# A Lightweight ID Based Authentication and Key Agreement Protocol for Multiserver Architecture

Authors: Yanrong Lu; Lixiang Li; Haipeng Peng; Xing Yang; Yixian Yang
Journal: International Journal of Distributed Sensor Networks
 (2015)

---

## Abstract

There is an increasing demand of an anonymous authentication to secure communications between numerous different network members while preserving privacy for the members. In this study, we address this issue by using an ID based authenticated and key agreement protocol to improve the recent protocol proposed by Xue et al. They claimed that their protocol could resist masquerade and insider attacks. Unfortunately, we find that Xue et al.’s protocol is not only really insecure against masquerade and insider attacks but also vulnerable to off-line password guessing attack. Therefore, a slight modification to their protocol is proposed to improve their shortcomings. Moreover, our protocol does not use timestamps, so it is not required to synchronize the time. As a result, according to our performance and security analyses, we can prove that our proposed protocol can enhance efficiency and improve security in comparison to previous protocols.


---

## Body

## 1. Introduction

With the rapid growth of network technology, user authentication plays an important role in achieving the dependable network environments. When we enjoy online shopping, online game, on line documentation, data exchange, and so forth, identity authentication is a basic protection measure to authenticate the identity of remote users [1]. Since Lamport [2] first protocol was shown in 1981, numerous protocols have been proposed and used in many communication systems [3–7]. In 2000, Hwang and Li [8] proposed a new remote user authentication scheme using smart card based on ElGamal’s public key cryptosystem. However, their scheme is inefficient because of high communication and computation costs. In order to remedy the security problems and to reduce the communication and computation costs, a large number of smart cards based authentication schemes using one way hash function have been investigated [9–14].Traditionally, password authentication is mostly considered in single server environment where it has not been efficiently solved in a multiserver based environment. In addition, not only does each user need to log into different remote servers repetitively but also it needs to remember many various sets of identities and passwords if he wants to access these services. In order to solve this problem, different protocols have been suggested to access the resources of multiserver environments. In 2009, Hsiang and Shih [15] proposed a one-way hash function based remote authentication protocol for multisever environment. Later, Sood et al. [16] showed that Hsiang et al.’s protocol could not resist stolen smart card and replay and impersonation attacks and then they proposed an improved protocol. Unfortunately, Li et al. [17] pointed out that Sood et al.’s protocol was susceptible to stolen smart card and replay attacks and was not able to provide key agreement phase. Li et al. also proposed a modified version of Sood et al.’s protocol so as to remedy the security deficiencies. Recently, Xue et al. [18] showed that Li et al.’s protocol was still vulnerable to eavesdropping and replay and forgery attacks. To remedy the weaknesses of Li et al.’s protocol, they proposed a one-way hash based authentication and key agreement protocol for multiserver architecture, which was claimed to resist many kinds of attacks. However, through careful analysis, we found that Xue et al.’s protocol had some critical security pitfalls and is insecure for practical applications.In this paper, we analyze a novel multiserver authentication protocol proposed by Xue et al. We show that the protocol suffers from masquerade, off-line password guessing, and insider attacks. In order to overcome these security weaknesses, a slight modification to their protocol is proposed to improve their shortcomings. Moreover, our protocol employs random numbers instead of timestamps to avoid time synchronization. As a result, according to our performance and security analysis, we can prove that our proposed protocol is able to enhance efficiency and improve security in comparison to previous protocols.The rest of paper is organized as follows. In Section2, we review Xue et al.’s protocol and Section 3 shows the security weaknesses of Xue et al.’s protocol. In Section 4, we propose a new enhancement authentication protocol for multisever environment to overcome these security weaknesses. In Section 5, we present analysis of our protocol. Section 6 shows the performance and functionality comparison among the proposed protocol and other related ones. We conclude in Section 7.


## 2. Review of Xue et al.’s Protocol

In Xue et al.’s protocol, there are three participants, userU
i, service providing servers S
j, and control server CS, and four phases, namely, registration, login and authentication, password updating, and identity updating. The notations used throughout this paper are summarized as follows.U
i
,
S
j
,
CS:  user, service providing server, and control server;
ID
i
,
SID
j
: identity of U
i and S
j;
h
·
:  hash function;
P
i
: password of U
i;
x
,
y
: secret key selected by CS;
⊕
,
∥
:  exclusive-OR operation and concatenation operation;
N
i
1
,
N
i
2
,
N
i
3
: random number selected by U
i, S
j, and CS.The login and authentication phases are shown in Box1.Box 1:Login and authentication phases of Xue et al.'s protocol.
U
i               S
j                    C
S
(1)Input
I
D
i, P
i,             (3) Check
T
S
j
-
T
S
i
<
Δ
T,        (5) Check
T
S
C
S
-
T
S
i
<
Δ
T,
A
i
=
h
(
b
∥
P
i
),              J
i
=
B
S
j
⊕
N
i
2,             N
i
2
=
B
S
j
⊕
J
i,
Check
C
i
′
=
h
(
I
D
i
∥
A
i
)
=
?
C
i       K
i
=
h
(
N
i
2
∥
B
S
j
∥
P
i
j
∥
T
S
i
),
K
i
′
=
h
(
N
i
2
∥
B
S
j
∥
P
i
j
∥
T
S
i
)
=
?
K
i,
Generate
N
i
1, T
S
i,           L
i
=
S
I
D
j
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
∥
“
00
”
),    B
i
=
h
(
P
I
D
i
∥
x
), N
i
1
=
F
i
⊕
B
i,
B
i
=
D
i
⊕
C
i
,
F
i
=
B
i
⊕
N
i
1,          M
i
=
d
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
∥
“
11
”
).
S
I
D
j
=
L
i
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
∥
“
00
”
),
P
i
j
=
h
(
B
i
⊕
h
(
N
i
1
∥
S
I
D
j
∥
P
I
D
i
∥
T
S
i
)
),    →
4
F
i
,
P
i
j
,
C
I
D
i
,
G
i
,
P
I
D
i
,
T
S
i
,
J
i
,
K
i
,
L
i
,
M
i
,
P
S
I
D
j
C
I
D
i
=
I
D
i
⊕
h
(
B
i
∥
N
i
1
∥
T
S
i
∥
“
00
”
),                    h
B
i
⊕
h
N
i
1
∥
S
I
D
j
∥
P
I
D
i
∥
T
S
i
=
?
P
i
j,
G
i
=
b
⊕
h
(
B
i
∥
N
i
1
∥
T
S
i
∥
“
11
”
).                      Generate
N
i
3,
→
2
F
i
,
P
i
j
,
C
I
D
i
,
G
i
,
P
I
D
i
,
T
S
i                 P
i
=
N
i
1
⊕
N
i
3
⊕
h
(
S
I
D
j
∥
N
i
2
∥
B
S
j
),
R
i
=
N
i
2
⊕
N
i
3
⊕
h
(
I
D
i
∥
N
i
1
∥
B
i
),
Q
i
=
h
(
N
i
1
⊕
N
i
3
)
,
V
i
=
h
(
N
i
2
⊕
N
i
3
).
←
6
P
i
,
Q
i
,
R
i
,
V
i
(9)N
i
2
⊕
N
i
3
=
R
i
⊕
h
(
I
D
i
∥
N
i
1
∥
B
i
),            (7) N
i
1
⊕
N
i
3
=
P
i
⊕
h
(
S
I
D
j
∥
N
i
2
∥
B
S
j
),
Check
Q
i
′
=
h
(
N
i
1
⊕
N
i
3
)
=
?
Q
i.
Check
V
i
′
=
h
(
N
i
2
⊕
N
i
3
)
=
?
V
i.
←
8
R
i
,
V
i
↔
S
K
=
h
(
N
i
1
⊕
N
i
2
⊕
N
i
3
∥
T
S
i
)


### 2.1. Registration Phase

CS firstly chooses two security elements x and y.(1)U
i selects a password P
i and a random number b. Then, U
i computes A
i
=
h
(
b
∥
P
i
) and sends {
I
D
i
,
b
,
A
i
} to CS through a secure channel.(2)CS computes PI
D
i
=
h
(
I
D
i
∥
b
) and B
i
=
h
(
PI
D
i
∥
x
) and sends B
i to U
i via a secure channel.(3)U
i computes C
i
=
h
(
I
D
i
∥
A
i
) and D
i
=
B
i
⊕
h
(
PI
D
i
⊕
A
i
) and stores {
C
i
,
D
i
,
h
(
·
)
,
b
} into the smart card.


### 2.2. Login and Authentication Phases

(1)U
i inserts his smart card into the terminal and inputs his identity I
D
i and password P
i.(2)U
i computes A
i
=
h
(
b
∥
P
i
) and C
i
′
=
h
(
I
D
i
∥
A
i
) and checks whether C
i
′
=
?
C
i. If it is true, U
i is viewed as a legitimate user. Otherwise, the terminal rejects the login request. Then, U
i computes B
i
=
D
i
⊕
C
i, F
i
=
B
i
⊕
N
i
1, P
i
j
=
h
(
B
i
⊕
h
(
N
i
1
∥
SI
D
j
∥
PI
D
i
∥
T
S
i
)
), CI
D
i
=
I
D
i
⊕
h
(
B
i
∥
N
i
1
∥
T
S
i
∥
“
00
"
), and G
i
=
b
⊕
h
(
B
i
∥
N
i
1
∥
T
S
i
∥
“
11
"
) and transmits {
F
i
,
P
i
j
,
CI
D
i
,
G
i
,
PI
D
i
,
T
S
i
} to S
j.(3)S
j generates a random number d and sends {
SI
D
j
,
b
} to CS. Finally, S
j obtains B
S
j
=
h
(
PSI
D
j
∥
y
) from CS and stores {
B
S
j
,
b
} into its database. When receiving the message from U
i, S
j checks whether T
S
j
-
T
S
i
<
Δ
T is valid and where T
S
j is the current time. If it is true, S
j chooses a number N
i
2 and computes J
i
=
B
S
j
⊕
N
i
2, K
i
=
h
(
N
i
2
∥
B
S
j
∥
P
i
j
∥
T
S
i
), L
i
=
SI
D
j
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
∥
“
00
"
), and M
i
=
d
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
∥
“
11
"
) and transmits {
F
i
,
P
i
j
,
CI
D
i
,
G
i
,
PI
D
i
,
T
S
i
,
J
i
,
K
i
,
L
i
,
M
i
,
PSI
D
j
} to CS.(4)CS checks whether T
S
CS
-
T
S
i
<
Δ
T is valid, where T
S
CS is the current time. If it is true, S
j chooses a random number N
i
2, computes B
S
j
=
h
(
PSI
D
j
∥
y
), N
i
2
=
J
i
⊕
B
S
j, and K
′
=
h
(
N
i
2
∥
B
S
j
∥
P
i
j
∥
T
S
i
) and checks whether K
′
=
?
K. If it is true, CS continues to calculate B
i
=
h
(
PI
D
i
∥
x
), N
i
1
=
F
i
⊕
B
i, SI
D
i
=
L
i
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
∥
“
00
"
), and P
i
j
′
=
h
(
B
i
⊕
h
(
N
i
1
∥
SI
D
j
∥
PI
D
i
∥
T
S
i
)
) and checks whether P
i
j
′
=
?
P
i
j. If it is true, CS chooses a random number N
i
3 and calculates P
i
=
N
i
1
⊕
N
i
3
⊕
h
(
SI
D
j
∥
N
i
2
∥
B
S
j
), Q
i
=
h
(
N
i
1
⊕
N
i
3
), R
i
=
N
i
2
⊕
N
i
3
⊕
h
(
I
D
i
∥
N
i
1
∥
B
i
), and V
i
=
h
(
N
i
2
⊕
N
i
3
). Then, CS delivers {
P
i
,
Q
i
,
R
i
,
V
i
} to S
j.(5)S
j computes N
i
1
⊕
N
i
3
=
P
i
⊕
h
(
SI
D
j
∥
N
i
2
∥
B
S
j
) and Q
i
′
=
h
(
N
i
1
⊕
N
i
3
) and checks whether Q
i
′
=
?
Q
i. If it follows, S
j transmits {
R
i
,
V
i
} to U
i.(6)U
i computes N
i
2
⊕
N
i
3
=
R
i
⊕
h
(
I
D
i
∥
N
i
1
∥
B
i
) and V
i
′
=
h
(
N
i
2
⊕
N
i
3
) and checks whether V
i
′
=
?
V
i. If it follows, CS and S
j are authenticated by U
i. Finally, the common session key SK
=
h
(
(
N
i
1
⊕
N
i
2
⊕
N
i
3
)
∥
T
S
i
) can be shared among U
i, S
j, and CS.


### 2.3. Password Updating Phase

(1)U
i computes C
i
′
=
h
(
I
D
i
∥
A
i
′
) and D
i
′
=
B
i
⊕
h
(
PI
D
i
⊕
A
i
′
) and updates corresponding value in the smart card.(2)U
i submits {
I
D
i
,
A
i
′
} with a new password P
i
′ to CS. Then, CS updates user’s P
i stored in its verification table.


### 2.4. Identity Updating Phase

(1)U
i chooses a random number b
′ and computes A
i
′
=
h
(
b
′
∥
P
i
). Then, U
i submits {
I
D
i
,
b
′
,
A
i
′
} to CS.(2)CS computes PI
D
i
=
h
(
I
D
i
∥
b
′
) and B
i
′
=
h
(
PI
D
i
∥
x
) and submits B
i
′ to U
i.(3)U
i computes C
i
′
=
h
(
I
D
i
∥
A
i
′
) and D
i
′
=
B
i
′
⊕
h
(
PI
D
i
⊕
A
i
′
). Finally, the smart card is updated to {
C
i
′
,
D
i
′
,
h
(
·
)
,
b
′
}.(4)S
j selects a random number d
′ and submits {
SI
D
j
,
d
′
} to CS.(5)CS computes PSI
D
j
′
=
h
(
SI
D
j
∥
d
′
) and B
S
j
′
=
h
(
PSI
D
j
′
∥
y
). Then, CS sends B
S
j to S
j. S
j updates {
B
S
j
′
,
d
′
} in its database.


## 2.1. Registration Phase

CS firstly chooses two security elements x and y.(1)U
i selects a password P
i and a random number b. Then, U
i computes A
i
=
h
(
b
∥
P
i
) and sends {
I
D
i
,
b
,
A
i
} to CS through a secure channel.(2)CS computes PI
D
i
=
h
(
I
D
i
∥
b
) and B
i
=
h
(
PI
D
i
∥
x
) and sends B
i to U
i via a secure channel.(3)U
i computes C
i
=
h
(
I
D
i
∥
A
i
) and D
i
=
B
i
⊕
h
(
PI
D
i
⊕
A
i
) and stores {
C
i
,
D
i
,
h
(
·
)
,
b
} into the smart card.


## 2.2. Login and Authentication Phases

(1)U
i inserts his smart card into the terminal and inputs his identity I
D
i and password P
i.(2)U
i computes A
i
=
h
(
b
∥
P
i
) and C
i
′
=
h
(
I
D
i
∥
A
i
) and checks whether C
i
′
=
?
C
i. If it is true, U
i is viewed as a legitimate user. Otherwise, the terminal rejects the login request. Then, U
i computes B
i
=
D
i
⊕
C
i, F
i
=
B
i
⊕
N
i
1, P
i
j
=
h
(
B
i
⊕
h
(
N
i
1
∥
SI
D
j
∥
PI
D
i
∥
T
S
i
)
), CI
D
i
=
I
D
i
⊕
h
(
B
i
∥
N
i
1
∥
T
S
i
∥
“
00
"
), and G
i
=
b
⊕
h
(
B
i
∥
N
i
1
∥
T
S
i
∥
“
11
"
) and transmits {
F
i
,
P
i
j
,
CI
D
i
,
G
i
,
PI
D
i
,
T
S
i
} to S
j.(3)S
j generates a random number d and sends {
SI
D
j
,
b
} to CS. Finally, S
j obtains B
S
j
=
h
(
PSI
D
j
∥
y
) from CS and stores {
B
S
j
,
b
} into its database. When receiving the message from U
i, S
j checks whether T
S
j
-
T
S
i
<
Δ
T is valid and where T
S
j is the current time. If it is true, S
j chooses a number N
i
2 and computes J
i
=
B
S
j
⊕
N
i
2, K
i
=
h
(
N
i
2
∥
B
S
j
∥
P
i
j
∥
T
S
i
), L
i
=
SI
D
j
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
∥
“
00
"
), and M
i
=
d
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
∥
“
11
"
) and transmits {
F
i
,
P
i
j
,
CI
D
i
,
G
i
,
PI
D
i
,
T
S
i
,
J
i
,
K
i
,
L
i
,
M
i
,
PSI
D
j
} to CS.(4)CS checks whether T
S
CS
-
T
S
i
<
Δ
T is valid, where T
S
CS is the current time. If it is true, S
j chooses a random number N
i
2, computes B
S
j
=
h
(
PSI
D
j
∥
y
), N
i
2
=
J
i
⊕
B
S
j, and K
′
=
h
(
N
i
2
∥
B
S
j
∥
P
i
j
∥
T
S
i
) and checks whether K
′
=
?
K. If it is true, CS continues to calculate B
i
=
h
(
PI
D
i
∥
x
), N
i
1
=
F
i
⊕
B
i, SI
D
i
=
L
i
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
∥
“
00
"
), and P
i
j
′
=
h
(
B
i
⊕
h
(
N
i
1
∥
SI
D
j
∥
PI
D
i
∥
T
S
i
)
) and checks whether P
i
j
′
=
?
P
i
j. If it is true, CS chooses a random number N
i
3 and calculates P
i
=
N
i
1
⊕
N
i
3
⊕
h
(
SI
D
j
∥
N
i
2
∥
B
S
j
), Q
i
=
h
(
N
i
1
⊕
N
i
3
), R
i
=
N
i
2
⊕
N
i
3
⊕
h
(
I
D
i
∥
N
i
1
∥
B
i
), and V
i
=
h
(
N
i
2
⊕
N
i
3
). Then, CS delivers {
P
i
,
Q
i
,
R
i
,
V
i
} to S
j.(5)S
j computes N
i
1
⊕
N
i
3
=
P
i
⊕
h
(
SI
D
j
∥
N
i
2
∥
B
S
j
) and Q
i
′
=
h
(
N
i
1
⊕
N
i
3
) and checks whether Q
i
′
=
?
Q
i. If it follows, S
j transmits {
R
i
,
V
i
} to U
i.(6)U
i computes N
i
2
⊕
N
i
3
=
R
i
⊕
h
(
I
D
i
∥
N
i
1
∥
B
i
) and V
i
′
=
h
(
N
i
2
⊕
N
i
3
) and checks whether V
i
′
=
?
V
i. If it follows, CS and S
j are authenticated by U
i. Finally, the common session key SK
=
h
(
(
N
i
1
⊕
N
i
2
⊕
N
i
3
)
∥
T
S
i
) can be shared among U
i, S
j, and CS.


## 2.3. Password Updating Phase

(1)U
i computes C
i
′
=
h
(
I
D
i
∥
A
i
′
) and D
i
′
=
B
i
⊕
h
(
PI
D
i
⊕
A
i
′
) and updates corresponding value in the smart card.(2)U
i submits {
I
D
i
,
A
i
′
} with a new password P
i
′ to CS. Then, CS updates user’s P
i stored in its verification table.


## 2.4. Identity Updating Phase

(1)U
i chooses a random number b
′ and computes A
i
′
=
h
(
b
′
∥
P
i
). Then, U
i submits {
I
D
i
,
b
′
,
A
i
′
} to CS.(2)CS computes PI
D
i
=
h
(
I
D
i
∥
b
′
) and B
i
′
=
h
(
PI
D
i
∥
x
) and submits B
i
′ to U
i.(3)U
i computes C
i
′
=
h
(
I
D
i
∥
A
i
′
) and D
i
′
=
B
i
′
⊕
h
(
PI
D
i
⊕
A
i
′
). Finally, the smart card is updated to {
C
i
′
,
D
i
′
,
h
(
·
)
,
b
′
}.(4)S
j selects a random number d
′ and submits {
SI
D
j
,
d
′
} to CS.(5)CS computes PSI
D
j
′
=
h
(
SI
D
j
∥
d
′
) and B
S
j
′
=
h
(
PSI
D
j
′
∥
y
). Then, CS sends B
S
j to S
j. S
j updates {
B
S
j
′
,
d
′
} in its database.


## 3. Cryptanalysis of Xue et al.’s Protocol

Although Xue et al. claimed that their protocol can resist many types of attacks, the actual situation is not the case. In this section, we analyze the security weaknesses of Xue et al.’s protocol. Through careful analysis, we find that Xue et al.’s protocol is vulnerable to two kinds of masquerade, insider and off-line password guessing attacks. The detailed analyses are described as follows.


### 3.1. Masquerade Attack against a Legitimate User

We here assume that a malicious attackerA can totally control communication channels among U
i, S
j, and CS since the messages are transmitted via a public channel in the login and key agreement phase. Therefore, U
i can intercept, insert, or delete any messages at his will [2]. Once A steals user’s smart card, he can masquerade as U
i through the following steps.(1)A steals U
i’s smart card containing the information {
C
i
,
D
i
,
h
(
·
)
,
b
} [19, 21], where C
i
=
h
(
I
D
i
∥
h
(
b
∥
P
i
)
) and D
i
=
h
(
h
(
I
D
i
∥
b
)
∥
x
)
⊕
h
(
h
(
I
D
i
∥
b
)
⊕
h
(
b
∥
P
i
)
).(2)A can intercept a request message {
F
i
,
P
i
j
,
CI
D
i
,
G
i
,
PI
D
i
,
T
S
i
} of U
i from the public communication channel. Then A can calculate B
i
=
C
i
⊕
D
i, N
i
1
=
B
i
⊕
F
i, and I
D
i
=
CI
D
i
⊕
h
(
B
i
∥
N
i
1
∥
T
S
i
∥
“
00
"
). A can select a random number N
i
1
′ and calculate F
i
=
B
i
⊕
N
i
1
′, P
i
j
=
h
(
B
i
⊕
h
(
N
i
1
′
∥
SI
D
j
∥
h
(
I
D
i
∥
b
)
∥
T
S
i
′
), CI
D
i
=
I
D
i
⊕
h
(
B
i
∥
N
i
1
′
∥
T
S
i
′
∥
“
00
"
), and G
i
=
b
⊕
h
(
B
i
∥
N
i
1
′
∥
T
S
i
′
∥
“
11
"
), where T
S
i
′ is a new timestamp generated by A. Now A can deliver valid request message {
F
i
′
,
P
i
j
′
,
CI
D
i
′
,
G
i
′
,
PI
D
i
,
T
S
i
′
} by masquerading as U
i to S
j.(3) This valid request message fromA is verified by S
j if T
S
j
-
T
S
i
′
<
Δ
T, after A passing authentication by S
j, S
j calculates J
i
=
B
S
j
⊕
N
i
2, K
i
′
=
h
(
N
i
2
∥
B
S
j
∥
P
i
j
∥
T
S
i
′
), L
i
′
=
SI
D
j
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
′
∥
“
00
"
), and M
i
′
=
d
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
′
∥
“
11
"
) and transmits the message {
F
i
′
,
P
i
j
′
,
CI
D
i
′
,
G
i
′
,
PI
D
i
,
T
S
i
′
,
J
i
,
K
i
′
,
L
i
′
,
M
i
′
,
PSI
D
j
} to CS.(4) When receiving the message fromS
j, CS checks whether T
S
CS
-
T
S
i
′
<
Δ
T. If it is true, CS calculates B
S
j
=
h
(
PSI
D
j
∥
y
), N
i
2
=
J
i
⊕
B
S
j, K
i
′
=
h
(
N
i
2
∥
B
S
j
∥
P
i
j
′
∥
T
S
i
′
), B
i
=
h
(
PI
D
i
∥
x
), N
i
1
′
=
F
i
′
⊕
B
i, I
D
i
=
CI
D
i
′
⊕
h
(
B
i
∥
N
i
1
′
∥
T
S
i
′
∥
“
00
"
), SI
D
j
=
L
i
′
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
′
∥
“
00
"
), and P
i
j
′
=
h
(
B
i
⊕
h
(
N
i
1
′
∥
SI
D
j
∥
PI
D
i
∥
T
S
i
′
)
) and checks whether P
i
j
′
=
?
P
i
j. If it is true, CS continues to compute b
=
G
i
′
⊕
h
(
B
i
∥
N
i
1
′
∥
T
S
i
′
∥
“
11
"
), d
=
M
i
′
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
′
∥
“
11
"
), PI
D
i
=
h
(
I
D
i
∥
b
), and PSI
D
j
=
h
(
SI
D
j
∥
d
) and verifies whether PI
D
i and PSI
D
j are equal with the received corresponding values. If they follow, CS selects a random number N
i
3 and computes P
i
=
N
i
1
′
⊕
N
i
3
⊕
h
(
SI
D
j
∥
N
i
2
∥
B
S
j
), Q
i
=
h
(
N
i
1
′
⊕
N
i
3
), R
i
=
N
i
2
⊕
N
i
3
⊕
h
(
I
D
i
∥
N
i
1
′
∥
B
i
), and V
i
=
h
(
N
i
2
⊕
N
i
3
). Then CS sends {
P
i
′
,
Q
i
′
,
R
i
′
,
V
i
} to S
j.(5) After receiving the message fromCS, S
j computes N
i
1
′
⊕
N
i
3
=
P
i
′
⊕
h
(
SI
D
j
∥
N
i
2
∥
B
S
j
) and Q
i
′
=
h
(
N
i
1
′
⊕
N
i
3
) and checks whether Q
i
′
=
?
Q
i. Then, S
j directly transmits {
R
i
′
,
V
i
} to A who is masquerading as U
i.(6) The masquerading userA can verify the received value of  V
i
=
h
(
N
i
2
⊕
N
i
3
) by N
i
2
⊕
N
i
3
=
R
i
′
⊕
h
(
I
D
i
∥
N
i
1
′
∥
B
i
). Finally, A is masquerading as U
i, S
j, and CS agree on the common session key SK
=
h
(
(
N
i
1
′
⊕
N
i
2
⊕
N
i
3
)
∥
T
S
i
′
) and access the services provided by S
j.


### 3.2. Masquerade Attack against a Legitimate Service Providing Server

Assume a malicious attackerA has broken S
j. Then, A can get the secret number B
S
j and perform the following masquerade attack.(1)A has intercepted a valid request message {
F
i
,
P
i
j
,
CI
D
i
,
G
i
,
PI
D
i
,
T
S
i
} sent from U
i to S
j in the public communication. Then, A computes J
i
=
B
S
j
⊕
N
i
2
′, K
i
=
h
(
N
i
2
′
∥
B
S
j
∥
P
i
j
∥
T
S
i
), L
i
=
SI
D
j
⊕
h
(
B
S
j
∥
N
i
2
′
∥
T
S
i
∥
“
00
"
), and M
i
=
d
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
∥
“
11
"
), where N
i
2
′ is a random number generated by A. Then A transmits the message {
F
i
,
P
i
j
,
CI
D
i
,
G
i
,
PI
D
i
,
T
S
i
′
,
J
i
,
K
i
,
L
i
,
M
i
,
PSI
D
j
} to CS.(2) Upon receiving the message,CS carries out a series of computations and verifications according to his original protocol without being detected since CS has no operation to validate the correctness of B
S
j. Finally, CS sends {
P
i
,
Q
i
,
R
i
,
V
i
} to A who is masquerading as S
i.(3) The masquerading severA can verify the received value of Q
i
=
h
(
N
i
1
⊕
N
i
3
) through N
i
1
⊕
N
i
3
=
P
i
⊕
h
(
SI
D
j
∥
N
i
2
′
∥
B
S
j
). Then the masquerading sever A delivers the message {
R
i
,
V
i
} to U
i.(4) When receiving the message fromA who is masquerading as S
j, U
i computes N
i
2
⊕
N
i
3
=
R
i
⊕
h
(
I
D
i
∥
N
i
1
′
∥
B
i
) and V
i
′
=
h
(
N
i
2
⊕
N
i
3
) and verifies V
i
′ with the received value of V
i. U
i will notify A that the attacker who is masquerading as the sever S
j is the service providing server. Therefore, A can further establish a session key SK
=
h
(
N
i
1
⊕
N
i
2
′
⊕
N
i
3
∥
T
S
i
′
) with U
i and CS.


### 3.3. Off-Line Password Guessing Attack

A malicious attackerA stealing user’s smart card can gather information {
C
i
,
D
i
,
h
(
·
)
,
b
} from the memory of the stolen smart card [19, 21].(1)A intercepts a request message {
F
i
,
P
i
j
,
CI
D
i
,
G
i
,
PI
D
i
,
T
S
i
} delivered from U
i to S
j in the public communication channel.(2)A guesses a password P
i
′ to compute A
i
′
=
h
(
b
∥
P
i
′
) and checks whether h
(
PI
D
i
⊕
A
i
′
)
=
?
C
i. If it is true, A has guessed the correct password. Otherwise, A repeatedly guesses a new password until he succeeds.(3)A can also launch an off-line guessing attack on PI
D
i
=
h
(
I
D
i
∥
b
) to obtain the identity I
D
i of U
i since A knows the value of b from the stolen smart card of U
i.(4)A possesses the valid smart card of U
i and knows the identity I
D
i and the password P
i corresponding to U
i and hence can login to any service server.


### 3.4. Insider Attack

In general, the password is human memorable short strings. That is, password is not high-entropy keys [20]. Therefore, the following attack is feasible in practice.(1) In the registration phase,U
i sends {
I
D
i
,
b
,
A
i
} to CS, where A
i
=
h
(
b
∥
P
i
); P
i is the password of U
i. Then, a malicious insider attacker A can guess a password P
i and therefore it is not difficult for A to find out user’s exact password P
i from A
i by performing an off-line password guessing attack.(2)A tries to use identity-password pair (
I
D
i
,
P
i
) of U
i, following the password authentication of Xue et al.’s protocol and can successfully login to the other servers.


## 3.1. Masquerade Attack against a Legitimate User

We here assume that a malicious attackerA can totally control communication channels among U
i, S
j, and CS since the messages are transmitted via a public channel in the login and key agreement phase. Therefore, U
i can intercept, insert, or delete any messages at his will [2]. Once A steals user’s smart card, he can masquerade as U
i through the following steps.(1)A steals U
i’s smart card containing the information {
C
i
,
D
i
,
h
(
·
)
,
b
} [19, 21], where C
i
=
h
(
I
D
i
∥
h
(
b
∥
P
i
)
) and D
i
=
h
(
h
(
I
D
i
∥
b
)
∥
x
)
⊕
h
(
h
(
I
D
i
∥
b
)
⊕
h
(
b
∥
P
i
)
).(2)A can intercept a request message {
F
i
,
P
i
j
,
CI
D
i
,
G
i
,
PI
D
i
,
T
S
i
} of U
i from the public communication channel. Then A can calculate B
i
=
C
i
⊕
D
i, N
i
1
=
B
i
⊕
F
i, and I
D
i
=
CI
D
i
⊕
h
(
B
i
∥
N
i
1
∥
T
S
i
∥
“
00
"
). A can select a random number N
i
1
′ and calculate F
i
=
B
i
⊕
N
i
1
′, P
i
j
=
h
(
B
i
⊕
h
(
N
i
1
′
∥
SI
D
j
∥
h
(
I
D
i
∥
b
)
∥
T
S
i
′
), CI
D
i
=
I
D
i
⊕
h
(
B
i
∥
N
i
1
′
∥
T
S
i
′
∥
“
00
"
), and G
i
=
b
⊕
h
(
B
i
∥
N
i
1
′
∥
T
S
i
′
∥
“
11
"
), where T
S
i
′ is a new timestamp generated by A. Now A can deliver valid request message {
F
i
′
,
P
i
j
′
,
CI
D
i
′
,
G
i
′
,
PI
D
i
,
T
S
i
′
} by masquerading as U
i to S
j.(3) This valid request message fromA is verified by S
j if T
S
j
-
T
S
i
′
<
Δ
T, after A passing authentication by S
j, S
j calculates J
i
=
B
S
j
⊕
N
i
2, K
i
′
=
h
(
N
i
2
∥
B
S
j
∥
P
i
j
∥
T
S
i
′
), L
i
′
=
SI
D
j
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
′
∥
“
00
"
), and M
i
′
=
d
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
′
∥
“
11
"
) and transmits the message {
F
i
′
,
P
i
j
′
,
CI
D
i
′
,
G
i
′
,
PI
D
i
,
T
S
i
′
,
J
i
,
K
i
′
,
L
i
′
,
M
i
′
,
PSI
D
j
} to CS.(4) When receiving the message fromS
j, CS checks whether T
S
CS
-
T
S
i
′
<
Δ
T. If it is true, CS calculates B
S
j
=
h
(
PSI
D
j
∥
y
), N
i
2
=
J
i
⊕
B
S
j, K
i
′
=
h
(
N
i
2
∥
B
S
j
∥
P
i
j
′
∥
T
S
i
′
), B
i
=
h
(
PI
D
i
∥
x
), N
i
1
′
=
F
i
′
⊕
B
i, I
D
i
=
CI
D
i
′
⊕
h
(
B
i
∥
N
i
1
′
∥
T
S
i
′
∥
“
00
"
), SI
D
j
=
L
i
′
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
′
∥
“
00
"
), and P
i
j
′
=
h
(
B
i
⊕
h
(
N
i
1
′
∥
SI
D
j
∥
PI
D
i
∥
T
S
i
′
)
) and checks whether P
i
j
′
=
?
P
i
j. If it is true, CS continues to compute b
=
G
i
′
⊕
h
(
B
i
∥
N
i
1
′
∥
T
S
i
′
∥
“
11
"
), d
=
M
i
′
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
′
∥
“
11
"
), PI
D
i
=
h
(
I
D
i
∥
b
), and PSI
D
j
=
h
(
SI
D
j
∥
d
) and verifies whether PI
D
i and PSI
D
j are equal with the received corresponding values. If they follow, CS selects a random number N
i
3 and computes P
i
=
N
i
1
′
⊕
N
i
3
⊕
h
(
SI
D
j
∥
N
i
2
∥
B
S
j
), Q
i
=
h
(
N
i
1
′
⊕
N
i
3
), R
i
=
N
i
2
⊕
N
i
3
⊕
h
(
I
D
i
∥
N
i
1
′
∥
B
i
), and V
i
=
h
(
N
i
2
⊕
N
i
3
). Then CS sends {
P
i
′
,
Q
i
′
,
R
i
′
,
V
i
} to S
j.(5) After receiving the message fromCS, S
j computes N
i
1
′
⊕
N
i
3
=
P
i
′
⊕
h
(
SI
D
j
∥
N
i
2
∥
B
S
j
) and Q
i
′
=
h
(
N
i
1
′
⊕
N
i
3
) and checks whether Q
i
′
=
?
Q
i. Then, S
j directly transmits {
R
i
′
,
V
i
} to A who is masquerading as U
i.(6) The masquerading userA can verify the received value of  V
i
=
h
(
N
i
2
⊕
N
i
3
) by N
i
2
⊕
N
i
3
=
R
i
′
⊕
h
(
I
D
i
∥
N
i
1
′
∥
B
i
). Finally, A is masquerading as U
i, S
j, and CS agree on the common session key SK
=
h
(
(
N
i
1
′
⊕
N
i
2
⊕
N
i
3
)
∥
T
S
i
′
) and access the services provided by S
j.


## 3.2. Masquerade Attack against a Legitimate Service Providing Server

Assume a malicious attackerA has broken S
j. Then, A can get the secret number B
S
j and perform the following masquerade attack.(1)A has intercepted a valid request message {
F
i
,
P
i
j
,
CI
D
i
,
G
i
,
PI
D
i
,
T
S
i
} sent from U
i to S
j in the public communication. Then, A computes J
i
=
B
S
j
⊕
N
i
2
′, K
i
=
h
(
N
i
2
′
∥
B
S
j
∥
P
i
j
∥
T
S
i
), L
i
=
SI
D
j
⊕
h
(
B
S
j
∥
N
i
2
′
∥
T
S
i
∥
“
00
"
), and M
i
=
d
⊕
h
(
B
S
j
∥
N
i
2
∥
T
S
i
∥
“
11
"
), where N
i
2
′ is a random number generated by A. Then A transmits the message {
F
i
,
P
i
j
,
CI
D
i
,
G
i
,
PI
D
i
,
T
S
i
′
,
J
i
,
K
i
,
L
i
,
M
i
,
PSI
D
j
} to CS.(2) Upon receiving the message,CS carries out a series of computations and verifications according to his original protocol without being detected since CS has no operation to validate the correctness of B
S
j. Finally, CS sends {
P
i
,
Q
i
,
R
i
,
V
i
} to A who is masquerading as S
i.(3) The masquerading severA can verify the received value of Q
i
=
h
(
N
i
1
⊕
N
i
3
) through N
i
1
⊕
N
i
3
=
P
i
⊕
h
(
SI
D
j
∥
N
i
2
′
∥
B
S
j
). Then the masquerading sever A delivers the message {
R
i
,
V
i
} to U
i.(4) When receiving the message fromA who is masquerading as S
j, U
i computes N
i
2
⊕
N
i
3
=
R
i
⊕
h
(
I
D
i
∥
N
i
1
′
∥
B
i
) and V
i
′
=
h
(
N
i
2
⊕
N
i
3
) and verifies V
i
′ with the received value of V
i. U
i will notify A that the attacker who is masquerading as the sever S
j is the service providing server. Therefore, A can further establish a session key SK
=
h
(
N
i
1
⊕
N
i
2
′
⊕
N
i
3
∥
T
S
i
′
) with U
i and CS.


## 3.3. Off-Line Password Guessing Attack

A malicious attackerA stealing user’s smart card can gather information {
C
i
,
D
i
,
h
(
·
)
,
b
} from the memory of the stolen smart card [19, 21].(1)A intercepts a request message {
F
i
,
P
i
j
,
CI
D
i
,
G
i
,
PI
D
i
,
T
S
i
} delivered from U
i to S
j in the public communication channel.(2)A guesses a password P
i
′ to compute A
i
′
=
h
(
b
∥
P
i
′
) and checks whether h
(
PI
D
i
⊕
A
i
′
)
=
?
C
i. If it is true, A has guessed the correct password. Otherwise, A repeatedly guesses a new password until he succeeds.(3)A can also launch an off-line guessing attack on PI
D
i
=
h
(
I
D
i
∥
b
) to obtain the identity I
D
i of U
i since A knows the value of b from the stolen smart card of U
i.(4)A possesses the valid smart card of U
i and knows the identity I
D
i and the password P
i corresponding to U
i and hence can login to any service server.


## 3.4. Insider Attack

In general, the password is human memorable short strings. That is, password is not high-entropy keys [20]. Therefore, the following attack is feasible in practice.(1) In the registration phase,U
i sends {
I
D
i
,
b
,
A
i
} to CS, where A
i
=
h
(
b
∥
P
i
); P
i is the password of U
i. Then, a malicious insider attacker A can guess a password P
i and therefore it is not difficult for A to find out user’s exact password P
i from A
i by performing an off-line password guessing attack.(2)A tries to use identity-password pair (
I
D
i
,
P
i
) of U
i, following the password authentication of Xue et al.’s protocol and can successfully login to the other servers.


## 4. Our Improved Protocol

In this section, we propose an enhanced and simple ID based authentication protocol to remedy the weaknesses of Xue et al.’s protocol. Our protocol has three phases; that is, registration, login, and authentication are shown in Box2, and password update.Box 2:Login and authentication phases of our improved protocol.
U
i                 S
j              C
S
(1)Input
I
D
i, P
i,             (3) Generate  N
i
2,      (5) Check
A
i
=
h
(
b
∥
P
i
),               P
S
I
D
j
=
B
S
j
⊕
z,       P
i
j
′
=
K
i
⊕
M
i
⊕
P
S
I
D
j,
Check
C
i
′
=
h
I
D
i
∥
A
i
∥
h
(
y
)
=
?
C
i      P
i
j
=
P
S
I
D
j
⊕
F
i,       P
i
j
i
=
h
(
P
I
D
i
∥
A
i
∥
h
y
)
,
P
i
j
=
h
(
P
I
D
i
∥
A
i
∥
h
(
y
)
),
K
i
=
P
S
I
D
j
⊕
N
i
2,
P
i
j
′
=
?
P
i
j.
F
i
=
h
(
S
I
D
j
∥
h
(
y
)
)
⊕
P
i
j,
M
i
=
P
i
j
⊕
N
i
2.
N
i
1
=
G
i
⊕
h
(
A
i
∥
P
I
D
i
∥
S
I
D
j
∥
h
(
y
)
),
Generate
N
i
1,                   →
4
K
i
,
M
i
,
G
i
N
i
2
=
P
i
j
⊕
M
i,
G
i
=
h
(
A
i
∥
P
I
D
i
∥
S
I
D
j
∥
h
(
y
)
)
⊕
N
i
1.                 R
i
=
h
(
N
i
1
⊕
A
i
)
,
V
i
=
h
(
N
i
2
⊕
P
S
I
D
j
),
→
2
F
i
,
G
i              Generate
N
i
3,
P
i
=
N
i
1
⊕
N
i
2
⊕
N
i
3
⊕
h
(
I
D
i
∥
N
i
1
∥
P
i
j
),
Q
i
=
N
i
1
⊕
N
i
2
⊕
N
i
3
⊕
h
(
P
S
I
D
j
∥
N
i
2
∥
P
i
j).
(
9
)
c
h
e
c
k                 ←
6
P
i
,
Q
i
,
V
i
,
R
i
R
i
′
=
h
N
i
1
⊕
A
i
=
?
R
i.           (
7
) V
i
′
=
h
(
N
i
2
⊕
P
S
I
D
j
)
=
?
V
i,
N
i
2
⊕
N
i
3
=
h
(
I
D
i
∥
N
i
1
∥
P
i
j
)
⊕
P
i.       N
i
1
⊕
N
i
3
=
h
(
P
S
I
D
j
∥
N
i
2
∥
P
i
j
)
⊕
Q
i.
←
8
R
i
,
P
i
↔
S
K
=
h
(
N
i
1
⊕
N
i
2
⊕
N
i
3
∣
∣
h
(
P
i
j
)
)


### 4.1. Registration Phase

The registration phase ofU
i is as follows.(1)U
i generates a random number b and computes A
i
=
h
(
b
∥
P
i
). Then, U
i submits {
I
D
i
,
A
i
} to control sever CS.(2) Upon receiving message fromU
i, CS first generates a random number d and computes B
i
=
h
(
A
i
∥
d
) and PI
D
i
=
h
(
I
D
i
∥
h
(
y
)
). Then, CS stores {
B
i
,
PI
D
i
} into a smart card and returns it to U
i.(3)U
i computes C
i
=
h
(
I
D
i
∥
h
(
y
)
∥
A
i
) and stores the information {
B
i
,
C
i
,
h
(
y
)
} into the smart card.The registration phase ofS
j is as follows.(1)S
j submits his identity SI
D
j to CS.(2) WhenCS receives a registration request from S
j, CS generates a random number e and computes PSI
D
j
=
h
(
SI
D
j
∥
e
). Then, CS sends PSI
D
j to S
j.(3)S
j stores PSI
D
j by computing B
S
j
=
PSI
D
j
⊕
z, where z is the secret key of S
j.


### 4.2. Login and Authentication Phases

(1)U
i inserts his smart card into device and enters his identity I
D
i and password P
i. Then, the smart card validates the entered I
D
i and P
i by checking whether C
i
′
=
h
(
I
D
i
∥
h
(
b
∥
P
i
)
∥
h
(
y
)
) is equal to the stored C
i. If it holds, the smart card generates a random number N
i
1 and computes P
i
j
=
h
(
PI
D
i
∥
A
i
∥
h
(
y
)
), F
i
=
h
(
SI
D
j
∥
h
(
y
)
)
⊕
P
i
j, and G
i
=
h
(
A
i
∥
PI
D
i
∥
SI
D
j
∥
h
(
y
)
)
⊕
N
i
1. Finally, U
i submits {
F
i
,
G
i
} to S
j.(2) Upon receiving the message fromU
i, S
j first extracts PSI
D
j from B
S
j by using his secret key z and generates a random number N
i
2. Then, S
j computes P
i
j
=
PSI
D
j
⊕
F
i, K
i
=
PSI
D
j
⊕
N
i
2, and M
i
=
P
i
j
⊕
N
i
2 and transmits {
G
i
,
K
i
,
M
i
} to CS.(3)CS first checks whether P
i
j
′
=
h
(
PI
D
i
∥
A
i
∥
h
(
y
)
)
=
?
P
i
j. If it is true, CS generates a random number N
i
3 and computes R
i
=
h
(
N
i
1
⊕
A
i
), V
i
=
h
(
N
i
2
⊕
PSI
D
j
), N
i
1
=
G
i
⊕
h
(
A
i
∥
PI
D
i
∥
SI
D
j
∥
h
(
y
)
), N
i
2
=
P
i
j
⊕
M
i, P
i
=
N
i
1
⊕
N
i
2
⊕
N
i
3
⊕
h
(
I
D
i
∥
N
i
1
∥
P
i
j
), and Q
i
=
N
i
1
⊕
N
i
2
⊕
N
i
3
⊕
h
(
PSI
D
j
∥
N
i
2
∥
P
i
j
). Finally, CS delivers {
R
i
,
V
i
,
P
i
,
Q
i
} to S
j.(4)S
j directly verifies V
i
′
=
h
(
N
i
2
⊕
PSI
D
j
)
=
?
V
i. If it holds, S
j calculates N
i
1
⊕
N
i
3
=
h
(
PSI
D
j
∥
N
i
2
∥
P
i
j
)
⊕
Q
i and sends {
R
i
,
P
i
} to U
i.(5) Upon receiving the message fromS
j, U
i first checks whether R
i
′
=
h
(
N
i
1
⊕
A
i
)
=
?
R
i and then computes N
i
2
⊕
N
i
3
=
h
(
I
D
i
∥
N
i
1
∥
P
i
j
)
⊕
P
i. Finally, a session key SK
=
h
(
N
i
1
⊕
N
i
2
⊕
N
i
3
∥
h
(
P
i
j
)
) is established among U
i, S
j, and CS.


### 4.3. Password Updating Phase

WhenU
i changes original password by simply inserting the smart card into a device and he can finish this process without any assistance from CS.U
i generates a random b
′ and a new password P
i
′; then U
i computes A
i
′
=
h
(
b
′
∥
P
i
). Then, the smart card will compute C
i
′
=
h
(
A
i
′
∥
I
D
i
∥
b
′
) and replace C
i with C
i
′.


## 4.1. Registration Phase

The registration phase ofU
i is as follows.(1)U
i generates a random number b and computes A
i
=
h
(
b
∥
P
i
). Then, U
i submits {
I
D
i
,
A
i
} to control sever CS.(2) Upon receiving message fromU
i, CS first generates a random number d and computes B
i
=
h
(
A
i
∥
d
) and PI
D
i
=
h
(
I
D
i
∥
h
(
y
)
). Then, CS stores {
B
i
,
PI
D
i
} into a smart card and returns it to U
i.(3)U
i computes C
i
=
h
(
I
D
i
∥
h
(
y
)
∥
A
i
) and stores the information {
B
i
,
C
i
,
h
(
y
)
} into the smart card.The registration phase ofS
j is as follows.(1)S
j submits his identity SI
D
j to CS.(2) WhenCS receives a registration request from S
j, CS generates a random number e and computes PSI
D
j
=
h
(
SI
D
j
∥
e
). Then, CS sends PSI
D
j to S
j.(3)S
j stores PSI
D
j by computing B
S
j
=
PSI
D
j
⊕
z, where z is the secret key of S
j.


## 4.2. Login and Authentication Phases

(1)U
i inserts his smart card into device and enters his identity I
D
i and password P
i. Then, the smart card validates the entered I
D
i and P
i by checking whether C
i
′
=
h
(
I
D
i
∥
h
(
b
∥
P
i
)
∥
h
(
y
)
) is equal to the stored C
i. If it holds, the smart card generates a random number N
i
1 and computes P
i
j
=
h
(
PI
D
i
∥
A
i
∥
h
(
y
)
), F
i
=
h
(
SI
D
j
∥
h
(
y
)
)
⊕
P
i
j, and G
i
=
h
(
A
i
∥
PI
D
i
∥
SI
D
j
∥
h
(
y
)
)
⊕
N
i
1. Finally, U
i submits {
F
i
,
G
i
} to S
j.(2) Upon receiving the message fromU
i, S
j first extracts PSI
D
j from B
S
j by using his secret key z and generates a random number N
i
2. Then, S
j computes P
i
j
=
PSI
D
j
⊕
F
i, K
i
=
PSI
D
j
⊕
N
i
2, and M
i
=
P
i
j
⊕
N
i
2 and transmits {
G
i
,
K
i
,
M
i
} to CS.(3)CS first checks whether P
i
j
′
=
h
(
PI
D
i
∥
A
i
∥
h
(
y
)
)
=
?
P
i
j. If it is true, CS generates a random number N
i
3 and computes R
i
=
h
(
N
i
1
⊕
A
i
), V
i
=
h
(
N
i
2
⊕
PSI
D
j
), N
i
1
=
G
i
⊕
h
(
A
i
∥
PI
D
i
∥
SI
D
j
∥
h
(
y
)
), N
i
2
=
P
i
j
⊕
M
i, P
i
=
N
i
1
⊕
N
i
2
⊕
N
i
3
⊕
h
(
I
D
i
∥
N
i
1
∥
P
i
j
), and Q
i
=
N
i
1
⊕
N
i
2
⊕
N
i
3
⊕
h
(
PSI
D
j
∥
N
i
2
∥
P
i
j
). Finally, CS delivers {
R
i
,
V
i
,
P
i
,
Q
i
} to S
j.(4)S
j directly verifies V
i
′
=
h
(
N
i
2
⊕
PSI
D
j
)
=
?
V
i. If it holds, S
j calculates N
i
1
⊕
N
i
3
=
h
(
PSI
D
j
∥
N
i
2
∥
P
i
j
)
⊕
Q
i and sends {
R
i
,
P
i
} to U
i.(5) Upon receiving the message fromS
j, U
i first checks whether R
i
′
=
h
(
N
i
1
⊕
A
i
)
=
?
R
i and then computes N
i
2
⊕
N
i
3
=
h
(
I
D
i
∥
N
i
1
∥
P
i
j
)
⊕
P
i. Finally, a session key SK
=
h
(
N
i
1
⊕
N
i
2
⊕
N
i
3
∥
h
(
P
i
j
)
) is established among U
i, S
j, and CS.


## 4.3. Password Updating Phase

WhenU
i changes original password by simply inserting the smart card into a device and he can finish this process without any assistance from CS.U
i generates a random b
′ and a new password P
i
′; then U
i computes A
i
′
=
h
(
b
′
∥
P
i
). Then, the smart card will compute C
i
′
=
h
(
A
i
′
∥
I
D
i
∥
b
′
) and replace C
i with C
i
′.


## 5. Security Analysis of Our Improved Protocol

In this section, we first adopt Burrows-Abadi-Needham (BAN) logic [22] to prove that a session key between communicating parties can be correctly generated within authentication process. Then, we conduct a security analysis of the improved protocol to show that the improved protocol can withstand all possible security attacks. The following attacks are based on the assumptions that a malicious attacker A has completely monitored the communication channel in login and authentication phases. So A can eavesdrop, modify, insert, or delete any messages transmitted via public channel [2].


### 5.1. Verifying Authentication with BAN Logic

BAN logic has been highly successful in analyzing the security of authentication schemes [23]. We introduce some notations of BAN logic as follows:A
≡
X
:  A believes a statement X;
A
↔
K
B
: share a key K between A and B;
#
X
:  X is fresh;
A
⊲
X
:  A sees X;
A
⇒
X
:  A controls X;
A
~
X
:  A said X;
X
,
Y
K
:  X and Y are hashed with the key K;
X
K
:  X is XORed with the key K.We introduce logical postulates of BAN logic that we used into our protocol as follows.(1)
BAN logical postulates are as follows.
(a)
Message-meaning rule: ConsiderA
|
≡
A
↔
K
B
,
A
⊲
X
K
/
A
|
≡
|
B
~
X; if A believes that the key K is shared by A and B and sees X encrypted with K, then A believes that B once said X.
(b)
Nonce-verification rule: ConsiderA
|
≡
#
(
X
)
,
A
|
≡
B
|
~
X
/
A
|
≡
B
|
≡
X; if A believes that X could have been uttered only recently and that B once said X, then A believes that B believes X.
(c)
The belief rule: ConsiderA
|
≡
X
,
A
|
≡
Y
/
A
|
≡
(
X
,
Y
); if A believes X and Y, then A believes (
X
,
Y
).
(d)
Fresh conjuncatenation rule: ConsiderA
|
≡
#
(
X
)
/
A
|
≡
#
(
X
,
Y
); if A believes freshness of X, then B believes freshness of (
X
,
Y
).
(e)
Jurisdiction rule: ConsiderA
|
≡
B
⇒
X
,
A
|
≡
B
|
≡
X
/
A
|
≡
X; if A believes that B has jurisdiction over X and A trusts B on the truth of X, then A believes X.
(f)
Introduction of the session key: ConsiderA
|
≡
#
(
SK
)
,
A
|
≡
B
|
≡
#
(
SK
)
/
A
|
≡
A
↔
B; if A believes that the session key SK is fresh and B believes X, which are the necessary elements for a key, then A believes that he/she shares the session key SK with B.
(2)
Establishment of security goals:
(
g
1
)
U
i
|
≡
U
i
↔
SK
S
j;
(
g
2
)
U
i
|
≡
S
j
|
≡
U
i
↔
SK
S
j;
(
g
3
)
S
j
|
≡
U
i
↔
S
K
S
j;
(
g
4
)
S
j
|
≡
U
i
|
≡
U
i
↔
SK
S
j;
(
g
5
)
CS
|
≡
S
j
↔
SK
CS;
(
g
6
)
CS
|
≡
S
j
|
≡
S
j
↔
SK
CS;
(
g
7
)
S
j
|
≡
S
j
↔
SK
CS;
(
g
8
)
S
j
|
≡
CS
|
≡
S
j
↔
SK
CS;
(
g
9
)
U
i
|
≡
U
i
↔
SK
CS;
(
g
10
)
U
i
|
≡
CS
|
≡
U
i
↔
SK
CS;
(
g
11
)
CS
|
≡
U
i
↔
SK
CS;
(
g
12
)
CS
|
≡
U
i
|
≡
U
i
↔
SK
CS.
(3)
Idealized protocol:
U
i
:
P
i
j
h
(
SI
D
j
∥
h
(
y
)
), I
D
i
∥
h
b
∥
P
i
∥
SI
D
j
∥
h
y
N
i
1;
S
j
:
N
i
2
h
(
SI
D
j
∥
e
), P
i
j
N
i
2;
CS:
P
i
j
,
I
D
i
N
i
1
,
N
i
2
,
N
i
3, PSI
D
j
,
P
i
j
N
i
1
,
N
i
2
,
N
i
3, N
i
1
h
(
P
i
∥
b
), N
i
2
h
(
SI
D
j
∥
e
).
(4)
Initiative premises:
(
p
1
)
U
i
|
≡
#
N
i
1;
(
p
2
)
U
i
|
≡
#
N
i
2;
(
p
3
)
U
i
|
≡
#
N
i
3;
(
p
4
)
S
j
|
≡
#
N
i
1;
(
p
5
)
S
j
|
≡
#
N
i
2;
(
p
6
)
S
j
|
≡
#
N
i
3;
(
p
7
)
CS
|
≡
#
N
i
1;
(
p
8
)
CS
|
≡
#
N
i
2;
(
p
9
)
CS
|
≡
#
N
i
3;
(
p
10
)
S
j
|
≡
S
j
↔
h
(
y
)
CS;
(
p
11
)
U
i
|
≡
I
D
i;
(
p
12
)
U
i
|
≡
(
P
i
,
b
)
(
p
13
)
S
j
|
≡
(
SI
D
j
,
e
);
(
p
14
)
CS
|
≡
U
i
⇒
(
P
i
,
b
);
(
p
15
)
CS
|
≡
U
i
⇒
P
i
j.
(5)
Protocol analysis:
(
a
1
)
By(
p
1
)
–
(
p
3
) and U
i
⊲
(
P
i
j
,
I
D
i
)
N
i
1
,
N
i
2
,
N
i
3, we obtain U
i
|
≡
N
i
1
,
N
i
2
,
N
i
3;
(
a
2
)
byU
i
⊲
(
P
i
j
,
I
D
i
)
N
i
1
,
N
i
2
,
N
i
3 and (
a
1
), we apply the message-meaning rule to derive U
i
|
≡
S
j
~
P
i
j;
(
a
3
)
by(
a
2
), we apply the freshness conjuncatenation rule and the nonce-verification rule to derive U
i
|
≡
S
j
|
≡
P
i
j;
(
g
1
)
by(
a
3
), (
p
1
)
–
(
p
3
), and introduction of the session keys, we get U
i
≡
U
i
|
↔
SK
S
j;
(
g
2
)
by(
g
1
) and (
p
1
)
–
(
p
3
), we apply the nonce-verification rule to derive U
i
|
≡
S
j
|
≡
U
i
|
↔
SK
S
j;
(
a
4
)
by(
p
10
) and S
j
⊲
P
i
j
h
(
SI
D
j
∥
h
(
y
)
), we obtain S
j
|
≡
h
(
SI
D
j
∥
h
(
y
)
);
(
a
5
)
byS
j
⊲
P
i
j
h
(
SI
D
j
∥
h
(
y
)
) and (
a
1
), we apply the message-meaning rule to derive S
j
|
≡
U
i
~
P
i
j;
(
a
6
)
by(
a
5
), we apply the fresh conjuncatenation rule and the nonce-verification rule to derive S
j
|
≡
U
i
|
≡
P
i
j;
(
g
3
)
by(
a
6
), (
p
4
)
–
(
p
6
), and introduction of the session keys, we get S
j
|
≡
U
i
|
≡
U
i
|
↔
SK
S
j;
(
g
4
)
by(
g
3
) and (
p
4
)
–
(
p
6
), we apply the nonce-verification rule to derive S
j
|
≡
U
i
|
≡
U
i
|
↔
SK
S
j;
(
a
7
)
by(
p
6
)
–
(
p
8
) and CS
⊲
P
i
j
N
i
2, we apply the message-meaning rule, the fresh conjuncatenation rule, and the nonce-verification rule to derive CS
|
≡
U
i
|
≡
P
i
j;
(
a
8
)
by(
p
12
), (
p
14
)
-
(
p
15
), and (
a
7
), we apply the jurisdiction rule and the belief rule to derive CS
|
≡
P
i
j;
(
a
9
)
by(
a
10
), (
p
8
), and CS
⊲
P
i
j
N
i
2, we apply the fresh conjuncatenation rule and the nonce-verification rule to derive CS
|
≡
S
j
|
≡
P
i
j;
(
g
5
)
by(
a
9
), (
p
6
)
–
(
p
8
), and introduction of the session keys, we get CS
|
≡
S
j
|
↔
SK
CS;
(
g
6
)
by(
g
5
) and (
p
6
)
–
(
p
8
), we apply the nonce-verification rule to derive CS
|
≡
S
j
|
≡
S
j
|
↔
SK
CS;
(
a
10
)
by(
a
9
), (
p
4
)
–
(
p
6
), and S
j
⊲
(
PSI
D
j
,
P
i
j
)
N
i
1
,
N
i
2
,
N
i
3, we apply the message-meaning rule, the fresh conjuncatenation rule, and the nonce-verification rule to derive S
j
|
≡
CS
|
≡
P
i
j;
(
g
7
)
by(
a
10
), (
p
4
)
–
(
p
6
), and introduction of the session keys, we get S
j
|
≡
S
j
|
↔
SK
CS;
(
g
8
)
by(
g
7
) and (
p
4
)
–
(
p
6
), we apply the nonce-verification rule to derive S
j
|
≡
CS
|
≡
S
j
|
↔
SK
CS;
(
a
11
)
by(
p
1
)
–
(
p
3
), (
p
11
) and U
i
⊲
(
I
D
i
,
P
i
j
)
N
i
1
,
N
i
2
,
N
i
3, we apply the belief rule to derive U
i
|
≡
P
i
j;
(
a
12
)
by(
a
11
) and U
i
⊲
(
I
D
i
,
P
i
j
)
N
i
1
,
N
i
2
,
N
i
3, we apply the message-meaning rule, the fresh conjuncatenation rule, and the nonce-verification rule to derive U
i
|
≡
CS
|
≡
P
i
j;
(
g
9
)
by(
a
12
), (
p
1
)
–
(
p
3
), and introduction of the session keys, we get U
i
|
≡
U
i
|
↔
SK
CS;
(
g
10
)
by(
g
9
) and (
p
1
)
–
(
p
3
), we apply the nonce-verification rule to derive U
i
|
≡
CS
|
≡
U
i
|
↔
SK
CS;
(
a
13
)
by(
p
7
) and CS
⊲
I
D
i
∥
h
(
b
∥
P
i
)
∥
SI
D
j
∥
h
(
y
)
N
i
1, we apply the message-meaning rule, the fresh conjuncatenation rule, and the nonce-verification rule to derive CS
|
≡
U
i
|
≡
(
I
D
i
∥
h
(
b
∥
P
i
)
∥
S
I
D
j
∥
h
(
y
)
);
(
a
14
)
by(
a
13
) and (
p
10
)
–
(
p
12
), (
p
15
), we apply the belief rule to derive CS
|
≡
U
i
|
≡
P
i
j;
(
g
11
)
by(
a
14
), (
p
6
)
–
(
p
8
), and introduction of the session keys, we get CS
|
≡
U
i
|
↔
SK
CS;
(
g
12
)
by(
g
11
) and (
p
6
)
–
(
p
8
), we apply the nonce-verification rule to derive CS
|
≡
U
i
|
≡
U
i
|
↔
SK
CS;As a result, analyzing the security of our protocol with BAN logic, we can now be sure that the proposed protocol is truly capable of achieving the goals.


### 5.2. Masquerade Attack

Assume a malicious attackerA has extracted [19, 21] the information {
B
i
,
C
i
,
h
(
y
)
} stored in the smart card. Furthermore, A intercepts a request message {
F
i
,
G
i
} and tries to masquerade the legal user to compute the session key SK. However, it is impossible for A to forge a valid login request {
F
i
,
G
i
} because A does not know the identity I
D
i and the random number b of U
i, which will result in A incorrectly computing the value of A
i
=
h
(
P
i
∥
b
). The identity I
D
i and A
i of U
i are all protected by the one-way hash function, and thus it is computationally infeasible to derive A
i and I
D
i from the values B
i
=
h
(
A
i
∥
d
) and C
i
=
h
(
I
D
i
∥
A
i
∥
h
(
y
)
), respectively. Thus, masquerade attack as U
i is infeasible to the proposed protocol. On the other hand, suppose A intercepts a message {
F
i
,
G
i
} and {
K
i
,
M
i
,
G
i
} and tries to masquerade as S
j to authenticate by CS, he will fail because he cannot compute the correct P
i
j. Besides, it is also impossible to forge K
i without the knowledge of secret key z of S
j. Thus, masquerade attack as S
j is also infeasible to the proposed protocol.


### 5.3. Insider Attack with Smart Card

Our proposed protocol provides user registration using cipher codeA
i
=
h
(
P
i
∥
b
) over a secret channel. Even if a malicious attacker A has gotten [19, 21] the information {
B
i
,
C
i
,
h
(
y
)
} stored in the smart card, he cannot guess the parameter b which avoids the inherent risk of stolen passwords. Thus, our protocol resists insider attack.


### 5.4. Replay Attack

Replay attack means a malicious attackerA must not obtain sensitive information by replaying previously transmitted messages [24]. If a malicious attacker A wants to replay the same messages of the sender or the receiver, it is clear that user cannot succeed because U
i, S
j, and CS chooses different random numbers (
N
i
1
,
N
i
2
,
N
i
3
) in each new session. Besides, A cannot compute the session key SK
=
h
(
N
i
1
⊕
N
i
2
⊕
N
i
3
∥
h
(
P
i
j
)
) correctly since the parameter P
i
j is not directly exposed in public channel. Thus, A has no opportunity to successfully replay used messages.


### 5.5. Mutual Authentication

Our protocol can provide mutual authentication amongU
i, S
j, and CS.(1)CS authenticates S
j by computing the message P
i
j
=
h
(
PI
D
i
∥
A
i
∥
h
(
y
)
) with its own memory comparing with the receiving message P
i
j
′
=
K
i
⊕
PSI
D
i
⊕
M
i, where both of K
i and M
i come from S
j. Furthermore, the authentication of CS to U
i is completely dependent on the authentication of CS to S
j since obtained P
i
j of S
j is directly derived from U
i.(2)CS is authenticated by verifying the computed R
i
′
=
h
(
N
i
1
∥
I
D
i
) and V
i
′
=
h
(
N
i
2
∥
PSI
D
j
) with the received R
i and V
i, respectively. At the same time, the authentication of U
i to S
j is completely dependent on the authentication of U
i to CS since V
i
=
h
(
I
D
i
∥
N
i
1
) transmitted by S
j is headed from CS.


### 5.6. Off-Line Password Guessing Attack

Assume a malicious attackerA has stolen the smart card and extracted [19, 21] the information {
B
i
,
C
i
,
h
(
y
)
} from it. Moreover, A has eavesdropped the request message {
F
i
,
G
i
}. If A tries to obtain the identity I
D
i and password P
i correctly at the same time, A first should obtain A
i
=
h
(
b
∥
P
i
). It is obviously impossible to get A
i from B
i
=
h
(
A
i
∥
d
) since it is protected by a one-way hash function and a random number d. Thus, the proposed protocol is secure against the off-line password guessing attack.


### 5.7. The Session Key Perfect Forward Secrecy

Even if a malicious attackerA obtains all of participants’ secret keys and previous session keys, he still cannot compromise session key SK
=
h
(
N
i
1
⊕
N
i
2
⊕
N
i
3
∥
h
(
P
i
j
)
). Since in each session a fresh session key is generated depending on (
N
i
1
,
N
i
2
,
N
i
3
,
P
i
j
) and the secret differs in every session. Thus, the proposed protocol can provide the session key perfect forward secrecy.


### 5.8. Stolen Smart Card Attack

Even thoughA has read [19, 21] the information B
i
,
C
i
,
h
y from the stolen smart card,   A cannot get real identity I
D
i and the password P
i correctly at the same time since they are protected by a one-way hash function and two random numbers (b
,
d). Thus, it is not possible to guess these two parameters correctly at the same time in polynomial time. Therefore, the proposed protocol is secure against the stolen smart card attack.


### 5.9. Not Requiring Clock Synchronization

In timestamps authentication protocols, the clocks of all devices must be synchronized [25]. In our protocol, we provide random numbers based authentication mechanism, instead of the timestamps that cause serious time synchronization problems.


## 5.1. Verifying Authentication with BAN Logic

BAN logic has been highly successful in analyzing the security of authentication schemes [23]. We introduce some notations of BAN logic as follows:A
≡
X
:  A believes a statement X;
A
↔
K
B
: share a key K between A and B;
#
X
:  X is fresh;
A
⊲
X
:  A sees X;
A
⇒
X
:  A controls X;
A
~
X
:  A said X;
X
,
Y
K
:  X and Y are hashed with the key K;
X
K
:  X is XORed with the key K.We introduce logical postulates of BAN logic that we used into our protocol as follows.(1)
BAN logical postulates are as follows.
(a)
Message-meaning rule: ConsiderA
|
≡
A
↔
K
B
,
A
⊲
X
K
/
A
|
≡
|
B
~
X; if A believes that the key K is shared by A and B and sees X encrypted with K, then A believes that B once said X.
(b)
Nonce-verification rule: ConsiderA
|
≡
#
(
X
)
,
A
|
≡
B
|
~
X
/
A
|
≡
B
|
≡
X; if A believes that X could have been uttered only recently and that B once said X, then A believes that B believes X.
(c)
The belief rule: ConsiderA
|
≡
X
,
A
|
≡
Y
/
A
|
≡
(
X
,
Y
); if A believes X and Y, then A believes (
X
,
Y
).
(d)
Fresh conjuncatenation rule: ConsiderA
|
≡
#
(
X
)
/
A
|
≡
#
(
X
,
Y
); if A believes freshness of X, then B believes freshness of (
X
,
Y
).
(e)
Jurisdiction rule: ConsiderA
|
≡
B
⇒
X
,
A
|
≡
B
|
≡
X
/
A
|
≡
X; if A believes that B has jurisdiction over X and A trusts B on the truth of X, then A believes X.
(f)
Introduction of the session key: ConsiderA
|
≡
#
(
SK
)
,
A
|
≡
B
|
≡
#
(
SK
)
/
A
|
≡
A
↔
B; if A believes that the session key SK is fresh and B believes X, which are the necessary elements for a key, then A believes that he/she shares the session key SK with B.
(2)
Establishment of security goals:
(
g
1
)
U
i
|
≡
U
i
↔
SK
S
j;
(
g
2
)
U
i
|
≡
S
j
|
≡
U
i
↔
SK
S
j;
(
g
3
)
S
j
|
≡
U
i
↔
S
K
S
j;
(
g
4
)
S
j
|
≡
U
i
|
≡
U
i
↔
SK
S
j;
(
g
5
)
CS
|
≡
S
j
↔
SK
CS;
(
g
6
)
CS
|
≡
S
j
|
≡
S
j
↔
SK
CS;
(
g
7
)
S
j
|
≡
S
j
↔
SK
CS;
(
g
8
)
S
j
|
≡
CS
|
≡
S
j
↔
SK
CS;
(
g
9
)
U
i
|
≡
U
i
↔
SK
CS;
(
g
10
)
U
i
|
≡
CS
|
≡
U
i
↔
SK
CS;
(
g
11
)
CS
|
≡
U
i
↔
SK
CS;
(
g
12
)
CS
|
≡
U
i
|
≡
U
i
↔
SK
CS.
(3)
Idealized protocol:
U
i
:
P
i
j
h
(
SI
D
j
∥
h
(
y
)
), I
D
i
∥
h
b
∥
P
i
∥
SI
D
j
∥
h
y
N
i
1;
S
j
:
N
i
2
h
(
SI
D
j
∥
e
), P
i
j
N
i
2;
CS:
P
i
j
,
I
D
i
N
i
1
,
N
i
2
,
N
i
3, PSI
D
j
,
P
i
j
N
i
1
,
N
i
2
,
N
i
3, N
i
1
h
(
P
i
∥
b
), N
i
2
h
(
SI
D
j
∥
e
).
(4)
Initiative premises:
(
p
1
)
U
i
|
≡
#
N
i
1;
(
p
2
)
U
i
|
≡
#
N
i
2;
(
p
3
)
U
i
|
≡
#
N
i
3;
(
p
4
)
S
j
|
≡
#
N
i
1;
(
p
5
)
S
j
|
≡
#
N
i
2;
(
p
6
)
S
j
|
≡
#
N
i
3;
(
p
7
)
CS
|
≡
#
N
i
1;
(
p
8
)
CS
|
≡
#
N
i
2;
(
p
9
)
CS
|
≡
#
N
i
3;
(
p
10
)
S
j
|
≡
S
j
↔
h
(
y
)
CS;
(
p
11
)
U
i
|
≡
I
D
i;
(
p
12
)
U
i
|
≡
(
P
i
,
b
)
(
p
13
)
S
j
|
≡
(
SI
D
j
,
e
);
(
p
14
)
CS
|
≡
U
i
⇒
(
P
i
,
b
);
(
p
15
)
CS
|
≡
U
i
⇒
P
i
j.
(5)
Protocol analysis:
(
a
1
)
By(
p
1
)
–
(
p
3
) and U
i
⊲
(
P
i
j
,
I
D
i
)
N
i
1
,
N
i
2
,
N
i
3, we obtain U
i
|
≡
N
i
1
,
N
i
2
,
N
i
3;
(
a
2
)
byU
i
⊲
(
P
i
j
,
I
D
i
)
N
i
1
,
N
i
2
,
N
i
3 and (
a
1
), we apply the message-meaning rule to derive U
i
|
≡
S
j
~
P
i
j;
(
a
3
)
by(
a
2
), we apply the freshness conjuncatenation rule and the nonce-verification rule to derive U
i
|
≡
S
j
|
≡
P
i
j;
(
g
1
)
by(
a
3
), (
p
1
)
–
(
p
3
), and introduction of the session keys, we get U
i
≡
U
i
|
↔
SK
S
j;
(
g
2
)
by(
g
1
) and (
p
1
)
–
(
p
3
), we apply the nonce-verification rule to derive U
i
|
≡
S
j
|
≡
U
i
|
↔
SK
S
j;
(
a
4
)
by(
p
10
) and S
j
⊲
P
i
j
h
(
SI
D
j
∥
h
(
y
)
), we obtain S
j
|
≡
h
(
SI
D
j
∥
h
(
y
)
);
(
a
5
)
byS
j
⊲
P
i
j
h
(
SI
D
j
∥
h
(
y
)
) and (
a
1
), we apply the message-meaning rule to derive S
j
|
≡
U
i
~
P
i
j;
(
a
6
)
by(
a
5
), we apply the fresh conjuncatenation rule and the nonce-verification rule to derive S
j
|
≡
U
i
|
≡
P
i
j;
(
g
3
)
by(
a
6
), (
p
4
)
–
(
p
6
), and introduction of the session keys, we get S
j
|
≡
U
i
|
≡
U
i
|
↔
SK
S
j;
(
g
4
)
by(
g
3
) and (
p
4
)
–
(
p
6
), we apply the nonce-verification rule to derive S
j
|
≡
U
i
|
≡
U
i
|
↔
SK
S
j;
(
a
7
)
by(
p
6
)
–
(
p
8
) and CS
⊲
P
i
j
N
i
2, we apply the message-meaning rule, the fresh conjuncatenation rule, and the nonce-verification rule to derive CS
|
≡
U
i
|
≡
P
i
j;
(
a
8
)
by(
p
12
), (
p
14
)
-
(
p
15
), and (
a
7
), we apply the jurisdiction rule and the belief rule to derive CS
|
≡
P
i
j;
(
a
9
)
by(
a
10
), (
p
8
), and CS
⊲
P
i
j
N
i
2, we apply the fresh conjuncatenation rule and the nonce-verification rule to derive CS
|
≡
S
j
|
≡
P
i
j;
(
g
5
)
by(
a
9
), (
p
6
)
–
(
p
8
), and introduction of the session keys, we get CS
|
≡
S
j
|
↔
SK
CS;
(
g
6
)
by(
g
5
) and (
p
6
)
–
(
p
8
), we apply the nonce-verification rule to derive CS
|
≡
S
j
|
≡
S
j
|
↔
SK
CS;
(
a
10
)
by(
a
9
), (
p
4
)
–
(
p
6
), and S
j
⊲
(
PSI
D
j
,
P
i
j
)
N
i
1
,
N
i
2
,
N
i
3, we apply the message-meaning rule, the fresh conjuncatenation rule, and the nonce-verification rule to derive S
j
|
≡
CS
|
≡
P
i
j;
(
g
7
)
by(
a
10
), (
p
4
)
–
(
p
6
), and introduction of the session keys, we get S
j
|
≡
S
j
|
↔
SK
CS;
(
g
8
)
by(
g
7
) and (
p
4
)
–
(
p
6
), we apply the nonce-verification rule to derive S
j
|
≡
CS
|
≡
S
j
|
↔
SK
CS;
(
a
11
)
by(
p
1
)
–
(
p
3
), (
p
11
) and U
i
⊲
(
I
D
i
,
P
i
j
)
N
i
1
,
N
i
2
,
N
i
3, we apply the belief rule to derive U
i
|
≡
P
i
j;
(
a
12
)
by(
a
11
) and U
i
⊲
(
I
D
i
,
P
i
j
)
N
i
1
,
N
i
2
,
N
i
3, we apply the message-meaning rule, the fresh conjuncatenation rule, and the nonce-verification rule to derive U
i
|
≡
CS
|
≡
P
i
j;
(
g
9
)
by(
a
12
), (
p
1
)
–
(
p
3
), and introduction of the session keys, we get U
i
|
≡
U
i
|
↔
SK
CS;
(
g
10
)
by(
g
9
) and (
p
1
)
–
(
p
3
), we apply the nonce-verification rule to derive U
i
|
≡
CS
|
≡
U
i
|
↔
SK
CS;
(
a
13
)
by(
p
7
) and CS
⊲
I
D
i
∥
h
(
b
∥
P
i
)
∥
SI
D
j
∥
h
(
y
)
N
i
1, we apply the message-meaning rule, the fresh conjuncatenation rule, and the nonce-verification rule to derive CS
|
≡
U
i
|
≡
(
I
D
i
∥
h
(
b
∥
P
i
)
∥
S
I
D
j
∥
h
(
y
)
);
(
a
14
)
by(
a
13
) and (
p
10
)
–
(
p
12
), (
p
15
), we apply the belief rule to derive CS
|
≡
U
i
|
≡
P
i
j;
(
g
11
)
by(
a
14
), (
p
6
)
–
(
p
8
), and introduction of the session keys, we get CS
|
≡
U
i
|
↔
SK
CS;
(
g
12
)
by(
g
11
) and (
p
6
)
–
(
p
8
), we apply the nonce-verification rule to derive CS
|
≡
U
i
|
≡
U
i
|
↔
SK
CS;As a result, analyzing the security of our protocol with BAN logic, we can now be sure that the proposed protocol is truly capable of achieving the goals.


## 5.2. Masquerade Attack

Assume a malicious attackerA has extracted [19, 21] the information {
B
i
,
C
i
,
h
(
y
)
} stored in the smart card. Furthermore, A intercepts a request message {
F
i
,
G
i
} and tries to masquerade the legal user to compute the session key SK. However, it is impossible for A to forge a valid login request {
F
i
,
G
i
} because A does not know the identity I
D
i and the random number b of U
i, which will result in A incorrectly computing the value of A
i
=
h
(
P
i
∥
b
). The identity I
D
i and A
i of U
i are all protected by the one-way hash function, and thus it is computationally infeasible to derive A
i and I
D
i from the values B
i
=
h
(
A
i
∥
d
) and C
i
=
h
(
I
D
i
∥
A
i
∥
h
(
y
)
), respectively. Thus, masquerade attack as U
i is infeasible to the proposed protocol. On the other hand, suppose A intercepts a message {
F
i
,
G
i
} and {
K
i
,
M
i
,
G
i
} and tries to masquerade as S
j to authenticate by CS, he will fail because he cannot compute the correct P
i
j. Besides, it is also impossible to forge K
i without the knowledge of secret key z of S
j. Thus, masquerade attack as S
j is also infeasible to the proposed protocol.


## 5.3. Insider Attack with Smart Card

Our proposed protocol provides user registration using cipher codeA
i
=
h
(
P
i
∥
b
) over a secret channel. Even if a malicious attacker A has gotten [19, 21] the information {
B
i
,
C
i
,
h
(
y
)
} stored in the smart card, he cannot guess the parameter b which avoids the inherent risk of stolen passwords. Thus, our protocol resists insider attack.


## 5.4. Replay Attack

Replay attack means a malicious attackerA must not obtain sensitive information by replaying previously transmitted messages [24]. If a malicious attacker A wants to replay the same messages of the sender or the receiver, it is clear that user cannot succeed because U
i, S
j, and CS chooses different random numbers (
N
i
1
,
N
i
2
,
N
i
3
) in each new session. Besides, A cannot compute the session key SK
=
h
(
N
i
1
⊕
N
i
2
⊕
N
i
3
∥
h
(
P
i
j
)
) correctly since the parameter P
i
j is not directly exposed in public channel. Thus, A has no opportunity to successfully replay used messages.


## 5.5. Mutual Authentication

Our protocol can provide mutual authentication amongU
i, S
j, and CS.(1)CS authenticates S
j by computing the message P
i
j
=
h
(
PI
D
i
∥
A
i
∥
h
(
y
)
) with its own memory comparing with the receiving message P
i
j
′
=
K
i
⊕
PSI
D
i
⊕
M
i, where both of K
i and M
i come from S
j. Furthermore, the authentication of CS to U
i is completely dependent on the authentication of CS to S
j since obtained P
i
j of S
j is directly derived from U
i.(2)CS is authenticated by verifying the computed R
i
′
=
h
(
N
i
1
∥
I
D
i
) and V
i
′
=
h
(
N
i
2
∥
PSI
D
j
) with the received R
i and V
i, respectively. At the same time, the authentication of U
i to S
j is completely dependent on the authentication of U
i to CS since V
i
=
h
(
I
D
i
∥
N
i
1
) transmitted by S
j is headed from CS.


## 5.6. Off-Line Password Guessing Attack

Assume a malicious attackerA has stolen the smart card and extracted [19, 21] the information {
B
i
,
C
i
,
h
(
y
)
} from it. Moreover, A has eavesdropped the request message {
F
i
,
G
i
}. If A tries to obtain the identity I
D
i and password P
i correctly at the same time, A first should obtain A
i
=
h
(
b
∥
P
i
). It is obviously impossible to get A
i from B
i
=
h
(
A
i
∥
d
) since it is protected by a one-way hash function and a random number d. Thus, the proposed protocol is secure against the off-line password guessing attack.


## 5.7. The Session Key Perfect Forward Secrecy

Even if a malicious attackerA obtains all of participants’ secret keys and previous session keys, he still cannot compromise session key SK
=
h
(
N
i
1
⊕
N
i
2
⊕
N
i
3
∥
h
(
P
i
j
)
). Since in each session a fresh session key is generated depending on (
N
i
1
,
N
i
2
,
N
i
3
,
P
i
j
) and the secret differs in every session. Thus, the proposed protocol can provide the session key perfect forward secrecy.


## 5.8. Stolen Smart Card Attack

Even thoughA has read [19, 21] the information B
i
,
C
i
,
h
y from the stolen smart card,   A cannot get real identity I
D
i and the password P
i correctly at the same time since they are protected by a one-way hash function and two random numbers (b
,
d). Thus, it is not possible to guess these two parameters correctly at the same time in polynomial time. Therefore, the proposed protocol is secure against the stolen smart card attack.


## 5.9. Not Requiring Clock Synchronization

In timestamps authentication protocols, the clocks of all devices must be synchronized [25]. In our protocol, we provide random numbers based authentication mechanism, instead of the timestamps that cause serious time synchronization problems.


## 6.  Performance and Functionality Analysis

In this section, we compare our protocol with other related protocols regarding performance and security. It is crucial for smart card based schemes to provide low computation cost due to the smart card possesses the power constraints and small flash memory [26]. We take the login phase and authentication phase into consideration since these two are the principal part of an authentication protocol. To analyze the computational complexity of the protocols, we use hashing operation as the time complexity since xor operations require very little computations. Figure 1 shows comparison regarding the performance. From this comparison, we can see that our proposed protocol has almost the least computation costs compared with other’s protocols. Hence, our proposed protocol is very useful in environments of limited computation and communication resources to access remote information systems.Figure 1
Performance comparison.Table1 lists the functionality comparisons of our proposed protocol with Sood et al.’s protocol [16], Li et al.’s protocol [17], and Xue et al.’s protocol [18]. We can see that the proposed protocol not only provides proper mutual authentication and perfect forward secrecy but also can prevent masquerade attack and other attacks. As a result, the proposed protocol is more secure and has many functionalities compared with these related protocols.Table 1
Functionality comparison.
Ours
Xue et al. [18]
Li et al. [17]
Sood et al. [16]
Provide mutual authentication
Yes
Yes
Yes
Yes
Provide perfect forward secrecy
Yes
Yes
Yes
Yes
Resist insider attack
Yes
No
No
No
Resist masquerade attack
Yes
No
No
No
Resist replay attack
Yes
Yes
No
No
No time synchronization
Yes
No
Yes
Yes


## 7. Conclusion

In this paper, we have shown that Xue et al.’s protocol cannot really protect against masquerade attack, off-line password guessing, and insider attacks. In order to avoid these security weaknesses, a slight modification without using timestamps to their protocol is proposed to improve their shortcomings. Moreover, we discussed the security of the proposed protocol and showed that it conforms to all desirable security attributes. Finally, we compared the proposed protocol and existing competitive protocols regarding efficiency and security and showed that the proposed protocol is more secure and has the least computation costs. Therefore, our protocol is able to satisfy all of the essential requirements for multiserver environments. In the future, we will propose a cryptanalysis scheme [27] to prove that our authentication mechanism is secure. Moreover, we will evaluate our scheme for the energy and communication overheads using some network simulator for practical implementation. In addition, we will continue to extend our study to combine a user’s biometrics [28] and discuss the biometrics matching issue in detail.



---

*Source: 635890-2015-03-04.xml*