server impersonation attack, and known session-specific temporary information attack and fails to provide forward secrecy.


#### 3.2.1. Forward Secrecy

Forward secrecy ensures that when the long-term secret is compromised, the attacker still cannot reveal the established session key. In Zhou et al.’s scheme, with the master keys, the attacker can reveal SK as follows:Step 1: the attacker interceptsPIDi,f1,f2,f3,f4 and f12,f13,f14 from the public channelStep 2: the attacker computesα=f1⊕H1PIDiIDCSs, IDi=f2⊕H1αPIDiIDCS, PIDinew=f3⊕H1IDis⊕H1αIDi, β⊕γ=f13⊕H1PIDinewαPIDi, and SK=H1α⊕β⊕γWhen the long-term secrets is compromised, all the established session keys will be disclosed.


#### 3.2.2. User Impersonation Attack

User impersonation attack denotes that the attacker can masquerade as a valid user to login the cloud server. This attack is performed as follows:Step 1: the attacker interceptsPIDi,f1,f2,f3,f4 from the public channel and sends this message to Sj.Step 2: upon receivingPIDi,f1,f2,f3,f4, Sj handles this message and sends PIDi,f1,f2,f3,f4,PSIDjnew,f5∗,f6∗,f7∗,f8∗ to CS.Step 3: CS handles the messagePIDi,f1,f2,f3,f4,PSIDjnew,f5∗,f6∗,f7∗,f8∗. As f4′=f4, f8′=f8∗, CS sends back f9∗,f10∗,f11∗,f12∗,f13∗,f14∗ to Sj.Step 4:Sj handles f9∗,f10∗,f11∗,f12∗,f13∗,f14∗. As f11′=f11∗, Sj sends f12∗,f13∗,f14∗ to the attacker.S
j and CS believe that PIDi,f1,f2,f3,f4 comes from the legitimate user Ui. Without compromising the smart card, the attacker can impersonate the user Ui by replaying PIDi,f1,f2,f3,f4. Zhou et al.’s scheme is vulnerable to user impersonation attack.


#### 3.2.3. Server Impersonation Attack

Server impersonation attack denotes that the attacker can masquerade as a valid cloud server to deceive the user. This attack is performed as follows:Step 1: the attacker intercepts the messagePIDi,f1,f2,f3,f4,PSIDj,f5,f6,f7,f8 from the public channel.Step 2: when intercepting a new login requestPIDinew,f1∗,f2∗,f3∗,f4∗ from the public channel, the attacker sends PIDinew,f1∗,f2∗,f3∗,f4∗,PSIDj,f5,f6,f7,f8 to CS.Step 3: CS handlesPIDinew,f1∗,f2∗,f3∗,f4∗,PSIDj,f5,f6,f7,f8. As f4′=f4∗, f8′=f8, CS returns f9∗,f10∗,f11∗,f12∗,f13∗,f14∗ to the attacker.Step 4: the attacker deliversf12∗,f13∗,f14∗ to Ui.Step 5: after receivingf12∗,f13∗,f14∗, as f14′=f14∗, Ui believes that the attacker is the legitimate cloud server Sj.InPIDi,f1,f2,f3,f4,PSIDj,f5,f6,f7,f8 that Sj delivers to CS, PSIDj,f5,f6,f7,f8 is completely independent with PIDi,f1,f2,f3,f4. CS verifies the validity of the two messages independently. It leads that the attacker can impersonate the cloud server by replaying PSIDj,f5,f6,f7,f8.


#### 3.2.4. Known Session-Specific Temporary Information Attack

This attack denotes that when the temporary secret such as random number is compromised, the attacker can reveal the established session key. With the random numberα, the attacker reveals the session key as follows:Step 1: the attacker interceptsPIDi,f1,f2,f3,f4 and f12,f13,f14 from the public channel.Step 2: whenUi generates a new login request using PIDinew and sends PIDinew,f1∗,f2∗,f3∗,f4∗ to Sj. The attacker intercepts PIDinew,f1∗,f2∗,f3∗,f4∗ from the public channel.Step 3: the attacker computesβ⊕γ=f13⊕H1PIDinewαPIDi and SK=H1α⊕β⊕γ.In Zhou et al.’s scheme, if the random numberα is compromised, the attacker can reveal the session key. Zhou et al.’s scheme is vulnerable to known session-specific temporary information attack.


## 3.1. Review of Zhou et al.’s Scheme

### 3.1.1. User Registration Phase

U
i delivers an enrollment request to CS in this phase.Step 1:Ui picks his identity IDi, pseudoidentity PIDi, and password PWi. Then Ui selects a random number ri and calculates Pi=H1PWiri. Afterwards, Ui delivers the registration request IDi,PIDi to CS via the secure channel.Step 2: after gettingIDi,PIDi, CS checks if IDi is valid. If it holds, CS computes Ai=H1PIDiIDCSs and Bi=H1IDis. CS saves IDi in its database and returns Ai,Bi,IDCS to Ui via the secure channel.Step 3: after receivingAi,Bi,IDCS, Ui computes Ci=Ai⊕Pi, Di=Bi⊕H1IDiPi, and Ei=ri⊕H1IDiPWi. Then, Ui stores Ci,Di,Ei,PIDi,IDCS in the memory of a smart card.


### 3.1.2. Cloud Server Registration Phase

CS distributes the secret key toSj in this phase.Step 1:Sj chooses its identity SIDj and pseudoidentity PSIDj and delivers SIDj,PSIDj to CS via the secure channel.Step 2: after gettingSIDj,PSIDj, CS computes sm1=H1PSIDjIDCSs and sm2=H1SIDjs. CS delivers sm1,sm2,IDCS to Sj via the secure channel.Step 3:Sj keeps sm1,sm2,IDCS as secret.


### 3.1.3. Login and Authentication Phase

U
i and Sj authenticate each other in the assistance of CS as shown in Figure 1.Step 1:Ui inputs IDi∗ and PWi∗. The smart card picks a new pseudoidentity PIDinew, computes ri∗=Ei⊕H1IDi∗PWi∗, Pi∗=H1PWi∗ri∗, Ai∗=Ci⊕Pi∗, Bi∗=Di⊕H1IDiPi∗, f1=Ai∗⊕α, f2=H1αPIDiIDCS⊕IDi, f3=Bi∗⊕PIDinew⊕H1αIDi, and f4=H1IDiPIDiPIDinewαf3, where α is a nonce. The smart card delivers the login request PIDi,f1,f2,f3,f4 to Sj via the public channel.Step 2: upon receivingPIDi,f1,f2,f3,f4, Sj picks a new pseudoidentity PSIDjnew. Sj computes f5=sm1⊕β, f6=H1βPSIDjIDCS⊕SIDj, f7=sm2⊕PSIDjnew⊕H1βSIDj, and f8=H1SIDjPSIDjPSIDjnewβf7, where β is a random number. Sj sends PIDi,f1,f2,f3,f4,PSIDj,f5,f6,f7,f8 to CS via the public channel.Step 3: after receivingPIDi,f1,f2,f3,f4,PSIDj,f5,f6,f7,f8, CS computes α=f1⊕H1PIDiIDCSs, IDi=f2⊕H1αPIDiIDCS, PIDinew=f3⊕H1IDis⊕H1αIDi, and f4′=H1IDiPIDiPIDinewαf3, and verifies if f4′=f4. If the equation holds, CS computes β=f5⊕H1PSIDjIDCSs, SIDj=f6⊕H1βPSIDjIDCS, PSIDjnew=f7⊕H1SIDjs⊕H1βSIDj, and f8′=H1SIDjPSIDjPSIDjnewβf7, and verifies if f8′=f8. If it holds, proceed next step, otherwise, the protocol aborts.Step 4: CS computesSK=H1α⊕β⊕γ, f9=H1PSIDjnewIDCSs⊕H1βPSIDjnew, f10=H1PSIDjnewβPSIDj⊕α⊕γ, f11=H1SKf9f10H1SIDjs, f12=H1PIDinewIDCSsH1αPIDinew, f13=H1PIDinewαPIDi⊕β⊕γ, and f14=H1SKf12f13H1IDis, where γ is a nonce. CS sends {f9,f10,f11,f12,f13,f14} to Sj.Step 5: after receivingf9,f10,f11,f12,f13,f14, Sj computes α⊕γ=f10⊕H1PSIDjnewβPSIDj, SK=H1α⊕γ⊕β, f11′=H1SKf9f10sm2 and verifies if f11′=f11. If it holds, Sj computes sm1new=f9⊕H1βPSIDjnew. Sj keeps sm1new,PSIDjnew as secret and removes sm1,PSIDj. Sj delivers f12,f13,f14 to Ui.Step 6: after receiving {f12,f13,f14}, the smart card computes β⊕γ=f13⊕H1PIDinewαPIDi, SK=H1α⊕β⊕γ, f14′=H1SKf12f13Bi∗ and checks if f14′=f14. If they are equal, the smart card calculates Cinew=f12⊕H1αPIDinew⊕Pi, stores Cinew,PIDinew, and removes Ci,PIDi.Figure 1
Login and authentication phase of Zhou et al.’s scheme.


## 3.1.1. User Registration Phase

U
i delivers an enrollment request to CS in this phase.Step 1:Ui picks his identity IDi, pseudoidentity PIDi, and password PWi. Then Ui selects a random number ri and calculates Pi=H1PWiri. Afterwards, Ui delivers the registration request IDi,PIDi to CS via the secure channel.Step 2: after gettingIDi,PIDi, CS checks if IDi is valid. If it holds, CS computes Ai=H1PIDiIDCSs and Bi=H1IDis. CS saves IDi in its database and returns Ai,Bi,IDCS to Ui via the secure channel.Step 3: after receivingAi,Bi,IDCS, Ui computes Ci=Ai⊕Pi, Di=Bi⊕H1IDiPi, and Ei=ri⊕H1IDiPWi. Then, Ui stores Ci,Di,Ei,PIDi,IDCS in the memory of a smart card.


## 3.1.2. Cloud Server Registration Phase

CS distributes the secret key toSj in this phase.Step 1:Sj chooses its identity SIDj and pseudoidentity PSIDj and delivers SIDj,PSIDj to CS via the secure channel.Step 2: after gettingSIDj,PSIDj, CS computes sm1=H1PSIDjIDCSs and sm2=H1SIDjs. CS delivers sm1,sm2,IDCS to Sj via the secure channel.Step 3:Sj keeps sm1,sm2,IDCS as secret.


## 3.1.3. Login and Authentication Phase

U
i and Sj authenticate each other in the assistance of CS as shown in Figure 1.Step 1:Ui inputs IDi∗ and PWi∗. The smart card picks a new pseudoidentity PIDinew, computes ri∗=Ei⊕H1IDi∗PWi∗, Pi∗=H1PWi∗ri∗, Ai∗=Ci⊕Pi∗, Bi∗=Di⊕H1IDiPi∗, f1=Ai∗⊕α, f2=H1αPIDiIDCS⊕IDi, f3=Bi∗⊕PIDinew⊕H1αIDi, and f4=H1IDiPIDiPIDinewαf3, where α is a nonce. The smart card delivers the login request PIDi,f1,f2,f3,f4 to Sj via the public channel.Step 2: upon receivingPIDi,f1,f2,f3,f4, Sj picks a new pseudoidentity PSIDjnew. Sj computes f5=sm1⊕β, f6=H1βPSIDjIDCS⊕SIDj, f7=sm2⊕PSIDjnew⊕H1βSIDj, and f8=H1SIDjPSIDjPSIDjnewβf7, where β is a random number. Sj sends PIDi,f1,f2,f3,f4,PSIDj,f5,f6,f7,f8 to CS via the public channel.Step 3: after receivingPIDi,f1,f2,f3,f4,PSIDj,f5,f6,f7,f8, CS computes α=f1⊕H1PIDiIDCSs, IDi=f2⊕H1αPIDiIDCS, PIDinew=f3⊕H1IDis⊕H1αIDi, and f4′=H1IDiPIDiPIDinewαf3, and verifies if f4′=f4. If the equation holds, CS computes β=f5⊕H1PSIDjIDCSs, SIDj=f6⊕H1βPSIDjIDCS, PSIDjnew=f7⊕H1SIDjs⊕H1βSIDj, and f8′=H1SIDjPSIDjPSIDjnewβf7, and verifies if f8′=f8. If it holds, proceed next step, otherwise, the protocol aborts.Step 4: CS computesSK=H1α⊕β⊕γ, f9=H1PSIDjnewIDCSs⊕H1βPSIDjnew, f10=H1PSIDjnewβPSIDj⊕α⊕γ, f11=H1SKf9f10H1SIDjs, f12=H1PIDinewIDCSsH1αPIDinew, f13=H1PIDinewαPIDi⊕β⊕γ, and f14=H1SKf12f13H1IDis, where γ is a nonce. CS sends {f9,f10,f11,f12,f13,f14} to Sj.Step 5: after receivingf9,f10,f11,f12,f13,f14, Sj computes α⊕γ=f10⊕H1PSIDjnewβPSIDj, SK=H1α⊕γ⊕β, f11′=H1SKf9f10sm2 and verifies if f11′=f11. If it holds, Sj computes sm1new=f9⊕H1βPSIDjnew. Sj keeps sm1new,PSIDjnew as secret and removes sm1,PSIDj. Sj delivers f12,f13,f14 to Ui.Step 6: after receiving {f12,f13,f14}, the smart card computes β⊕γ=f13⊕H1PIDinewαPIDi, SK=H1α⊕β⊕γ, f14′=H1SKf12f13Bi∗ and checks if f14′=f14. If they are equal, the smart card calculates Cinew=f12⊕H1αPIDinew⊕Pi, stores Cinew,PIDinew, and removes Ci,PIDi.Figure 1
Login and authentication phase of Zhou et al.’s scheme.


## 3.2. Cryptanalysis of Zhou et al.’s Scheme

In this section, we reveal that Zhou et al.’s scheme suffers from replay attack, user impersonation attack, server impersonation attack, and known session-specific temporary information attack and fails to provide forward secrecy.


### 3.2.1. Forward Secrecy

Forward secrecy ensures that when the long-term secret is compromised, the attacker still cannot reveal the established session key. In Zhou et al.’s scheme, with the master keys, the attacker can reveal SK as follows:Step 1: the attacker interceptsPIDi,f1,f2,f3,f4 and f12,f13,f14 from the public channelStep 2: the attacker computesα=f1⊕H1PIDiIDCSs, IDi=f2⊕H1αPIDiIDCS, PIDinew=f3⊕H1IDis⊕H1αIDi, β⊕γ=f13⊕H1PIDinewαPIDi, and SK=H1α⊕β⊕γWhen the long-term secrets is compromised, all the established session keys will be disclosed.


### 3.2.2. User Impersonation Attack

User impersonation attack denotes that the attacker can masquerade as a valid user to login the cloud server. This attack is performed as follows:Step 1: the attacker interceptsPIDi,f1,f2,f3,f4 from the public channel and sends this message to Sj.Step 2: upon receivingPIDi,f1,f2,f3,f4, Sj handles this message and sends PIDi,f1,f2,f3,f4,PSIDjnew,f5∗,f6∗,f7∗,f8∗ to CS.Step 3: CS handles the messagePIDi,f1,f2,f3,f4,PSIDjnew,f5∗,f6∗,f7∗,f8∗. As f4′=f4, f8′=f8∗, CS sends back f9∗,f10∗,f11∗,f12∗,f13∗,f14∗ to Sj.Step 4:Sj handles f9∗,f10∗,f11∗,f12∗,f13∗,f14∗. As f11′=f11∗, Sj sends f12∗,f13∗,f14∗ to the attacker.S
j and CS believe that PIDi,f1,f2,f3,f4 comes from the legitimate user Ui. Without compromising the smart card, the attacker can impersonate the user Ui by replaying PIDi,f1,f2,f3,f4. Zhou et al.’s scheme is vulnerable to user impersonation attack.


### 3.2.3. Server Impersonation Attack

Server impersonation attack denotes that the attacker can masquerade as a valid cloud server to deceive the user. This attack is performed as follows:Step 1: the attacker intercepts the messagePIDi,f1,f2,f3,f4,PSIDj,f5,f6,f7,f8 from the public channel.Step 2: when intercepting a new login requestPIDinew,f1∗,f2∗,f3∗,f4∗ from the public channel, the attacker sends PIDinew,f1∗,f2∗,f3∗,f4∗,PSIDj,f5,f6,f7,f8 to CS.Step 3: CS handlesPIDinew,f1∗,f2∗,f3∗,f4∗,PSIDj,f5,f6,f7,f8. As f4′=f4∗, f8′=f8, CS returns f9∗,f10∗,f11∗,f12∗,f13∗,f14∗ to the attacker.Step 4: the attacker deliversf12∗,f13∗,f14∗ to Ui.Step 5: after receivingf12∗,f13∗,f14∗, as f14′=f14∗, Ui believes that the attacker is the legitimate cloud server Sj.InPIDi,f1,f2,f3,f4,PSIDj,f5,f6,f7,f8 that Sj delivers to CS, PSIDj,f5,f6,f7,f8 is completely independent with PIDi,f1,f2,f3,f4. CS verifies the validity of the two messages independently. It leads that the attacker can impersonate the cloud server by replaying PSIDj,f5,f6,f7,f8.


### 3.2.4. Known Session-Specific Temporary Information Attack

This attack denotes that when the temporary secret such as random number is compromised, the attacker can reveal the established session key. With the random numberα, the attacker reveals the session key as follows:Step 1: the attacker interceptsPIDi,f1,f2,f3,f4 and f12,f13,f14 from the public channel.Step 2: whenUi generates a new login request using PIDinew and sends PIDinew,f1∗,f2∗,f3∗,f4∗ to Sj. The attacker intercepts PIDinew,f1∗,f2∗,f3∗,f4∗ from the public channel.Step 3: the attacker computesβ⊕γ=f13⊕H1PIDinewαPIDi and SK=H1α⊕β⊕γ.In Zhou et al.’s scheme, if the random numberα is compromised, the attacker can reveal the session key. Zhou et al.’s scheme is vulnerable to known session-specific temporary information attack.


## 3.2.1. Forward Secrecy

Forward secrecy ensures that when the long-term secret is compromised, the attacker still cannot reveal the established session key. In Zhou et al.’s scheme, with the master keys, the attacker can reveal SK as follows:Step 1: the attacker interceptsPIDi,f1,f2,f3,f4 and f12,f13,f14 from the public channelStep 2: the attacker computesα=f1⊕H1PIDiIDCSs, IDi=f2⊕H1αPIDiIDCS, PIDinew=f3⊕H1IDis⊕H1αIDi, β⊕γ=f13⊕H1PIDinewαPIDi, and SK=H1α⊕β⊕γWhen the long-term secrets is compromised, all the established session keys will be disclosed.


## 3.2.2. User Impersonation Attack

User impersonation attack denotes that the attacker can masquerade as a valid user to login the cloud server. This attack is performed as follows:Step 1: the attacker interceptsPIDi,f1,f2,f3,f4 from the public channel and sends this message to Sj.Step 2: upon receivingPIDi,f1,f2,f3,f4, Sj handles this message and sends PIDi,f1,f2,f3,f4,PSIDjnew,f5∗,f6∗,f7∗,f8∗ to CS.Step 3: CS handles the messagePIDi,f1,f2,f3,f4,PSIDjnew,f5∗,f6∗,f7∗,f8∗. As f4′=f4, f8′=f8∗, CS sends back f9∗,f10∗,f11∗,f12∗,f13∗,f14∗ to Sj.Step 4:Sj handles f9∗,f10∗,f11∗,f12∗,f13∗,f14∗. As f11′=f11∗, Sj sends f12∗,f13∗,f14∗ to the attacker.S
j and CS believe that PIDi,f1,f2,f3,f4 comes from the legitimate user Ui. Without compromising the smart card, the attacker can impersonate the user Ui by replaying PIDi,f1,f2,f3,f4. Zhou et al.’s scheme is vulnerable to user impersonation attack.


## 3.2.3. Server Impersonation Attack

Server impersonation attack denotes that the attacker can masquerade as a valid cloud server to deceive the user. This attack is performed as follows:Step 1: the attacker intercepts the messagePIDi,f1,f2,f3,f4,PSIDj,f5,f6,f7,f8 from the public channel.Step 2: when intercepting a new login requestPIDinew,f1∗,f2∗,f3∗,f4∗ from the public channel, the attacker sends PIDinew,f1∗,f2∗,f3∗,f4∗,PSIDj,f5,f6,f7,f8 to CS.Step 3: CS handlesPIDinew,f1∗,f2∗,f3∗,f4∗,PSIDj,f5,f6,f7,f8. As f4′=f4∗, f8′=f8, CS returns f9∗,f10∗,f11∗,f12∗,f13∗,f14∗ to the attacker.Step 4: the attacker deliversf12∗,f13∗,f14∗ to Ui.Step 5: after receivingf12∗,f13∗,f14∗, as f14′=f14∗, Ui believes that the attacker is the legitimate cloud server Sj.InPIDi,f1,f2,f3,f4,PSIDj,f5,f6,f7,f8 that Sj delivers to CS, PSIDj,f5,f6,f7,f8 is completely independent with PIDi,f1,f2,f3,f4. CS verifies the validity of the two messages independently. It leads that the attacker can impersonate the cloud server by replaying PSIDj,f5,f6,f7,f8.


## 3.2.4. Known Session-Specific Temporary Information Attack

This attack denotes that when the temporary secret such as random number is compromised, the attacker can reveal the established session key. With the random numberα, the attacker reveals the session key as follows:Step 1: the attacker interceptsPIDi,f1,f2,f3,f4 and f12,f13,f14 from the public channel.Step 2: whenUi generates a new login request using PIDinew and sends PIDinew,f1∗,f2∗,f3∗,f4∗ to Sj. The attacker intercepts PIDinew,f1∗,f2∗,f3∗,f4∗ from the public channel.Step 3: the attacker computesβ⊕γ=f13⊕H1PIDinewαPIDi and SK=H1α⊕β⊕γ.In Zhou et al.’s scheme, if the random numberα is compromised, the attacker can reveal the session key. Zhou et al.’s scheme is vulnerable to known session-specific temporary information attack.


## 4. The Proposed Scheme

A robust three-factor authentication scheme for cloud computing is put forward in this section. The proposed scheme is described as below.


### 4.1. System Setup Phase

CS picks its master keys. CS also selects a nonce y as its secret value. CS picks a hash function H1 and a symmetric cryptosystem Ek/Dk. In addition, CS publishes the Chebyshev polynomial’s parameters x,p.


### 4.2. User Registration Phase

U
i transmits the enrollment request to CS in this phase, as shown in Figure 2.Step 1:Ui selects his identity IDi and password PWi as he wishes, imprints his biometric bi, and calculates Ai=H1PWiH2bi. Then, Ui delivers {IDi,Ai} to CS through the secure channel.Step 2: after receiving {IDi,Ai}, CS picks two random numbers ti,r1, calculates Ci=H1sIDi, Di=Ai⊕Ci, Zi=H1Ai⊕IDimodμ, and PIDi=EyIDir1, where the integer μ satisfies 28≤μ≤210. CS saves IDi,ti,Counter=0 into its database. Moreover, CS stores parameters Di,Zi,PIDi,ti,H1yr1,μ in a smart card and delivers it to Ui.Figure 2
User registration phase.


### 4.3. Cloud Server Registration Phase

CS issues the secret key toSj in this phase.Step 1:Sj delivers its identity SIDj to CS through the secure channel.Step 2: after receivingSIDj, CS calculates smj=H1SIDjs. CS sends back smj to Sj through the secure channel.Step 3:Sj keeps smj as secret.


### 4.4. Login and Authentication Phase

U
i and Sj perform mutual authentication by the aide of CS in this phase, as shown in Figure 3.Step 1:Ui inputs his identity IDi∗ and password PWi∗ and imprints the biometric bi∗. Then, the smart card calculates Ai∗=H1PWi∗H2bi∗ and Zi∗=H1Ai∗⊕IDi∗modμ and verifies whether Zi∗ is equal to Zi. If it holds, the smart card calculates Oi=ti⊕H1T1H1yr1, Ci∗=Di⊕Ai∗, Ri=Tαx, and Li=H1IDi∗Ci∗RiSIDjOiT1, where α is a nonce and T1 is the current timestamp. PIDi,Ri,Li,Oi,T1 is delivered to Sj through the open channel.Step 2: after gettingPIDi,Ri,Li,Oi,T1, Sj verifies whether T1 is fresh. If it holds, Sj generates a random number β and calculates RS=Tβx, Gi=H1PIDiRiRSsmjT2, Qi=H1smjRi, and Ni=EQiRSGi, where T2 is the current timestamp. Sj sends PIDi,Ri,Li,Oi,T1,Ni,T2 to CS via the public channel.Step 3: after receivingPIDi,Ri,Li,Oi,T1,Ni,T2, CS checks the freshness of T2 and computes IDir1′=DyPIDi, ti′=Oi⊕H1T1H1yr1′, Ci=H1sIDi, and Li′=H1IDiCiRiSIDjOiT1 and verifies ti′=?ti, Li′=?Li. If ti′=ti, Li′≠Li, the smart card is probably compromised. For the item IDi,ti,Counter, CS performs Counter=Counter+1. When it reaches the preset value, CS suspends Ui. If ti′=ti, Li′=Li, CS believes the authenticity of Ui and performs the next step.Step 4: CS computessmj=H1SIDjs, Qi=H1smjRi, RS′Gi′=DQiNi, and Gi″=H1PIDiRiRS′smjT2, and verifies Gi′⊕Gi″. If it holds, CS believes the authenticity of Sj. Otherwise, the protocol terminates.Step 5: CS picks a noncer2, computes PIDinew=EyIDir2, Ki=H1CiRi, Fi=EKiQiRS′PIDinew, and M1=H1smjRiFiT3, where T3 is the current timestamp. CS transmits Fi,M1,T3 to Sj through the open channel.Step 6: after gettingFi,M1,T3, Sj checks the freshness of T3 and computes M1′=H1smjRiFiT3, and verifies M1′=?M1. If they are equal, Sj authenticates the user Ui successfully. Sj computes Ei=TβRi, SK=H1EiQi, and M2=H1SKFiQiT4. Sj transmits Fi,M2,T4 to Ui via the public channel.Step 7: upon receivingFi,M2,T4, the smart card checks the freshness of T4. Then, the smart card computes Ki=H1Ci∗Ri, Qi′RS″PIDinew=DKiFi, Ei=TαRS″, SK=H1EiQi′, and M2′=H1SKFiQi′T4, and checks M2′=?M2. If it holds, Ui authenticates the cloud server Sj successfully. The smart card replaces PIDi with PIDinew in the memory.Figure 3
Login and authentication phase of the proposed scheme.


### 4.5. Password Update Phase

The original password is replaced by a new password in this phase.Step 1:Ui enters IDi∗ and PWi∗ and imprints bi∗. The smart card calculates Ai∗=H1PWi∗H2bi∗ and Zi∗=H1Ai∗⊕IDi∗modμ, and verifies whether Zi∗ is equal to Zi. If they are not equal, the protocol terminates.Step 2:Ui keys a new password PWinew. The smart card computes Ainew=H1PWinewH2bi∗, Zinew=H1Ainew⊕IDi∗modμ, and Dinew=Di⊕Ai∗⊕Ainew. The smart card replaces Zi,Di, with Zinew, Dinew.


## 4.1. System Setup Phase

CS picks its master keys. CS also selects a nonce y as its secret value. CS picks a hash function H1 and a symmetric cryptosystem Ek/Dk. In addition, CS publishes the Chebyshev polynomial’s parameters x,p.


## 4.2. User Registration Phase

U
i transmits the enrollment request to CS in this phase, as shown in Figure 2.Step 1:Ui selects his identity IDi and password PWi as he wishes, imprints his biometric bi, and calculates Ai=H1PWiH2bi. Then, Ui delivers {IDi,Ai} to CS through the secure channel.Step 2: after receiving {IDi,Ai}, CS picks two random numbers ti,r1, calculates Ci=H1sIDi, Di=Ai⊕Ci, Zi=H1Ai⊕IDimodμ, and PIDi=EyIDir1, where the integer μ satisfies 28≤μ≤210. CS saves IDi,ti,Counter=0 into its database. Moreover, CS stores parameters Di,Zi,PIDi,ti,H1yr1,μ in a smart card and delivers it to Ui.Figure 2
User registration phase.


## 4.3. Cloud Server Registration Phase

CS issues the secret key toSj in this phase.Step 1:Sj delivers its identity SIDj to CS through the secure channel.Step 2: after receivingSIDj, CS calculates smj=H1SIDjs. CS sends back smj to Sj through the secure channel.Step 3:Sj keeps smj as secret.


## 4.4. Login and Authentication Phase

U
i and Sj perform mutual authentication by the aide of CS in this phase, as shown in Figure 3.Step 1:Ui inputs his identity IDi∗ and password PWi∗ and imprints the biometric bi∗. Then, the smart card calculates Ai∗=H1PWi∗H2bi∗ and Zi∗=H1Ai∗⊕IDi∗modμ and verifies whether Zi∗ is equal to Zi. If it holds, the smart card calculates Oi=ti⊕H1T1H1yr1, Ci∗=Di⊕Ai∗, Ri=Tαx, and Li=H1IDi∗Ci∗RiSIDjOiT1, where α is a nonce and T1 is the current timestamp. PIDi,Ri,Li,Oi,T1 is delivered to Sj through the open channel.Step 2: after gettingPIDi,Ri,Li,Oi,T1, Sj verifies whether T1 is fresh. If it holds, Sj generates a random number β and calculates RS=Tβx, Gi=H1PIDiRiRSsmjT2, Qi=H1smjRi, and Ni=EQiRSGi, where T2 is the current timestamp. Sj sends PIDi,Ri,Li,Oi,T1,Ni,T2 to CS via the public channel.Step 3: after receivingPIDi,Ri,Li,Oi,T1,Ni,T2, CS checks the freshness of T2 and computes IDir1′=DyPIDi, ti′=Oi⊕H1T1H1yr1′, Ci=H1sIDi, and Li′=H1IDiCiRiSIDjOiT1 and verifies ti′=?ti, Li′=?Li. If ti′=ti, Li′≠Li, the smart card is probably compromised. For the item IDi,ti,Counter, CS performs Counter=Counter+1. When it reaches the preset value, CS suspends Ui. If ti′=ti, Li′=Li, CS believes the authenticity of Ui and performs the next step.Step 4: CS computessmj=H1SIDjs, Qi=H1smjRi, RS′Gi′=DQiNi, and Gi″=H1PIDiRiRS′smjT2, and verifies Gi′⊕Gi″. If it holds, CS believes the authenticity of Sj. Otherwise, the protocol terminates.Step 5: CS picks a noncer2, computes PIDinew=EyIDir2, Ki=H1CiRi, Fi=EKiQiRS′PIDinew, and M1=H1smjRiFiT3, where T3 is the current timestamp. CS transmits Fi,M1,T3 to Sj through the open channel.Step 6: after gettingFi,M1,T3, Sj checks the freshness of T3 and computes M1′=H1smjRiFiT3, and verifies M1′=?M1. If they are equal, Sj authenticates the user Ui successfully. Sj computes Ei=TβRi, SK=H1EiQi, and M2=H1SKFiQiT4. Sj transmits Fi,M2,T4 to Ui via the public channel.Step 7: upon receivingFi,M2,T4, the smart card checks the freshness of T4. Then, the smart card computes Ki=H1Ci∗Ri, Qi′RS″PIDinew=DKiFi, Ei=TαRS″, SK=H1EiQi′, and M2′=H1SKFiQi′T4, and checks M2′=?M2. If it holds, Ui authenticates the cloud server Sj successfully. The smart card replaces PIDi with PIDinew in the memory.Figure 3
Login and authentication phase of the proposed scheme.


## 4.5. Password Update Phase

The original password is replaced by a new password in this phase.Step 1:Ui enters IDi∗ and PWi∗ and imprints bi∗. The smart card calculates Ai∗=H1PWi∗H2bi∗ and Zi∗=H1Ai∗⊕IDi∗modμ, and verifies whether Zi∗ is equal to Zi. If they are not equal, the protocol terminates.Step 2:Ui keys a new password PWinew. The smart card computes Ainew=H1PWinewH2bi∗, Zinew=H1Ainew⊕IDi∗modμ, and Dinew=Di⊕Ai∗⊕Ainew. The smart card replaces Zi,Di, with Zinew, Dinew.


## 5. Security Analysis

In this section, Burrows–Abadi–Needham (BAN) logic [32] proof demonstrates the completeness of our scheme. The formal analysis under the random oracle model shows that our scheme provides semantic security. Moreover, the informal analysis proves that our scheme is not susceptible to known attacks.


### 5.1. BAN Logic Proof

We confirm the correctness of our scheme in this section. Table3 lists the notations and rules of BAN logic.Table 3
The notations and rules in BAN logic.
Symbols
Description
P, Q
The principals
X
A statement
P
⊲
X
P see X, P gets a message that consists of X
P
∼
X
P said X, P sent a message that consists of X
P
≡
X
P is convinced that X is true
P
⟹
X
P has jurisdiction over X
P
⟷
K
Q
K is a secret shared by P and Q
X
K
X is combined with a secret K
X
K
X is encrypted with a key K
#
X
X is fresh
Belief rule
P
≡
Q
≡
X
,
Y
/
P
≡
Q
≡
X
Message meaning rule (Rule 1)
P
≡
P
⟷
K
Q
,
P
⊲
X
K
/
P
≡
Q
∼
X or P≡P⟷KQ,P⊲XK/P≡Q∼X
Nonce-verification rule (Rule 2)
P
≡
#
X
,
P
≡
Q
∼
X
/
P
≡
Q
≡
X
Jurisdiction rule (Rule 3)
P
≡
Q
⟹
X
,
P
≡
Q
≡
X
/
P
≡
XOur scheme ought to fulfil the goals as below.Goal 1:Sj≡Ui≡Ui⟷SKSjGoal 2:Sj≡Ui⟷SKSjGoal 3:Ui≡Sj≡Ui⟷SKSjGoal 4:Ui≡Ui⟷SKSjWe idealize our scheme as below:M1:Ui⟶SjIDi,Ui≡Ri,T1CiM2a:Sj⟶CSIDi,Ui≡Ri,T1CiM2b:Sj⟶CSPIDi,Ri,RS,T2smj,RsQiM3:CS⟶SjUi⟷QiSj,RS,PIDinew,RiKi,Ui≡Ri,Fi,T3smjM4a:Sj⟶UiUi⟷QiSj,RS,PIDinew,RiKiM4b:Sj⟶UiUi⟷SKSj,Fi,T4QiThe analysis of our scheme is based on the following initial assumptions:A1:CS≡Ui⟷CiCSA2:CS≡#T1A3:CS≡Ui⇒Ui≡RiA4:Sj≡CS⟷smjSjA5:Sj≡#T3A6:Sj≡CS⇒Ui≡RiA7:Sj≡Ui⇒Ui⟷SKSjA8:Ui≡Ui⟷KiCSA9:Ui≡#RiA10:Ui≡CS⇒Ui⟷QiSjA11:Ui≡#T4A12:Ui≡Sj⇒Ui⟷SKSjThe analysis of the proposed scheme is as follows.According to M2a, we get(1)
CS⊲IDi,Ui≡Ri,T1CiFrom (1), A1, applying Rule 1, we get(2)
CS≡Ui∼IDi,Ui≡Ri,T1From (2), A2, applying Rule 2, we get(3)
CS≡Ui≡Ui≡RiFrom (3), A3, applying Rule 3, we get(4)
CS≡Ui≡RiAccording to M3, we get(5)
Sj⊲Ui≡Ri,Fi,T3smjFrom (5), A4, applying Rule 1, we get(6)
Sj≡CS∼Ui≡Ri,Fi,T3From (6), A5, applying Rule 2, we get(7)
Sj≡CS≡Ui≡RiFrom (7), A6, applying Rule 3, we get(8)
Sj≡Ui≡RiFrom (8), andSK=H1TβRiH1smjRi, we get(9)
Sj≡Ui≡Ui⟷SKSj Goal 1From (9), A7, applying Rule 3, we get(10)
Sj≡Ui⟷SKSj Goal 2According to M4a, we get(11)
Ui⊲Ui⟷QiSj,RS,PIDnew,RiKiFrom (11), A8, applying Rule 1, we get(12)
Ui≡CS∼Ui⟷QiSj,RS,PIDnew,RiFrom (12), A9, applying Rule 2, we get(13)
Ui≡CS≡Ui⟷QiSjFrom (13), A10, applying Rule 3, we get(14)
Ui≡Ui⟷QiSjAccording to M4b, we get(15)
Ui⊲Ui⟷SKSj,Fi,T4QiFrom (14), (15), applying Rule 1, we get(16)
Ui≡Sj∼Ui⟷SKSj,Fi,T4From (16), A11, applying Rule 2, we get(17)
Ui≡Sj≡Ui⟷SKSj Goal 3From (17), A12, applying Rule 3, we get(18)
Ui≡Ui⟷SKSj Goal 4


### 5.2. Formal Security Analysis

Based on the security model of two-factor authentication presented by Wang and Wang [33], we put forward a security model of three-factor authentication for cloud computing. Afterwards, we prove the semantic security of our scheme in this model.


#### 5.2.1. Formal Security Model

(1) Participants. There are multiple instances of the control server CS, the cloud server Sj, and the user Ui in the authentication scheme for cloud computing. We use CSa, Sja, and Uia to denote these instances.(2) Queries. The attacker is capable of making the queries as follows:ExecuteCSa/Sja/Uia: by making this query, the attacker can obtain the messages delivered via the open channel.SendCSa/Sja/Uia,m: by making this query, the attacker can impersonate the principal Uia,Sja,GWNa to send a message m. If m is valid, a response is sent back to the attacker.RevealSja/Uia: by making this query, the attacker can get the session key of Sja/Uia, if the principal involves a session key.CorruptUia,τ: by making this query, the attacker is capable of getting one or two types of user authentication information.Whenτ=1, the attacker acquires the password.Whenτ=2, the attacker acquires the smart card.Whenτ=3, the attacker acquires the biometric.CorruptSja/CSa: by making this query, the attacker can obtain cloud server’s secret key or CS’s master key. This oracle corresponds to the forward secrecy.TestSja/Uia: if the principal is fresh (see below) and involves a session key SK, the oracle spins a coin b. When b=1, it sends back SK to the attacker. When b=0, it sends back a random string to the attacker. This oracle is used to simulate the semantic security of session key. The attacker is capable of asking this query only once.(3) Freshness. We say Sja/Uia is fresh, if the following conditions are met:(1)
S
j
a
/
U
i
a is accepted and involves a SK
(2)
The attacker never makes CorruptSja/CSa or Reveal Sja/Uia query(4) Semantic Security. After making the above queries, the attacker tries to reveal the value of b in test query. The advantage of the attacker in breaking the semantic security is defined as follows:(1)AdvPakeA=2Prb′=b−1.If for all the attackers,AdvPakeA is negligible, the authentication scheme provides semantic security.


#### 5.2.2. Formal Security Analysis

Theorem 1.
Let the password spaceDPW be subject to Zipf distribution [34]. A polynomial-time attacker A runs against our scheme. We presume A can ask less than qe Execute queries, qs Send queries, qb Biohash queries, qh Hash queries, and qε Encryption/Decryption queries. We have(2)AdvPakeA≤2C′∗qss′+qs+qe2p+6qs+qh22l1+2qs+qb22l2+qε22l3+2qhAdvPCHDHP,where l1,l2,l3 are the length of hash output, bio-hash output, and symmetric encryption output, respectively. AdvPCHDHP is the advantage of A in solving CHDHP. When using the Tianya password distribution [34], we have DPW≈13million, C′=0.062239, and s′=0.155478.Proof.
In order to obtainAdvPakeA, we define the games Φi 0≤i≤6, where Φ0 corresponds to the real attack. Prχi is the advantage of A in revealing b in game Gi.Φ0: as it simulates the real attack, we get,(3)AdvPakeA=2Prχ0−1.Φ1: in this game, a hash list ΛH is used to simulate the hash oracle. A biohash list ΛBH is used to simulate the biohash oracle. And an encryption/decryption list Λε is used to simulate the encryption/decryption oracle. For a hash query H1α, if the hash value of α already exists in ΛH, the oracle sends back the hash value. Otherwise, the oracle selects a nonce β as the answer of H1α and stores α,β in ΛH. The biohash oracle is performed in the similar way. For an encryption query Ekφ, the oracle firstly uses φ and k to search Λε, If there exists an tuple k,φ,ω, it answers ω. Otherwise, it sends back a random string ω to the adversary and stores k,φ,ω in Λε. For an decryption query Dkω, the oracle uses ω and k to search Λε. If there exists a tuple k,φ,ω, it answers φ. Otherwise, it sends back a random string φ to the adversary, and stores k,φ,ω in Λε. Φ1 is indistinguishable from Φ0. We get(4)Prχ0−Prχ1=0.Φ2: in this game, we terminate the execution when encountering some collisions.(1)
The collision occurs on the outputs of hash function or biohash function with the probability ofqh2/2l1+1+qb2/2l2+1(2)
The collision occurs on the outputs of symmetric encryption with the probability ofqε2/2l3+1(3)
The collision occurs on the transcripts of messages, with the probability ofqs+qe2/2pWe get(5)Prχ1−Prχ2≤qh22l1+1+qb22l2+1+qε22l3+1+qs+qe22p.Φ3: in this game, we terminate the execution when A guesses Li,Gi,M1,M2. The probability is at most qs/2l1. We get(6)Prχ3−Prχ2≤qs2l1.Φ4: in this game, we terminate the execution when A guesses user’s authentication value Ci. The probability is less than qs/2l1. We obtain(7)Prχ4−Prχ3≤qs2l1.Φ5: in this game, we terminate the execution when A has computed Ci with the help of Corrupt Uia,z.(1)
When CorruptUia,z=1,2, A is able to guess the biometric with the probability of qs/2l1(2)
When CorruptUia,z=2,3, A is able to guess the password with the probability of C′∗qss′.(3)
When CorruptUia,z=1,3, A is able to guess Di with the probability of qs/2l1.We obtain(8)Prχ5−Prχ4≤qs2l1+C′∗qss′+qs2l1.Φ6: we use the private hash oracle H1′ rather than the hash oracle H1 to compute the session key. A knows nothing about H1′. Thus, we have(9)Prχ6=12.Φ6: it is indistinguishable from Φ5, unless a hash query H1EiQi is made by A. We use Γ1 to denote this event. We have(10)Prχ6−Prχ5≤PrΓ1.If the hash queryH1EiQi has been asked, by selecting randomly in ΛH, we can obtain Ei=TαRS=TβRi with the probability of 1/qh. We get(11)PrΓ1≤qhAdvPCHDHP.From (3)–(11), we have(12)AdvPakeA≤2C′∗qss′+qs+qe2p+6qs+qh22l1+2qs+qb22l2+qε22l3+2qhAdvPCHDHP.


### 5.3. Informal Security Analysis

In this section, we prove that our scheme is resistant to diverse attacks. Particularly, our scheme is secure against all kinds of session key exposure attacks, as the session key is generated based on the long-term secret and Chebyshev chaotic-based Diffie–Hellman key exchange. Besides, we demonstrate that the proposed scheme preserves desired properties such as user anonymity and three-factor secrecy.


#### 5.3.1. User Anonymity

In our scheme, only the control server who has the secret keyy can retrieve IDi from PIDi. In addition, after authenticating Ui, CS generates a new pseudoidentity PIDinew and delivers the encrypted PIDinew to Ui. PIDinew is encrypted with the secret key Ki by CS. Only Ui is able to compute Ki and obtain PIDinew. The attacker knows nothing about PIDinew, and hence he cannot link PIDinew with PIDi. It makes the user identity untraceable. Consequently, our scheme achieves user anonymity.


#### 5.3.2. Resistance to Off-Line Guessing Attack

As the fuzzy verifierZi is employed in our scheme as suggested in [33], even if the attacker obtains the smart card as well as biometric at the same time, he is unable to reveal the password. With the smart card and biometric, the attacker chooses one pair of identity and password from dictionary space and checks if Zi∗=Zi. However, there are a great many candidates conforming to Zi∗=Zi. In order to distinguish the correct one from so many candidates, there is no alternative but to launch online guessing attack. However, we employ the “honeywords” technique [33] to prevent this attack. When the number of online guessing attacks reaches the preset value, for example, 10, Ui is suspended. Consequently, our scheme can resist off-line guessing attack.


#### 5.3.3. Resistance to Session Key Disclosure Attack

The session keySK is computed using Ei and Qi. Ei is the secret key generated by the Chebyshev chaotic-based Diffie–Hellman key exchange. Only Ui and Sj who know the random number α or β are able to compute Ei. Qi is computed based on the long-term secret smj. Only Sj and CS who have smj are able to compute Qi. Besides, Qi is transmitted to Ui by means of symmetric encryption with the secret key H1CiRi. Only Ui and CS who have Ci are able to reveal Qi. Both Ei and Qi are unavailable to the attacker. Therefore, our scheme can resist this attack.


#### 5.3.4. Forward Secrecy

Suppose that the attacker has acquired the master keys, he is able to compute Qi. However, Ei is the secret key generated by the Chebyshev chaotic-based Diffie–Hellman key exchange. To reveal Ei, there is no alternative but to solve the CHDHP. Therefore, our scheme preserves forward secrecy.


#### 5.3.5. Resistance to Session-Specific Temporary Information Attack

Assume that the attacker has acquired the random numberα. To compute Ei=TαRs, Rs is required. RS is encrypted using the secret key Qi or Ki, where Qi=H1smjRi and Ki=H1CiRi. To retrieve RS, the attacker needs to reveal Ci or smj. Assume that the attacker has acquired the random number β, the attacker can calculate Ei=TβRi. Afterwards, to derive Qi, the attacker has to get Ci or smj. However, smj is only known to Sj and CS, Ci is only known to Ui and CS. Therefore, the attacker cannot reveal the session key when the nonce is disclosed.


#### 5.3.6. Resistance to Forgery Attack

In our scheme, the hash valuesLi,Gi,M1,M2 of the transmitted parameters and the secret value Ai, smj are used to ensure message integrity and verify the sender’s identity. As Ci and smj are unavailable to the attacker, he cannot generate a message that is verified to be valid by the recipient.


#### 5.3.7. Resistance to Desynchronization Attack

In each message, the hash valueLi,Gi,M1,M2 is used to ensure that the transmitted parameters are not tampered with. If the attacker alters a parameter of a message, the receiver will find that the received hash value is not equal to the one he computes, and the protocol terminates. Besides, if the attacker blocks a message, as it does not change the long-term parameters the participants have, it does not affect the user’s next login. For instance, if the attacker blocks the message Fi,M2,T4, the user fails to update his pseudoidentity. But with PIDi, the user still is able to access the cloud server.


#### 5.3.8. Resistance to Replay Attack

In the proposed scheme, every message contains a timestamp. And the timestamps are involved in the hash valuesLi,Gi,M1,M2. Upon receiving a message, the receiver first verifies whether the timestamp is fresh. If it holds, the receiver continues to process the message. Otherwise, the protocol aborts.


#### 5.3.9. Resistance to Privileged Insider Attack

The user never submits his biometric or password to CS at registration. On the other hand, the user cannot masquerade as a cloud server or CS, assmj is unavailable. The cloud server cannot masquerade as a user or CS, as Ci is unavailable. Therefore, our scheme is immune to such an attack.


#### 5.3.10. Resistance to Man-in-the-Middle Attack

In each message, the hash valueLi,Gi,M1,M2 of the transmitted parameters and the secret Ai, smj are computed to ensure message integrity and verify the sender’s identity. As Ai and smj are unavailable, the attacker is unable to generate a valid message to replace the intercepted one. Consequently, the attacker is unable to launch man-in-the-middle attack.


#### 5.3.11. Mutual Authentication

In our scheme, based on the authentication valueCi, CS verifies the authenticity of Ui by checking Li′=?Li. Based on the secret key smj, CS verifies the authenticity of Sj by checking Gi′=?Gi″. If Li′=Li and Gi′=Gi″, CS believes that Ui and Sj are legitimate and sends a response message to Sj. After getting the response message from CS, Sj verifies the authenticity of CS and Ui by checking M1′=?M1. If it holds, Sj believes that Ui and CS are legitimate and sends back a response message to Ui. Afterwards, Ui verifies the authenticity of CS and Sj by checking M2′=?M2. If it holds, Ui believes that CS and Sj are legitimate. Therefore, our scheme provides mutual authentication among CS, Ui, and Sj.


#### 5.3.12. Resistance to Eavesdropping Attack

The attacker can intercept messages from public channel. However, the secret parameters such as the user authentication valueCi, the user identity, the cloud server’s secret key smj, and the session key SK are protected with hash function and symmetric encryption. The attacker cannot acquire any useful information from the intercepted messages and uses them to launch active attacks.


#### 5.3.13. Resistance to All Kinds of Session Key Exposure

The session key consists of two parts,Ei and Qi. Ei is generated by Chebyshev chaotic-based Diffie–Hellman key exchange. Qi is computed using the cloud server’s secret key as well as a Chebyshev polynomial. The purpose of Ei is to make sure that our scheme can be resistant to known key attack, as well as preserve forward secrecy. The purpose of Qi is to make sure that our scheme can withstand session-specific temporary information attack. The attacker can reveal neither Ei nor Qi. Hence, our scheme is resistant to all kinds of session key exposure attacks.


#### 5.3.14. Three-Factor Secrecy

When the attacker reveals the biometric and smart card, he cannot retrieve the password as shown in5.3.2. When the attacker reveals the smart card and password, he cannot retrieve the biometric from Zi as the hash function is irreversible. With the biometric and password, the attacker cannot retrieve the critical data of smart card. Hence, our scheme preserves three-factor secrecy.Most of the existing three-factor authentication schemes fail to preserve three-factory secrecy, because when the biometric and smart card is disclosed, the attacker can guess user’s password based on the verification value that is used to verify the validity of the inputted password and biometric in smart card. However, our scheme employs the fuzzy verifier and “honeywords” technique to prevent revealing of the password.


## 5.1. BAN Logic Proof

We confirm the correctness of our scheme in this section. Table3 lists the notations and rules of BAN logic.Table 3
The notations and rules in BAN logic.
Symbols
Description
P, Q
The principals
X
A statement
P
⊲
X
P see X, P gets a message that consists of X
P
∼
X
P said X, P sent a message that consists of X
P
≡
X
P is convinced that X is true
P
⟹
X
P has jurisdiction over X
P
⟷
K
Q
K is a secret shared by P and Q
X
K
X is combined with a secret K
X
K
X is encrypted with a key K
#
X
X is fresh
Belief rule
P
≡
Q
≡
X
,
Y
/
P
≡
Q
≡
X
Message meaning rule (Rule 1)
P
≡
P
⟷
K
Q
,
P
⊲
X
K
/
P
≡
Q
∼
X or P≡P⟷KQ,P⊲XK/P≡Q∼X
Nonce-verification rule (Rule 2)
P
≡
#
X
,
P
≡
Q
∼
X
/
P
≡
Q
≡
X
Jurisdiction rule (Rule 3)
P
≡
Q
⟹
X
,
P
≡
Q
≡
X
/
P
≡
XOur scheme ought to fulfil the goals as below.Goal 1:Sj≡Ui≡Ui⟷SKSjGoal 2:Sj≡Ui⟷SKSjGoal 3:Ui≡Sj≡Ui⟷SKSjGoal 4:Ui≡Ui⟷SKSjWe idealize our scheme as below:M1:Ui⟶SjIDi,Ui≡Ri,T1CiM2a:Sj⟶CSIDi,Ui≡Ri,T1CiM2b:Sj⟶CSPIDi,Ri,RS,T2smj,RsQiM3:CS⟶SjUi⟷QiSj,RS,PIDinew,RiKi,Ui≡Ri,Fi,T3smjM4a:Sj⟶UiUi⟷QiSj,RS,PIDinew,RiKiM4b:Sj⟶UiUi⟷SKSj,Fi,T4QiThe analysis of our scheme is based on the following initial assumptions:A1:CS≡Ui⟷CiCSA2:CS≡#T1A3:CS≡Ui⇒Ui≡RiA4:Sj≡CS⟷smjSjA5:Sj≡#T3A6:Sj≡CS⇒Ui≡RiA7:Sj≡Ui⇒Ui⟷SKSjA8:Ui≡Ui⟷KiCSA9:Ui≡#RiA10:Ui≡CS⇒Ui⟷QiSjA11:Ui≡#T4A12:Ui≡Sj⇒Ui⟷SKSjThe analysis of the proposed scheme is as follows.According to M2a, we get(1)
CS⊲IDi,Ui≡Ri,T1CiFrom (1), A1, applying Rule 1, we get(2)
CS≡Ui∼IDi,Ui≡Ri,T1From (2), A2, applying Rule 2, we get(3)
CS≡Ui≡Ui≡RiFrom (3), A3, applying Rule 3, we get(4)
CS≡Ui≡RiAccording to M3, we get(5)
Sj⊲Ui≡Ri,Fi,T3smjFrom (5), A4, applying Rule 1, we get(6)
Sj≡CS∼Ui≡Ri,Fi,T3From (6), A5, applying Rule 2, we get(7)
Sj≡CS≡Ui≡RiFrom (7), A6, applying Rule 3, we get(8)
Sj≡Ui≡RiFrom (8), andSK=H1TβRiH1smjRi, we get(9)
Sj≡Ui≡Ui⟷SKSj Goal 1From (9), A7, applying Rule 3, we get(10)
Sj≡Ui⟷SKSj Goal 2According to M4a, we get(11)
Ui⊲Ui⟷QiSj,RS,PIDnew,RiKiFrom (11), A8, applying Rule 1, we get(12)
Ui≡CS∼Ui⟷QiSj,RS,PIDnew,RiFrom (12), A9, applying Rule 2, we get(13)
Ui≡CS≡Ui⟷QiSjFrom (13), A10, applying Rule 3, we get(14)
Ui≡Ui⟷QiSjAccording to M4b, we get(15)
Ui⊲Ui⟷SKSj,Fi,T4QiFrom (14), (15), applying Rule 1, we get(16)
Ui≡Sj∼Ui⟷SKSj,Fi,T4From (16), A11, applying Rule 2, we get(17)
Ui≡Sj≡Ui⟷SKSj Goal 3From (17), A12, applying Rule 3, we get(18)
Ui≡Ui⟷SKSj Goal 4


## 5.2. Formal Security Analysis

Based on the security model of two-factor authentication presented by Wang and Wang [33], we put forward a security model of three-factor authentication for cloud computing. Afterwards, we prove the semantic security of our scheme in this model.


### 5.2.1. Formal Security Model

(1) Participants. There are multiple instances of the control server CS, the cloud server Sj, and the user Ui in the authentication scheme for cloud computing. We use CSa, Sja, and Uia to denote these instances.(2) Queries. The attacker is capable of making the queries as follows:ExecuteCSa/Sja/Uia: by making this query, the attacker can obtain the messages delivered via the open channel.SendCSa/Sja/Uia,m: by making this query, the attacker can impersonate the principal Uia,Sja,GWNa to send a message m. If m is valid, a response is sent back to the attacker.RevealSja/Uia: by making this query, the attacker can get the session key of Sja/Uia, if the principal involves a session key.CorruptUia,τ: by making this query, the attacker is capable of getting one or two types of user authentication information.Whenτ=1, the attacker acquires the password.Whenτ=2, the attacker acquires the smart card.Whenτ=3, the attacker acquires the biometric.CorruptSja/CSa: by making this query, the attacker can obtain cloud server’s secret key or CS’s master key. This oracle corresponds to the forward secrecy.TestSja/Uia: if the principal is fresh (see below) and involves a session key SK, the oracle spins a coin b. When b=1, it sends back SK to the attacker. When b=0, it sends back a random string to the attacker. This oracle is used to simulate the semantic security of session key. The attacker is capable of asking this query only once.(3) Freshness. We say Sja/Uia is fresh, if the following conditions are met:(1)
S
j
a
/
U
i
a is accepted and involves a SK
(2)
The attacker never makes CorruptSja/CSa or Reveal Sja/Uia query(4) Semantic Security. After making the above queries, the attacker tries to reveal the value of b in test query. The advantage of the attacker in breaking the semantic security is defined as follows:(1)AdvPakeA=2Prb′=b−1.If for all the attackers,AdvPakeA is negligible, the authentication scheme provides semantic security.


### 5.2.2. Formal Security Analysis

Theorem 1.
Let the password spaceDPW be subject to Zipf distribution [34]. A polynomial-time attacker A runs against our scheme. We presume A can ask less than qe Execute queries, qs Send queries, qb Biohash queries, qh Hash queries, and qε Encryption/Decryption queries. We have(2)AdvPakeA≤2C′∗qss′+qs+qe2p+6qs+qh22l1+2qs+qb22l2+qε22l3+2qhAdvPCHDHP,where l1,l2,l3 are the length of hash output, bio-hash output, and symmetric encryption output, respectively. AdvPCHDHP is the advantage of A in solving CHDHP. When using the Tianya password distribution [34], we have DPW≈13million, C′=0.062239, and s′=0.155478.Proof.
In order to obtainAdvPakeA, we define the games Φi 0≤i≤6, where Φ0 corresponds to the real attack. Prχi is the advantage of A in revealing b in game Gi.Φ0: as it simulates the real attack, we get,(3)AdvPakeA=2Prχ0−1.Φ1: in this game, a hash list ΛH is used to simulate the hash oracle. A biohash list ΛBH is used to simulate the biohash oracle. And an encryption/decryption list Λε is used to simulate the encryption/decryption oracle. For a hash query H1α, if the hash value of α already exists in ΛH, the oracle sends back the hash value. Otherwise, the oracle selects a nonce β as the answer of H1α and stores α,β in ΛH. The biohash oracle is performed in the similar way. For an encryption query Ekφ, the oracle firstly uses φ and k to search Λε, If there exists an tuple k,φ,ω, it answers ω. Otherwise, it sends back a random string ω to the adversary and stores k,φ,ω in Λε. For an decryption query Dkω, the oracle uses ω and k to search Λε. If there exists a tuple k,φ,ω, it answers φ. Otherwise, it sends back a random string φ to the adversary, and stores k,φ,ω in Λε. Φ1 is indistinguishable from Φ0. We get(4)Prχ0−Prχ1=0.Φ2: in this game, we terminate the execution when encountering some collisions.(1)
The collision occurs on the outputs of hash function or biohash function with the probability ofqh2/2l1+1+qb2/2l2+1(2)
The collision occurs on the outputs of symmetric encryption with the probability ofqε2/2l3+1(3)
The collision occurs on the transcripts of messages, with the probability ofqs+qe2/2pWe get(5)Prχ1−Prχ2≤qh22l1+1+qb22l2+1+qε22l3+1+qs+qe22p.Φ3: in this game, we terminate the execution when A guesses Li,Gi,M1,M2. The probability is at most qs/2l1. We get(6)Prχ3−Prχ2≤qs2l1.Φ4: in this game, we terminate the execution when A guesses user’s authentication value Ci. The probability is less than qs/2l1. We obtain(7)Prχ4−Prχ3≤qs2l1.Φ5: in this game, we terminate the execution when A has computed Ci with the help of Corrupt Uia,z.(1)
When CorruptUia,z=1,2, A is able to guess the biometric with the probability of qs/2l1(2)
When CorruptUia,z=2,3, A is able to guess the password with the probability of C′∗qss′.(3)
When CorruptUia,z=1,3, A is able to guess Di with the probability of qs/2l1.We obtain(8)Prχ5−Prχ4≤qs2l1+C′∗qss′+qs2l1.Φ6: we use the private hash oracle H1′ rather than the hash oracle H1 to compute the session key. A knows nothing about H1′. Thus, we have(9)Prχ6=12.Φ6: it is indistinguishable from Φ5, unless a hash query H1EiQi is made by A. We use Γ1 to denote this event. We have(10)Prχ6−Prχ5≤PrΓ1.If the hash queryH1EiQi has been asked, by selecting randomly in ΛH, we can obtain Ei=TαRS=TβRi with the probability of 1/qh. We get(11)PrΓ1≤qhAdvPCHDHP.From (3)–(11), we have(12)AdvPakeA≤2C′∗qss′+qs+qe2p+6qs+qh22l1+2qs+qb22l2+qε22l3+2qhAdvPCHDHP.


## 5.2.1. Formal Security Model

(1) Participants. There are multiple instances of the control server CS, the cloud server Sj, and the user Ui in the authentication scheme for cloud computing. We use CSa, Sja, and Uia to denote these instances.(2) Queries. The attacker is capable of making the queries as follows:ExecuteCSa/Sja/Uia: by making this query, the attacker can obtain the messages delivered via the open channel.SendCSa/Sja/Uia,m: by making this query, the attacker can impersonate the principal Uia,Sja,GWNa to send a message m. If m is valid, a response is sent back to the attacker.RevealSja/Uia: by making this query, the attacker can get the session key of Sja/Uia, if the principal involves a session key.CorruptUia,τ: by making this query, the attacker is capable of getting one or two types of user authentication information.Whenτ=1, the attacker acquires the password.Whenτ=2, the attacker acquires the smart card.Whenτ=3, the attacker acquires the biometric.CorruptSja/CSa: by making this query, the attacker can obtain cloud server’s secret key or CS’s master key. This oracle corresponds to the forward secrecy.TestSja/Uia: if the principal is fresh (see below) and involves a session key SK, the oracle spins a coin b. When b=1, it sends back SK to the attacker. When b=0, it sends back a random string to the attacker. This oracle is used to simulate the semantic security of session key. The attacker is capable of asking this query only once.(3) Freshness. We say Sja/Uia is fresh, if the following conditions are met:(1)
S
j
a
/
U
i
a is accepted and involves a SK
(2)
The attacker never makes CorruptSja/CSa or Reveal Sja/Uia query(4) Semantic Security. After making the above queries, the attacker tries to reveal the value of b in test query. The advantage of the attacker in breaking the semantic security is defined as follows:(1)AdvPakeA=2Prb′=b−1.If for all the attackers,AdvPakeA is negligible, the authentication scheme provides semantic security.


## 5.2.2. Formal Security Analysis

Theorem 1.
Let the password spaceDPW be subject to Zipf distribution [34]. A polynomial-time attacker A runs against our scheme. We presume A can ask less than qe Execute queries, qs Send queries, qb Biohash queries, qh Hash queries, and qε Encryption/Decryption queries. We have(2)AdvPakeA≤2C′∗qss′+qs+qe2p+6qs+qh22l1+2qs+qb22l2+qε22l3+2qhAdvPCHDHP,where l1,l2,l3 are the length of hash output, bio-hash output, and symmetric encryption output, respectively. AdvPCHDHP is the advantage of A in solving CHDHP. When using the Tianya password distribution [34], we have DPW≈13million, C′=0.062239, and s′=0.155478.Proof.
In order to obtainAdvPakeA, we define the games Φi 0≤i≤6, where Φ0 corresponds to the real attack. Prχi is the advantage of A in revealing b in game Gi.Φ0: as it simulates the real attack, we get,(3)AdvPakeA=2Prχ0−1.Φ1: in this game, a hash list ΛH is used to simulate the hash oracle. A biohash list ΛBH is used to simulate the biohash oracle. And an encryption/decryption list Λε is used to simulate the encryption/decryption oracle. For a hash query H1α, if the hash value of α already exists in ΛH, the oracle sends back the hash value. Otherwise, the oracle selects a nonce β as the answer of H1α and stores α,β in ΛH. The biohash oracle is performed in the similar way. For an encryption query Ekφ, the oracle firstly uses φ and k to search Λε, If there exists an tuple k,φ,ω, it answers ω. Otherwise, it sends back a random string ω to the adversary and stores k,φ,ω in Λε. For an decryption query Dkω, the oracle uses ω and k to search Λε. If there exists a tuple k,φ,ω, it answers φ. Otherwise, it sends back a random string φ to the adversary, and stores k,φ,ω in Λε. Φ1 is indistinguishable from Φ0. We get(4)Prχ0−Prχ1=0.Φ2: in this game, we terminate the execution when encountering some collisions.(1)
The collision occurs on the outputs of hash function or biohash function with the probability ofqh2/2l1+1+qb2/2l2+1(2)
The collision occurs on the outputs of symmetric encryption with the probability ofqε2/2l3+1(3)
The collision occurs on the transcripts of messages, with the probability ofqs+qe2/2pWe get(5)Prχ1−Prχ2≤qh22l1+1+qb22l2+1+qε22l3+1+qs+qe22p.Φ3: in this game, we terminate the execution when A guesses Li,Gi,M1,M2. The probability is at most qs/2l1. We get(6)Prχ3−Prχ2≤qs2l1.Φ4: in this game, we terminate the execution when A guesses user’s authentication value Ci. The probability is less than qs/2l1. We obtain(7)Prχ4−Prχ3≤qs2l1.Φ5: in this game, we terminate the execution when A has computed Ci with the help of Corrupt Uia,z.(1)
When CorruptUia,z=1,2, A is able to guess the biometric with the probability of qs/2l1(2)
When CorruptUia,z=2,3, A is able to guess the password with the probability of C′∗qss′.(3)
When CorruptUia,z=1,3, A is able to guess Di with the probability of qs/2l1.We obtain(8)Prχ5−Prχ4≤qs2l1+C′∗qss′+qs2l1.Φ6: we use the private hash oracle H1′ rather than the hash oracle H1 to compute the session key. A knows nothing about H1′. Thus, we have(9)Prχ6=12.Φ6: it is indistinguishable from Φ5, unless a hash query H1EiQi is made by A. We use Γ1 to denote this event. We have(10)Prχ6−Prχ5≤PrΓ1.If the hash queryH1EiQi has been asked, by selecting randomly in ΛH, we can obtain Ei=TαRS=TβRi with the probability of 1/qh. We get(11)PrΓ1≤qhAdvPCHDHP.From (3)–(11), we have(12)AdvPakeA≤2C′∗qss′+qs+qe2p+6qs+qh22l1+2qs+qb22l2+qε22l3+2qhAdvPCHDHP.


## 5.3. Informal Security Analysis

In this section, we prove that our scheme is resistant to diverse attacks. Particularly, our scheme is secure against all kinds of session key exposure attacks, as the session key is generated based on the long-term secret and Chebyshev chaotic-based Diffie–Hellman key exchange. Besides, we demonstrate that the proposed scheme preserves desired properties such as user anonymity and three-factor secrecy.


### 5.3.1. User Anonymity

In our scheme, only the control server who has the secret keyy can retrieve IDi from PIDi. In addition, after authenticating Ui, CS generates a new pseudoidentity PIDinew and delivers the encrypted PIDinew to Ui. PIDinew is encrypted with the secret key Ki by CS. Only Ui is able to compute Ki and obtain PIDinew. The attacker knows nothing about PIDinew, and hence he cannot link PIDinew with PIDi. It makes the user identity untraceable. Consequently, our scheme achieves user anonymity.


### 5.3.2. Resistance to Off-Line Guessing Attack

As the fuzzy verifierZi is employed in our scheme as suggested in [33], even if the attacker obtains the smart card as well as biometric at the same time, he is unable to reveal the password. With the smart card and biometric, the attacker chooses one pair of identity and password from dictionary space and checks if Zi∗=Zi. However, there are a great many candidates conforming to Zi∗=Zi. In order to distinguish the correct one from so many candidates, there is no alternative but to launch online guessing attack. However, we employ the “honeywords” technique [33] to prevent this attack. When the number of online guessing attacks reaches the preset value, for example, 10, Ui is suspended. Consequently, our scheme can resist off-line guessing attack.


### 5.3.3. Resistance to Session Key Disclosure Attack

The session keySK is computed using Ei and Qi. Ei is the secret key generated by the Chebyshev chaotic-based Diffie–Hellman key exchange. Only Ui and Sj who know the random number α or β are able to compute Ei. Qi is computed based on the long-term secret smj. Only Sj and CS who have smj are able to compute Qi. Besides, Qi is transmitted to Ui by means of symmetric encryption with the secret key H1CiRi. Only Ui and CS who have Ci are able to reveal Qi. Both Ei and Qi are unavailable to the attacker. Therefore, our scheme can resist this attack.


### 5.3.4. Forward Secrecy

Suppose that the attacker has acquired the master keys, he is able to compute Qi. However, Ei is the secret key generated by the Chebyshev chaotic-based Diffie–Hellman key exchange. To reveal Ei, there is no alternative but to solve the CHDHP. Therefore, our scheme preserves forward secrecy.


### 5.3.5. Resistance to Session-Specific Temporary Information Attack

Assume that the attacker has acquired the random numberα. To compute Ei=TαRs, Rs is required. RS is encrypted using the secret key Qi or Ki, where Qi=H1smjRi and Ki=H1CiRi. To retrieve RS, the attacker needs to reveal Ci or smj. Assume that the attacker has acquired the random number β, the attacker can calculate Ei=TβRi. Afterwards, to derive Qi, the attacker has to get Ci or smj. However, smj is only known to Sj and CS, Ci is only known to Ui and CS. Therefore, the attacker cannot reveal the session key when the nonce is disclosed.


### 5.3.6. Resistance to Forgery Attack

In our scheme, the hash valuesLi,Gi,M1,M2 of the transmitted parameters and the secret value Ai, smj are used to ensure message integrity and verify the sender’s identity. As Ci and smj are unavailable to the attacker, he cannot generate a message that is verified to be valid by the recipient.


### 5.3.7. Resistance to Desynchronization Attack

In each message, the hash valueLi,Gi,M1,M2 is used to ensure that the transmitted parameters are not tampered with. If the attacker alters a parameter of a message, the receiver will find that the received hash value is not equal to the one he computes, and the protocol terminates. Besides, if the attacker blocks a message, as it does not change the long-term parameters the participants have, it does not affect the user’s next login. For instance, if the attacker blocks the message Fi,M2,T4, the user fails to update his pseudoidentity. But with PIDi, the user still is able to access the cloud server.


### 5.3.8. Resistance to Replay Attack

In the proposed scheme, every message contains a timestamp. And the timestamps are involved in the hash valuesLi,Gi,M1,M2. Upon receiving a message, the receiver first verifies whether the timestamp is fresh. If it holds, the receiver continues to process the message. Otherwise, the protocol aborts.


### 5.3.9. Resistance to Privileged Insider Attack

The user never submits his biometric or password to CS at registration. On the other hand, the user cannot masquerade as a cloud server or CS, assmj is unavailable. The cloud server cannot masquerade as a user or CS, as Ci is unavailable. Therefore, our scheme is immune to such an attack.


### 5.3.10. Resistance to Man-in-the-Middle Attack

In each message, the hash valueLi,Gi,M1,M2 of the transmitted parameters and the secret Ai, smj are computed to ensure message integrity and verify the sender’s identity. As Ai and smj are unavailable, the attacker is unable to generate a valid message to replace the intercepted one. Consequently, the attacker is unable to launch man-in-the-middle attack.


### 5.3.11. Mutual Authentication

In our scheme, based on the authentication valueCi, CS verifies the authenticity of Ui by checking Li′=?Li. Based on the secret key smj, CS verifies the authenticity of Sj by checking Gi′=?Gi″. If Li′=Li and Gi′=Gi″, CS believes that Ui and Sj are legitimate and sends a response message to Sj. After getting the response message from CS, Sj verifies the authenticity of CS and Ui by checking M1′=?M1. If it holds, Sj believes that Ui and CS are legitimate and sends back a response message to Ui. Afterwards, Ui verifies the authenticity of CS and Sj by checking M2′=?M2. If it holds, Ui believes that CS and Sj are legitimate. Therefore, our scheme provides mutual authentication among CS, Ui, and Sj.


### 5.3.12. Resistance to Eavesdropping Attack

The attacker can intercept messages from public channel. However, the secret parameters such as the user authentication valueCi, the user identity, the cloud server’s secret key smj, and the session key SK are protected with hash function and symmetric encryption. The attacker cannot acquire any useful information from the intercepted messages and uses them to launch active attacks.


### 5.3.13. Resistance to All Kinds of Session Key Exposure

The session key consists of two parts,Ei and Qi. Ei is generated by Chebyshev chaotic-based Diffie–Hellman key exchange. Qi is computed using the cloud server’s secret key as well as a Chebyshev polynomial. The purpose of Ei is to make sure that our scheme can be resistant to known key attack, as well as preserve forward secrecy. The purpose of Qi is to make sure that our scheme can withstand session-specific temporary information attack. The attacker can reveal neither Ei nor Qi. Hence, our scheme is resistant to all kinds of session key exposure attacks.


### 5.3.14. Three-Factor Secrecy

When the attacker reveals the biometric and smart card, he cannot retrieve the password as shown in5.3.2. When the attacker reveals the smart card and password, he cannot retrieve the biometric from Zi as the hash function is irreversible. With the biometric and password, the attacker cannot retrieve the critical data of smart card. Hence, our scheme preserves three-factor secrecy.Most of the existing three-factor authentication schemes fail to preserve three-factory secrecy, because when the biometric and smart card is disclosed, the attacker can guess user’s password based on the verification value that is used to verify the validity of the inputted password and biometric in smart card. However, our scheme employs the fuzzy verifier and “honeywords” technique to prevent revealing of the password.


## 5.3.1. User Anonymity

In our scheme, only the control server who has the secret keyy can retrieve IDi from PIDi. In addition, after authenticating Ui, CS generates a new pseudoidentity PIDinew and delivers the encrypted PIDinew to Ui. PIDinew is encrypted with the secret key Ki by CS. Only Ui is able to compute Ki and obtain PIDinew. The attacker knows nothing about PIDinew, and hence he cannot link PIDinew with PIDi. It makes the user identity untraceable. Consequently, our scheme achieves user anonymity.


## 5.3.2. Resistance to Off-Line Guessing Attack

As the fuzzy verifierZi is employed in our scheme as suggested in [33], even if the attacker obtains the smart card as well as biometric at the same time, he is unable to reveal the password. With the smart card and biometric, the attacker chooses one pair of identity and password from dictionary space and checks if Zi∗=Zi. However, there are a great many candidates conforming to Zi∗=Zi. In order to distinguish the correct one from so many candidates, there is no alternative but to launch online guessing attack. However, we employ the “honeywords” technique [33] to prevent this attack. When the number of online guessing attacks reaches the preset value, for example, 10, Ui is suspended. Consequently, our scheme can resist off-line guessing attack.


## 5.3.3. Resistance to Session Key Disclosure Attack

The session keySK is computed using Ei and Qi. Ei is the secret key generated by the Chebyshev chaotic-based Diffie–Hellman key exchange. Only Ui and Sj who know the random number α or β are able to compute Ei. Qi is computed based on the long-term secret smj. Only Sj and CS who have smj are able to compute Qi. Besides, Qi is transmitted to Ui by means of symmetric encryption with the secret key H1CiRi. Only Ui and CS who have Ci are able to reveal Qi. Both Ei and Qi are unavailable to the attacker. Therefore, our scheme can resist this attack.


## 5.3.4. Forward Secrecy

Suppose that the attacker has acquired the master keys, he is able to compute Qi. However, Ei is the secret key generated by the Chebyshev chaotic-based Diffie–Hellman key exchange. To reveal Ei, there is no alternative but to solve the CHDHP. Therefore, our scheme preserves forward secrecy.


## 5.3.5. Resistance to Session-Specific Temporary Information Attack

Assume that the attacker has acquired the random numberα. To compute Ei=TαRs, Rs is required. RS is encrypted using the secret key Qi or Ki, where Qi=H1smjRi and Ki=H1CiRi. To retrieve RS, the attacker needs to reveal Ci or smj. Assume that the attacker has acquired the random number β, the attacker can calculate Ei=TβRi. Afterwards, to derive Qi, the attacker has to get Ci or smj. However, smj is only known to Sj and CS, Ci is only known to Ui and CS. Therefore, the attacker cannot reveal the session key when the nonce is disclosed.


## 5.3.6. Resistance to Forgery Attack

In our scheme, the hash valuesLi,Gi,M1,M2 of the transmitted parameters and the secret value Ai, smj are used to ensure message integrity and verify the sender’s identity. As Ci and smj are unavailable to the attacker, he cannot generate a message that is verified to be valid by the recipient.


## 5.3.7. Resistance to Desynchronization Attack

In each message, the hash valueLi,Gi,M1,M2 is used to ensure that the transmitted parameters are not tampered with. If the attacker alters a parameter of a message, the receiver will find that the received hash value is not equal to the one he computes, and the protocol terminates. Besides, if the attacker blocks a message, as it does not change the long-term parameters the participants have, it does not affect the user’s next login. For instance, if the attacker blocks the message Fi,M2,T4, the user fails to update his pseudoidentity. But with PIDi, the user still is able to access the cloud server.


## 5.3.8. Resistance to Replay Attack

In the proposed scheme, every message contains a timestamp. And the timestamps are involved in the hash valuesLi,Gi,M1,M2. Upon receiving a message, the receiver first verifies whether the timestamp is fresh. If it holds, the receiver continues to process the message. Otherwise, the protocol aborts.


## 5.3.9. Resistance to Privileged Insider Attack

The user never submits his biometric or password to CS at registration. On the other hand, the user cannot masquerade as a cloud server or CS, assmj is unavailable. The cloud server cannot masquerade as a user or CS, as Ci is unavailable. Therefore, our scheme is immune to such an attack.


## 5.3.10. Resistance to Man-in-the-Middle Attack

In each message, the hash valueLi,Gi,M1,M2 of the transmitted parameters and the secret Ai, smj are computed to ensure message integrity and verify the sender’s identity. As Ai and smj are unavailable, the attacker is unable to generate a valid message to replace the intercepted one. Consequently, the attacker is unable to launch man-in-the-middle attack.


## 5.3.11. Mutual Authentication

In our scheme, based on the authentication valueCi, CS verifies the authenticity of Ui by checking Li′=?Li. Based on the secret key smj, CS verifies the authenticity of Sj by checking Gi′=?Gi″. If Li′=Li and Gi′=Gi″, CS believes that Ui and Sj are legitimate and sends a response message to Sj. After getting the response message from CS, Sj verifies the authenticity of CS and Ui by checking M1′=?M1. If it holds, Sj believes that Ui and CS are legitimate and sends back a response message to Ui. Afterwards, Ui verifies the authenticity of CS and Sj by checking M2′=?M2. If it holds, Ui believes that CS and Sj are legitimate. Therefore, our scheme provides mutual authentication among CS, Ui, and Sj.


## 5.3.12. Resistance to Eavesdropping Attack

The attacker can intercept messages from public channel. However, the secret parameters such as the user authentication valueCi, the user identity, the cloud server’s secret key smj, and the session key SK are protected with hash function and symmetric encryption. The attacker cannot acquire any useful information from the intercepted messages and uses them to launch active attacks.


## 5.3.13. Resistance to All Kinds of Session Key Exposure

The session key consists of two parts,Ei and Qi. Ei is generated by Chebyshev chaotic-based Diffie–Hellman key exchange. Qi is computed using the cloud server’s secret key as well as a Chebyshev polynomial. The purpose of Ei is to make sure that our scheme can be resistant to known key attack, as well as preserve forward secrecy. The purpose of Qi is to make sure that our scheme can withstand session-specific temporary information attack. The attacker can reveal neither Ei nor Qi. Hence, our scheme is resistant to all kinds of session key exposure attacks.


## 5.3.14. Three-Factor Secrecy

When the attacker reveals the biometric and smart card, he cannot retrieve the password as shown in5.3.2. When the attacker reveals the smart card and password, he cannot retrieve the biometric from Zi as the hash function is irreversible. With the biometric and password, the attacker cannot retrieve the critical data of smart card. Hence, our scheme preserves three-factor secrecy.Most of the existing three-factor authentication schemes fail to preserve three-factory secrecy, because when the biometric and smart card is disclosed, the attacker can guess user’s password based on the verification value that is used to verify the validity of the inputted password and biometric in smart card. However, our scheme employs the fuzzy verifier and “honeywords” technique to prevent revealing of the password.


## 6. Performance Comparisons

We give the comparisons of our scheme and the recently proposed schemes [20, 21, 25, 26, 35, 36] with regard to security attributes, communication, and computation costs in this section.The security comparison is given in Table4. Note that, as Mo et al.’s scheme is designed for single-server environment, it only involves a single cloud server. Ghani et al.’s scheme does not establish session key. We summarize the security requirements of authentication protocol, and based on it, we analyzes the security properties of related schemes in Table 4. It indicates that only the proposed scheme meets all the security requirements, while the related schemes have diverse weaknesses. The security of our scheme is superior to the hash function-based schemes [21, 26], the symmetric cryptosystem-based schemes [35, 36], as well as ECC-based schemes [20, 25].Table 4
Security features of related schemes.
Security properties
Zhou et al. [26]
Amin et al. [21]
Kumari et al. [20]
Mo et al. [25]
Ghani et al. [35]
Martinez-Pelaez et al. [36]
Our scheme
User anonymity
√
√
√
√
×
√
√
Efficient typo detection
×
√
√
√
×
√
√
Resist desynchronization attack
√
√
√
√
×
×
√
Resist off-line guessing attack
√
×
√
√
√
×
√
Resist session key disclosure attack
√
×
√
√
−
×
√
Resist forgery attack
×
×
√
×
×
×
√
Resist replay attack
×
√
√
√
×
√
√
Resist known session-specific temporary information attack
×
×
×
×
−
×
√
Forward secrecy
×
×
√
√
−
×
√
Three-factor secrecy
−
−
×
−
−
−
√
Stolen-verifier attack
√
√
√
×
×
√
√
Resist all kinds of session key exposure attacks
×
×
×
×
−
×
√In Table5, we presents the computation cost, the communication overhead, and the smart card storage cost of the related schemes concerning the login and authentication phase. Furthermore, the computation cost comparison, communication overhead comparison, and smart card storage cost comparison are shown in Figure 4, Figure 5, and Figure 6, respectively. As shown in Figure 4, the computation overhead of our scheme is not as good as the hash-based schemes and the symmetric cryptosystem-based schemes, as public key operations are used to guarantee the security. But it is obviously better than the ECC-based schemes. As shown in Figure 5, the communication cost of our scheme is higher than Mo et al.’s scheme and Ghani et al.’s scheme, but it is lower than the other schemes. As shown in Figure 6, the storage cost of our scheme is inferior to Amin et al.’s scheme and Ghani et al.’s scheme, but it is superior to the other schemes.Table 5
Computation and communication costs and smart card storage cost of related schemes.
Computation overhead
Running time (ms)
Communication cost (bits)
Storage cost (bits)
User
Server
CS
Zhou et al. [26]
10
T
H
7
T
H
19
T
H
18
3584
640
Amin et al. [21]
9
T
H
4
T
H
10
T
H
11.5
2560
512
Kumari et al. [20]
2
T
B
H
+
5
T
H
+
3
T
P
5
T
H
+
3
T
P
6
T
H
+
2
T
P
554.64
2624
576
Mo et al. [25]
7
T
H
+
1
T
A
+
3
T
P
6
T
H
+
1
T
A
+
3
T
P
−
385.998
960
712
Ghani et al. [35]
2
T
H
2
T
H
4
T
H
+
2
T
s
21.4
1792
384
Martinez-Pelaez et al. [36]
7
T
H
+
3
T
s
6
T
H
+
3
T
s
26
T
H
+
2
T
s
89.1
3456
640
Our scheme
1
T
B
H
+
2
T
C
+
7
T
H
+
1
T
s
5
T
H
+
2
T
C
+
1
T
s
9
T
H
+
3
T
s
159.1
2304
532Figure 4
The computation cost of related schemes.Figure 5
The communication cost of related schemes.Figure 6
The smart card storage cost of related schemes.T
H, TBH, TS, and TC denote a hash function, a biohash function, a symmetric encryption/decryption, and a Chebyshev polynomial, respectively. TP and TA denote a point multiplication and a point addition on elliptic curve group. The computing time of lightweight operation “XOR” is negligible. In accordance with [3, 37], when performed on a smart phone with a Hisilicon kirin 960 CPU, 6 GB RAM, and the storage of 64 GB, the computations of TH, TS, TP, TA, TC, and TBH take 0.5 ms, 8.7 ms, 63.075 ms, 0.262 ms, 21.02 ms, and 21.02 ms, respectively. Besides, we assume that the bit length of timestamp, random number, the user identity, the identity of cloud server, the hash value, Chebyshev polynomial, and the output of symmetric encryption are 128 bits. The point on elliptic curve group is 160 bits.The hash-based schemes and the symmetric cryptosystem-based schemes have obvious advantage in efficiency as they just involve lightweight cryptographic operations. However, they suffer from various security vulnerabilities. In Zhou et al.’s scheme, the attacker is capable of impersonating the user and the cloud server by replaying the intercepted message. In Amin et al.’s scheme, the attacker can retrieve user’s password, disclose the session key, and impersonate the user when smart card is compromised. Martinez-Pelaez et al.’s scheme and Ghani et al.’s scheme are vulnerable to diverse and serious security weaknesses. They are unable to provide the essential security protection.The ECC-based schemes have low efficiency. They have better security than the hash-based schemes and the symmetric cryptosystem-based schemes, but still have security flaws. In Mo et al.’s scheme, the attacker can impersonate the user when the verifier table is leaked. Kumari et al.’s scheme achieves many security features, but it does not provide three-factor secrecy.In terms of the security of session key, only our scheme is resistant to all kinds of session key exposure attacks, as Chebyshev chaotic-based Diffie–Hellman key exchange and the long-term secret are used to establish the session key. None of the related schemes can withstand known session-specific temporary information attack. If one communication end uses unsecure random number generator, it will lead to the disclosure of the session key. The hash-based schemes and the symmetric cryptosystem-based schemes are unable to provide forward secrecy. The ECC-based schemes provide forward secrecy, as the elliptic curve-based Diffie–Hellman key exchange is employed. Furthermore, in Amin et al.’s scheme and Martinez-Pelaez et al.’s scheme, the attacker can retrieve the session key when the smart card is compromised.To sum up, the security of our scheme is optimal. In addition, its computation and communication overheads are obviously lower than the ECC-based schemes. Hence, our scheme is more practical.


## 7. Conclusion

In this paper, we pointed out that Zhou et al.’s scheme is unable to provide the essential security protection for cloud computing, as it does not consider replay attack, known session-specific temporary information attack, and forward secrecy. Furthermore, we present a novel IoT-based three-factor authentication scheme for cloud computing using chaotic maps. The use of Chebyshev chaotic maps guarantees the security of session key and simultaneously reduces the computation cost. In addition, the BAN logic analysis demonstrates that our scheme achieves mutual authentication as well as session key negotiation. The formal analysis confirms the semantic security of session key. The informal analysis proves that our scheme can withstand known attacks and achieve desired attributes such as user anonymity and resistance to all kinds of session key exposure attacks. Finally, the performance comparisons show that our scheme has significant advantage compared with the related schemes. As our scheme has high security, it is especially applicable to the security-critical cloud applications such as cloud-based healthcare systems. Afterwards, on the basis of our current work, we plan to make further study on the authentication protocol for smart healthcare systems.



---

*Source: 3805058-2020-02-18.xml*