# Improved ECC-Based Three-Factor Multiserver Authentication Scheme

Authors: Tsu-Yang Wu; Lei Yang; Zhiyuan Lee; Chien-Ming Chen; Jeng-Shyang Pan; SK Hafizul Islam
Journal: Security and Communication Networks
 (2021)

---

## Abstract

A multiserver environment can improve the efficiency of mobile network services more effectively than a single server in managing the increase in users. Because of the large number of users, the security of users’ personal information and communication information is more important in a multiserver environment. Recently, Wang et al. proposed a multiserver authentication scheme based on biometrics and proved the security of their scheme. However, we first demonstrate that their scheme is insecure against a known session-specific temporary information attacks, user impersonation attacks, and server impersonation attacks. To solve the security weakness, we propose an improved scheme based on Wang et al.’s scheme. The security of our improved scheme is also validated based on the formal security analysis, Burrows–Abadi–Needham (BAN) logic, ProVerif, and informal security analysis. Security and performance comparisons prove the security and efficiency of our scheme.


---

## Body

## 1. Introduction

With the development of information technologies [1–8] and the widespread application of the Internet of Things [9–12], mobile communication has emerged in many network communication environments. The multiserver environments in mobile communication improve the efficiency of user communications; therefore, it is more popular than single-server environments for users. The multiserver environment overcomes the limited storage and computing of the single-server environment and can provide more remote services. A typical multiserver environment is shown in Figure 1.Figure 1
Typical multiserver environment.Owing to the convenience of multiserver environments, authentication problems in the communication process cannot be disregarded. To date, three methods can be used to achieve user authentication in the environment. The first is password-based authentication [13–17]. This is the simplest method to perform authentication; however, an attacker can easily guess or steal a password from a party and impersonate as a valid user. The second is two-factor authentication, which is based on a password and a smart card [18–24]. Compared with password-based authentication, two-factor authentication improves security. However, if the smart card is stolen, then the information stored in the smart card may be recovered. This will result in well-known attacks, such as offline guessing attacks. In the past few years, Wang et al. have proposed some two-factor authentication schemes in different application scenarios. In 2014, they proposed an anonymous two-factor authentication scheme in a distributed system [19]. In the same year, they proposed an anonymous two-factor authentication scheme in a wireless sensor network [20]. In 2016, Wang et al. [25] compared and evaluated some representative two-factor authentication schemes and proposed a new evaluation standard for two-factor authentication schemes. In 2018, Wang et al. [26] proposed an evaluation framework for a two-factor authentication scheme for real-time data access in industrial wireless sensor networks and evaluated the relevant schemes. The third is three-factor authentication, which is based on passwords, smart cards, and biometrics [27–39]. In a public channel, an attacker may eavesdrop, modify, or replay transmitted messages. This poses a significant threat to the security of users. Because only the password- or smart card-based authentication scheme exhibits low security, applying biometrics to authentication schemes can overcome the insecurity of password- or smart card-based schemes. Therefore, a secure and efficient authentication scheme based on biometrics must be designed.Compared with Rivest–Shamir-Adleman (RSA) or ElGaml cryptosystems, elliptic curve cryptography (ECC) provides a small key size and computation efficiency under the same security level. In recent years, several biometric-based authentication schemes based on ECC have been proposed. In 2013, Pippal et al. [27] proposed a three-factor authentication scheme in a multiserver environment and claimed that their scheme can overcome all types of network attacks. In 2014, He and Wang [28] proposed a multiserver environment authentication scheme based on robust biometrics, claiming that their scheme was the first three-factor authentication scheme applicable to multiserver environments. In 2015, Odelu et al. [30] reported that the scheme proposed in [28] was vulnerable to a known session-specific temporary information attack and an impersonation attack and hence did not provide strong user anonymity; therefore, they proposed a secure multiserver authentication protocol based on biometric technology using smart cards. In the same year, Li et al. [31] discovered that Pippal et al.’ s [27] scheme can provide incorrect authentication but could not overcome impersonation, stolen smart card, and internal attacks. Therefore, Li et al. [31] proposed an improved scheme to overcome the problems above. In 2017, Kumari et al. [32] proposed a provable secure multicloud server authentication scheme based on biometrics. However, in 2018, Feng et al. [33] discovered that the scheme presented in [32] could not guarantee user anonymity, three-factor security, perfect forward security, etc.; hence, they proposed a multiserver environment authentication scheme based on anonymous biometrics. In the same year, Ali and Pal [34] analyzed Li et al.’s [31] scheme and discovered that it could not overcome password-guessing, user impersonation, insider, and smart card theft attacks nor could they guarantee user anonymity. Ali and Pal [34] proposed a three-factor multiserver authentication scheme based on an elliptic curve cryptosystem to solve the abovementioned issues. Unfortunately, Wang et al. [36] discovered that the scheme presented in [34] was vulnerable to user impersonation, server impersonation, privileged insider, and denial-of-service attacks, among others, and could not provide both forward and three-factor confidentiality. Therefore, Wang et al. proposed an improved multiserver authentication scheme based on biometrics and claimed that their scheme can overcome offline password-guessing, user impersonation, server impersonation, known specific session temporary information, three-factor security, user anonymity, and privileged internal attacks. Some important related works are summarized in Table 1.Table 1
The summary of authentication schemes.
SchemeCryptographic techniquesLimitationsPippal et al. [27](1) Utilized one-way hash function(2) Based on Diffie–Hellman problem(3) Based on smart card(1) Does not resist impersonation attacks(2) Does not resist internal attacksLi et al. [31](1) Utilized one-way hash function(2) Based on Diffie–Hellman problem(3) Based on smart card(1) Does not resist password-guessing attacks(2) Does not resist impersonation attacks(3) Does not resist internal attacks(4) Does not resist smart card theft attacks(5) Does not support user anonymityKumari et al. [32](1) Based on biometrics(2) Utilized one-way hash function(3) Based on anonymous authentication(1) Does not support user anonymity(2) Does not resist man-in-the-middle attacksFeng et al. [33](1) Utilized ECC(2) Based on smart card(3) Based on biometrics(1) Does not provide three-factor secrecy(2) Does not resist known session-specific temporary information attackAli and Pal [34](1) Utilized ECC(2) Three-factor security(3) Based on data encryption scheme(1) Does not resist impersonation attacks(2) Does not resist internal attacks(3) Does not provide forward secrecy(4) Does not provide three-factor secrecy(5) Does not resist known session-specific temporary information attackWang et al. [36](1) Utilized ECC(2) Based on biometrics(3) Based on data encryption scheme(1) Does not resist impersonation attacks(2) Does not resist known session-specific temporary information attackIn this study, we investigated Wang et al.‘s scheme subject to known session-specific temporary information, user impersonation, and server impersonation attacks. To overcome the abovementioned attacks, we refer to Wang et al.’s scheme and propose an improved authentication scheme. Finally, we demonstrate that our scheme is semantically secure in the ROR model and overcome known attacks using the ProVerif tool and the BAN logic.The remainder of this paper is organized as follows. A simple review and cryptanalysis of the scheme proposed by Wang et al. is discussed inSections 2 and 3, respectively. Section 4 elaborates the proposed scheme in detail. Section 5 demonstrates the security analysis of the proposed scheme. Section 6 presents a comparison of performance and security. Section 7 summarizes the paper.


## 2. Review of Wang et al.’s Scheme

Wang et al.’s scheme includes initialization, server and user registration, and login authentication phases. Their scheme involves three types of entities: users, servers, and a registration center. The notations used in the scheme and their descriptions are shown in Table2.Table 2
Notations and descriptions.
NotationsDescriptionsRCThe registration centerServerjThej-th serverUseriThei-th userAThe attackerPpubThe public key ofRCH⋅Hash functionh⋅Biohash functionIDiUser identityPWiUser’s passwordbiUser’s biometricsSCSmart cardSKSession keyConcatenation⊕Bitwise XOREkey⋅/Dkey⋅Symmetric encryption/decryption algorithm with key


### 2.1. Initialization

In this phase, the registration centerRC selects an elliptic curve Eq, and the basic point P of Eq defines two hash functions H⋅ and h⋅. Subsequently, the RC selects a random number x and computes the public key Ppub=xP, where x is the RC’s secret key and publishes Eq,P,Ppub,H⋅,h⋅.


### 2.2. Server and User Registration

The serverServerj selects its identity SIDj and sends its identity to the RC through a secure channel. The RC receives this message, computes SMj=HSIDjx, and sends SMj to Serverj. When Serverj receives SMj, it stores it as the secret key.The userUseri selects his IDi and PWi and imprints bi. Subsequently, Useri selects a random number ri, computes Pi=HPWi|hbi|ri, and sends IDi,Pi to the RC. The RC receives this message and calculates the following:(1)Ai=HxIDi,Bi=Ai⊕Pi,Vi=HPi⊕HIDimodn,where 24≤n≤28. Note that HPi⊕HIDi is the technique of fuzzy-verifier [40]. The RC stores Bi,Vi,Ekey⋅,P,Ppub,n in the smart card SC and then sends the SC to Useri in a secure channel. Subsequently, Useri stores ri in the SC.


### 2.3. Login and Authentication

In this phase,Useri and Serverj complete a mutual authentication and establish a session key SK with the aid of the RC.Step 1
Useri enters IDi and PWi, imprints bi, and logins the SC. Subsequently, the SC computes(2)Pi′=HPWihbiri,Vi′=HPi′⊕HIDimodn,and verifies ifVi′=Vi. If they are equal, then Useri generates a random number N1 and computes(3)Ai′=Bi⊕Pi′,Ri=N1P,Ci=HN1Ppub,Li=ECiIDiAi′SIDj.Next,Useri sends Ri,Li to the RC in the public channel.Step 2
After theRC receives Ri,Li, it computes(4)Ci′=HxRi,IDiAi′SIDj=DCi′Li,Ai=HxIDi,and verifies ifAi′=Ai. If they are equal, then the RC computes(5)SMj=HSIDjx,Yi=HSIDjSMj,Mi=ESMjIDiRiYiHAiCi′.Next, theRC sends Mi to Serverj in the public channel.Step 3
AfterServerj receives Mi, it computes(6)IDiRiYiHAiCi′=DSMjMi,Yi′=HSIDjSMj,and verifies ifYi′=Yi. If they are equal, then Serverj generates a random number N2 and computes(7)RS=N2P,Ei=N2Ri,SKj=HEiHAiCi′,Fi=HIDiSKjRSSIDj.Subsequently,Serverj sends Rs,Fi to Useri in the public channel.Step 4
AfterUseri receives Rs,Fi, he computes(8)Ei′=N1RS,SKi=HEi′HAiCi,Fi′=HIDiSKiRSSIDj,and verifies ifFi′=Fi. If they are equal, then Useri computes(9)Qi=HSKiRS.Next,Useri sends Qi to Serverj in the public channel.Step 5
AfterServerj receives Qi, it computes(10)Qi′=HSKjRS,and verifies ifQi′=Qi. If they are equal, then SKi=SKj is the session key for Useri and Serverj.


## 2.1. Initialization

In this phase, the registration centerRC selects an elliptic curve Eq, and the basic point P of Eq defines two hash functions H⋅ and h⋅. Subsequently, the RC selects a random number x and computes the public key Ppub=xP, where x is the RC’s secret key and publishes Eq,P,Ppub,H⋅,h⋅.


## 2.2. Server and User Registration

The serverServerj selects its identity SIDj and sends its identity to the RC through a secure channel. The RC receives this message, computes SMj=HSIDjx, and sends SMj to Serverj. When Serverj receives SMj, it stores it as the secret key.The userUseri selects his IDi and PWi and imprints bi. Subsequently, Useri selects a random number ri, computes Pi=HPWi|hbi|ri, and sends IDi,Pi to the RC. The RC receives this message and calculates the following:(1)Ai=HxIDi,Bi=Ai⊕Pi,Vi=HPi⊕HIDimodn,where 24≤n≤28. Note that HPi⊕HIDi is the technique of fuzzy-verifier [40]. The RC stores Bi,Vi,Ekey⋅,P,Ppub,n in the smart card SC and then sends the SC to Useri in a secure channel. Subsequently, Useri stores ri in the SC.


## 2.3. Login and Authentication

In this phase,Useri and Serverj complete a mutual authentication and establish a session key SK with the aid of the RC.Step 1
Useri enters IDi and PWi, imprints bi, and logins the SC. Subsequently, the SC computes(2)Pi′=HPWihbiri,Vi′=HPi′⊕HIDimodn,and verifies ifVi′=Vi. If they are equal, then Useri generates a random number N1 and computes(3)Ai′=Bi⊕Pi′,Ri=N1P,Ci=HN1Ppub,Li=ECiIDiAi′SIDj.Next,Useri sends Ri,Li to the RC in the public channel.Step 2
After theRC receives Ri,Li, it computes(4)Ci′=HxRi,IDiAi′SIDj=DCi′Li,Ai=HxIDi,and verifies ifAi′=Ai. If they are equal, then the RC computes(5)SMj=HSIDjx,Yi=HSIDjSMj,Mi=ESMjIDiRiYiHAiCi′.Next, theRC sends Mi to Serverj in the public channel.Step 3
AfterServerj receives Mi, it computes(6)IDiRiYiHAiCi′=DSMjMi,Yi′=HSIDjSMj,and verifies ifYi′=Yi. If they are equal, then Serverj generates a random number N2 and computes(7)RS=N2P,Ei=N2Ri,SKj=HEiHAiCi′,Fi=HIDiSKjRSSIDj.Subsequently,Serverj sends Rs,Fi to Useri in the public channel.Step 4
AfterUseri receives Rs,Fi, he computes(8)Ei′=N1RS,SKi=HEi′HAiCi,Fi′=HIDiSKiRSSIDj,and verifies ifFi′=Fi. If they are equal, then Useri computes(9)Qi=HSKiRS.Next,Useri sends Qi to Serverj in the public channel.Step 5
AfterServerj receives Qi, it computes(10)Qi′=HSKjRS,and verifies ifQi′=Qi. If they are equal, then SKi=SKj is the session key for Useri and Serverj.


## 3. Cryptanalysis of Wang et al.’s Scheme

In this section, we demonstrate Wang et al.’s scheme subject to three security attacks. In our proposed attacks, we assumed that the attackerA is a legitimate user and has already registered with the RC.


### 3.1. Known Session-Specific Temporary Information Attack

A known session-specific temporary information attack refers to a security attack in which an attacker attempts to obtain the currentSK when temporary secret values such as random numbers are disclosed [41].In this attack, we assume that the attackerA obtains temporary information N1 and captures Ri,Li and Rs,Fi, which are transmitted over the public channel. Based on the above, A can compute(11)Ci=HN1Ppub,IDiAi′SIDj=DCiLi,Ei′=N1RS.Subsequently,A obtains Ci, Ai′, and Ei′; hence, it can determine SK=HEi′HAi′Ci. Furthermore, based on the formulas above, A can obtain the user’s IDi; in other words, the user’s anonymity is not protected.


### 3.2. User Impersonation Attack

Step 1
Based onSection 3.1, A can obtain IDi,Ai′, and SIDj. Subsequently, A generates a random number NA and computes(12)RA=NAP,CA=HNAPpub,LA=ECAIDiAi′SIDj.A fakes Useri to send RA,LA to the RC.Step 2
Upon receivingRA,LA, the RC computes(13)CA′=HxRA,IDiAi′SIDj=DCA′LA,Ai=HxIDi.It is clear thatAi′=Ai. Next, the RC computes(14)SMj=HSIDjx,Yi=HSIDjSMj,MA=ESMjIDiRAYiHAiCA′,and sendsMA to Serverj.Step 3
After receivingMA, Serverj computes(15)IDiRAYiHAiCA′=DSMjMA,Yi′=HSIDjSMj.It is clear thatYi′=Yi. Next, Serverj generates a random number N2 and computes(16)RS=N2P,EA=N2RA,SKjA=HEAHAiCA′,FA=HIDiSKjARSSIDj,and sendsRS,FA to Useri.Step 4
A intercepts the massage RS,FA and computes(17)EA′=NARS,SKA=HEA′HAiCA,FA′=HIDiSKARSSIDj.It is clear thatFA′=FA. Next,A computes(18)QA=HSKARS,and sendsQA to Serverj.Step 5
Upon receivingQA, Serverj computes QA′=HSKjARS. It is clear that QA′=QA. During this process, the server regards A as Useri.


### 3.3. Server Impersonation Attack

This attack is also based onCi, IDi, Ai′, and SIDj in Section 3.1. When Useri sends Ri,Li to the RC, A eavesdrops the message. Subsequently, when RC sends Mi to Serverj, A intercepts the message. A generates a random number NA and computes(19)RA=NAP,EA=NARi,SKAi=HEAHAi′Ci,FA=HIDiSKAiRASIDj,and sends RA,FA to Useri.Upon receivingRA,FA, Useri computes(20)EA′=N1RA,SKi=HEA′HAiCi,FA′=HIDiSKiRASIDj.It is clear thatFA′=FA. Next, Useri computes(21)QA=HSKiRA,and sends QA to Serverj. At this point, A intercepts the message and computes(22)QA′=HSKARA.It is clear thatQA′=QA. During the entire process, the user regards A as Serverj.


## 3.1. Known Session-Specific Temporary Information Attack

A known session-specific temporary information attack refers to a security attack in which an attacker attempts to obtain the currentSK when temporary secret values such as random numbers are disclosed [41].In this attack, we assume that the attackerA obtains temporary information N1 and captures Ri,Li and Rs,Fi, which are transmitted over the public channel. Based on the above, A can compute(11)Ci=HN1Ppub,IDiAi′SIDj=DCiLi,Ei′=N1RS.Subsequently,A obtains Ci, Ai′, and Ei′; hence, it can determine SK=HEi′HAi′Ci. Furthermore, based on the formulas above, A can obtain the user’s IDi; in other words, the user’s anonymity is not protected.


## 3.2. User Impersonation Attack

Step 1
Based onSection 3.1, A can obtain IDi,Ai′, and SIDj. Subsequently, A generates a random number NA and computes(12)RA=NAP,CA=HNAPpub,LA=ECAIDiAi′SIDj.A fakes Useri to send RA,LA to the RC.Step 2
Upon receivingRA,LA, the RC computes(13)CA′=HxRA,IDiAi′SIDj=DCA′LA,Ai=HxIDi.It is clear thatAi′=Ai. Next, the RC computes(14)SMj=HSIDjx,Yi=HSIDjSMj,MA=ESMjIDiRAYiHAiCA′,and sendsMA to Serverj.Step 3
After receivingMA, Serverj computes(15)IDiRAYiHAiCA′=DSMjMA,Yi′=HSIDjSMj.It is clear thatYi′=Yi. Next, Serverj generates a random number N2 and computes(16)RS=N2P,EA=N2RA,SKjA=HEAHAiCA′,FA=HIDiSKjARSSIDj,and sendsRS,FA to Useri.Step 4
A intercepts the massage RS,FA and computes(17)EA′=NARS,SKA=HEA′HAiCA,FA′=HIDiSKARSSIDj.It is clear thatFA′=FA. Next,A computes(18)QA=HSKARS,and sendsQA to Serverj.Step 5
Upon receivingQA, Serverj computes QA′=HSKjARS. It is clear that QA′=QA. During this process, the server regards A as Useri.


## 3.3. Server Impersonation Attack

This attack is also based onCi, IDi, Ai′, and SIDj in Section 3.1. When Useri sends Ri,Li to the RC, A eavesdrops the message. Subsequently, when RC sends Mi to Serverj, A intercepts the message. A generates a random number NA and computes(19)RA=NAP,EA=NARi,SKAi=HEAHAi′Ci,FA=HIDiSKAiRASIDj,and sends RA,FA to Useri.Upon receivingRA,FA, Useri computes(20)EA′=N1RA,SKi=HEA′HAiCi,FA′=HIDiSKiRASIDj.It is clear thatFA′=FA. Next, Useri computes(21)QA=HSKiRA,and sends QA to Serverj. At this point, A intercepts the message and computes(22)QA′=HSKARA.It is clear thatQA′=QA. During the entire process, the user regards A as Serverj.


## 4. Improved Scheme

To overcome the attacks, we proposed an improved scheme based on Wang et al.’s scheme in this section. Our scheme still operates in a multiserver environment, including the initialization, modified server and user registration, and modified login and authentication phases. It is noteworthy that the initialization phase in our scheme is the same as that in Wang et al.’s scheme, and we used a rectangle to denote our modifications.


### 4.1. Modified Server and User Registration

The serverServerj selects its identity SIDj and sends its identity to the RC through a secure channel. The RC receives this message and selects a random number ej. Subsequently, the RC computes SMj=HSIDj|x|ej, stores SIDj,ej, and sends SMj to Serverj. When Serverj receives SMj, it stores it in the database.The userUseri selects his IDi and PWi and imprints bi. Subsequently, Useri selects a random number ri and computes(23)Pi=HPWihbiri,HIDi=HIDi⊕ri,and sends HIDi,IDi,Pi to the RC. The RC receives this message, selects a random number di, and computes(24)Ai=HxHIDiIDidi,Bi=Ai⊕Pi,Vi=HPi⊕HHIDimodn,where 24≤n≤28. The RC stores HIDi,IDi,di in the database, stores Bi,Vi,Ekey⋅,P,Ppub,n in the SC, and sends the SC to Useri in a secure channel. Next, Useri stores ri in the SC. The complete registration process is shown in Figure 2.Figure 2
Registration phase.


### 4.2. Modified Login and Authentication

In this phase,Useri and Serverj complete a mutual authentication and use the RC as an information center to establish an SK. The complete login and authentication processes are shown in Figure 3.Step 1
Useri enters IDi and PWi, imprints bi, and logins the SC. Next, the SC computes(25)Pi′=HPWihbiri,HIDi′=HIDi⊕ri,Vi′=HPi′⊕HHIDi′modn,and verifies ifVi′=Vi. If they are equal, Useri generates a random number N1 and computes(26)Ai′=Bi⊕Pi′,Di=HAi′⊕HIDi′⊕N1,Gi=HN1⊕Ai′⊕HIDi′,Ri=GiP,Ci=HGiPpub,Li=ECiHIDi′Ai′SIDj.Subsequently,Useri sends M1=Di,HIDi′,Li to the RC in the public channel.Step 2
After theRC receives M1, it retrieves HIDi′,IDi,di in the database and computes(27)Ai″=HxHIDi′IDidi,N1′=Di⊕HAi″⊕HIDi′,Gi′=HN1′⊕Ai″⊕HIDi′,Ri′=Gi′P,Ci′=HxRi′,HIDi′Ai′SIDj=DCi′Li,and verifies ifAi′=Ai″. If they are equal, the RC computes(28)SMj=HSIDjxej,Yi=HSIDjSMj,Mi=ESMjHIDi′Ri′YiHAi′Ci′.Next, theRC sends M2=Mi to Serverj in the public channel.Step 3
AfterServerj receives M2, it computes(29)HIDi′Ri′YiHAi′Ci′=DSMjMi,Yi′=HSIDjSMj,and verifies ifYi′=Yi. If they are equal, Serverj generates a random number N2 and computes(30)RS=N2P,Ei=N2Ri′,SKj=HEiHAi′Ci′,Fi=HHIDiSKjRSSIDj.Subsequently,Serverj sends M3=Rs,Fi to Useri in the public channel.Step 4
AfterUseri receives M3, it computes(31)Ei′=N1RS,SKi=HEi′HAiCi,Fi′=HHIDiSKiRSSIDj,and verifies ifFi′=Fi. If they are equal, SK is the session key for Useri and Serverj.Figure 3
Login and authentication phase.


## 4.1. Modified Server and User Registration

The serverServerj selects its identity SIDj and sends its identity to the RC through a secure channel. The RC receives this message and selects a random number ej. Subsequently, the RC computes SMj=HSIDj|x|ej, stores SIDj,ej, and sends SMj to Serverj. When Serverj receives SMj, it stores it in the database.The userUseri selects his IDi and PWi and imprints bi. Subsequently, Useri selects a random number ri and computes(23)Pi=HPWihbiri,HIDi=HIDi⊕ri,and sends HIDi,IDi,Pi to the RC. The RC receives this message, selects a random number di, and computes(24)Ai=HxHIDiIDidi,Bi=Ai⊕Pi,Vi=HPi⊕HHIDimodn,where 24≤n≤28. The RC stores HIDi,IDi,di in the database, stores Bi,Vi,Ekey⋅,P,Ppub,n in the SC, and sends the SC to Useri in a secure channel. Next, Useri stores ri in the SC. The complete registration process is shown in Figure 2.Figure 2
Registration phase.


## 4.2. Modified Login and Authentication

In this phase,Useri and Serverj complete a mutual authentication and use the RC as an information center to establish an SK. The complete login and authentication processes are shown in Figure 3.Step 1
Useri enters IDi and PWi, imprints bi, and logins the SC. Next, the SC computes(25)Pi′=HPWihbiri,HIDi′=HIDi⊕ri,Vi′=HPi′⊕HHIDi′modn,and verifies ifVi′=Vi. If they are equal, Useri generates a random number N1 and computes(26)Ai′=Bi⊕Pi′,Di=HAi′⊕HIDi′⊕N1,Gi=HN1⊕Ai′⊕HIDi′,Ri=GiP,Ci=HGiPpub,Li=ECiHIDi′Ai′SIDj.Subsequently,Useri sends M1=Di,HIDi′,Li to the RC in the public channel.Step 2
After theRC receives M1, it retrieves HIDi′,IDi,di in the database and computes(27)Ai″=HxHIDi′IDidi,N1′=Di⊕HAi″⊕HIDi′,Gi′=HN1′⊕Ai″⊕HIDi′,Ri′=Gi′P,Ci′=HxRi′,HIDi′Ai′SIDj=DCi′Li,and verifies ifAi′=Ai″. If they are equal, the RC computes(28)SMj=HSIDjxej,Yi=HSIDjSMj,Mi=ESMjHIDi′Ri′YiHAi′Ci′.Next, theRC sends M2=Mi to Serverj in the public channel.Step 3
AfterServerj receives M2, it computes(29)HIDi′Ri′YiHAi′Ci′=DSMjMi,Yi′=HSIDjSMj,and verifies ifYi′=Yi. If they are equal, Serverj generates a random number N2 and computes(30)RS=N2P,Ei=N2Ri′,SKj=HEiHAi′Ci′,Fi=HHIDiSKjRSSIDj.Subsequently,Serverj sends M3=Rs,Fi to Useri in the public channel.Step 4
AfterUseri receives M3, it computes(31)Ei′=N1RS,SKi=HEi′HAiCi,Fi′=HHIDiSKiRSSIDj,and verifies ifFi′=Fi. If they are equal, SK is the session key for Useri and Serverj.Figure 3
Login and authentication phase.


## 5. Security Analysis

### 5.1. Formal Security Analysis

In this section, we show the security analysis of our improved scheme in the random oracle model [42]. First, we define the adversarial model [25, 26, 43–47] and simulate the adversary capabilities in a real attack. In the proposed scheme, three participants, Useri, Serverj, and RC, are involved. We use ∏​Ux, ∏​Sy, and ∏​RCz to represent the xth communication of Useri, the y th communication of Serverj, and the z th communication of RC, respectively. To perform a formal security analysis, we defined the following query model for the attacker A.Execute∏​Ux,∏​Sy,∏​RCz: A performs this query to eavesdrop and record the messages transmitted on the public channel, such as the messages between the U and the RC, the messages between the RC and the S, and the messages between the S and the UHash∏​EK,M: based on this query, A can get the hash value if each item in the hash function is known, where E=U,S,RCSend∏​EK,M: A executes this query with message M and then receives the response message from the entity EReveal∏​EK: A executes this query to obtain the return result of current session key SK generated by ECorrupt∏​EK: A executes this query to obtain information Bi,Vi,ri,Ekey⋅,P,Ppub,n in the smart cardTest∏​EK: based on this query, an unbiased coin c begins to be flipped. If c=0, A returns SK to a random string, and if c=1, A returns SK to a session keyIn the ROR model, the following theorem describes the security of our proposed schemeP.Theorem 1.
IfA runs P in an ROR model against a scheme in polynomial time, l represents the total number of bits of the biometric. The AdvAAKE that A’s advantage breaks the security of SK in AKE scheme, and then AdvAP≤qh2/Hash+2maxC′⋅qsends,qsend/2l+2AdvΩPk, where qsend and qh are the number of Send∏​EK,M and Hash∏​EK,M; Hash is the range space of ℎ (∙); C′ and s are parameters of Zipf’s law [48]; AdvΩPk is the advantage of A breaking the symmetric cipher Ω.Proof.
We define a sequence of five games, namely,GMii=0,1,2,3,4. Let SuccAGMi represent the event that UA wins GMi. The AdvA,GMiP=PrSuccAGMi represents the advantage of A winning GMi, where PrE is the probability of event E. The AdvAP represents the advantage of UA that breaks the security of SK in the proposed scheme. The detailed description of GMi is as follows.GameGM0:GM0 is the first game that represents a real attack on the ROR model. At this point, select coin c to start GM0. From semantic security, we can get AdvAP=2⋅AdvA,GM0P−1.GameGM1:GM1 means that A can perform the Execute query and get the message Di,HIDi,Li,Mi and RS,Fi transmitted in the scheme. At the end of the game, A will perform Reveal and Test queries to determine whether SK=HEiHAiCi can be obtained. But A cannot derive Ei,Ai,andCi, so the probability of GM1 is the same as that of GM0, that is, AdvA,GM1P=AdvA,GM0P.GameGM2:GM2 has added Hash and Send queries, Ei,Ai,andCi, which are all protected by ℎ (∙). But Ei,Ai,andCi are not directly obtained in the transmission channel, and according to the birthday paradox, we can get AdvA,GM1P−AdvA,GM2P≤qh2/2Hash.GameGM3:Corrupt query is added in GM3 and A can get the information Bi,Vi,ri,Ekey⋅,P,Ppub,n in the smart card. The Useri uses the password and biometric information to register, and A wants to guess Pi=HPWihbiri, but the probability of guessing the biometrics is 1/2l [49], which is almost negligible. Using Zipf’s law [48], we can get AdvA,GM2P−AdvA,GM3P≤maxC′⋅qsends,qsend/2l.GameGM4:GM4 is the last part of the game. At this time, A attempts to decrypt the information Li,Mi and uses the obtained information Bi,Vi,ri,Ekey⋅,P,Ppub,n to infer SK. Without the master key x of RC, A cannot compute Ai=HxHIDiIDidi and Ci=HGiPpub=HHN1⊕Ai′⊕HIDi′Ppub. According to the security of Ω symmetric encryption algorithm, we can obtain AdvA,GM3P−AdvA,GM4P≤AdvΩPk.
All queries are performed byA. After querying the test query, only the coin c of GM4 is left. Thus, the probability of guessing coin c is AdvA,GM4P=1/2. In summary, we can deduce(32)12AdvAP=AdvA,GM0P−12=AdvA,GM1P−12=AdvA,GM1P−AdvA,GM4P≤AdvA,GM1P−AdvA,GM2P+AdvA,GM2P−AdvA,GM3P+AdvA,GM3P−AdvA,GM4P≤qh22Hash+maxC′⋅qsends,qsend2l+AdvΩPk.
Therefore, the advantage ofA breaking the scheme is AdvAP≤qh2/Hash+2maxC′⋅qsends,qsend/2l+2AdvΩPk.


### 5.2. Formal Security Analysis by BAN Logic

In this subsection, we demonstrate through the BAN logic that after our scheme verifies the authenticity of each other’s identity and that the determinedSK will not be obtained by others. In fact, the BAN logic is a rule used to define and analyze the communication process between two parties. Specifically, the conclusions obtained by the BAN logic are through rigorous logic analysis, which further explains the confidentiality and credibility of the communication information. The notations and rules of the BAN logic used in the BAN logic calculation performed in this study are cited in [24, 27, 28, 30, 31, 36, 50, 51]. The proof of our scheme is as follows:


#### 5.2.1. Rules

rule1 Nonce verification rule: P|≡#X,P|≡Q|∼X/P|≡Q|≡Xrule2 Message meaning rule: P|≡P↔KQ,P⊲XK/P|≡Q|∼Xrule3 Jurisdiction rule: P|≡Q|≡X,P|≡Q|⟹X/P|≡Xrule4 Jurisdiction rule: P|≡#X/P|≡#X,Y


#### 5.2.2. Goals

Goal 1.U|≡S|≡U↔SKjSGoal 2.U|≡U↔SKjSGoal 3.S|≡U|≡U↔SKiSGoal 4.S|≡U↔SKiS


#### 5.2.3. Idealize the Communication Messages

M1:U⟶RC:Di,HIDi′,HIDi′,U↔AiRC,SIDjCiM2:RC⟶S:HIDi′,Ri′,Yi,U↔HAi′Ci′SSMjM3:S⟶U:Rs,HIDi′,U↔SKjS,Rs,SIDjHAi′Ci′


#### 5.2.4. Initial Assumptions

A1:S|≡S↔SMjRCA2:S|≡#N1A3:S|≡RC|⇒U↔HAi′Ci′SA4:U|≡U↔HAi′Ci′SA5:U|≡#N2A6:U|≡S|⇒U↔SKjSA7:S|≡#N2A8:S|≡U|⇒U↔SKiS


#### 5.2.5. The Proof of Our Proposed Scheme

ForGoal1 By M2, we have S1:S⊲HIDi′,Ri′,Yi,U↔HAi′Ci′SSMj. Based on A1, S1, and rule (2), we have S2:S|≡RC|∼HIDi′,Ri′,Yi,U↔HAi′Ci′S. Based on A2 and rule (4), we obtain S3:S|≡#HIDi′,Ri′,Yi,U↔HAi′Ci′S. Using S3, S2, and rule (1), S4:S|≡RC|≡HIDi′,Ri′,Yi,U↔HAi′Ci′S. Subsequently, we have S5:S|≡RC|≡U↔HAi′Ci′S. Based on A3, S5, and rule (3), we have S6:S|≡U↔HAi′Ci′S. By M3, we have S7:U⊲HIDi′,U↔SKjS,Rs,SIDjHAi′Ci′. Based on A4, S7, and rule (2), we have S8:U|≡S|∼HIDi′,U↔SKjS,Rs,SIDj. Based on A5, S8, rule (4), and rule (1), we obtain S9:U|≡S|≡HIDi′,U↔SKjS,Rs,SIDj and the following: S10:U|≡S|≡U↔SKjS.Goal1.ForGoal2, based on A6, S10, and rule (3), we have S11:U|≡U↔SKjS.Goal2.ForGoal3, based on M3, we have S12:S⊲U↔SKiS,RsHAi′Ci′. Subsequently, based on S6,S12,and rule2, we have S13:S|≡U|∼U↔SKiS,Rs. Based on A7, S13, rule (4), and rule (1), we obtain S14:S|≡U|≡U↔SKiS,Rs. Therefore, we have S15:S|≡U|≡U↔SKiS.Goal3.ForGoal4, based on A8, S15, and rule (3), we have S16:S|≡U↔SKiS.Goal4.


### 5.3. Security Verification by ProVerif

We used the verification tool ProVerif to test the security of our proposed scheme. ProVerif is an important verification tool for verifying security fundamentals such as authentication, confidentiality, anonymity, and privacy [11, 24, 51, 52]. Furthermore, ProVerif can automatically verify the security of a scheme. It handles basic elements such as public key cryptography and the Diffie–Hellman mechanism.The definition of the ProVerif code is shown in Figure4. Our scheme comprised three entities: Useri, RC, and Serverj. Figures 5–7 show the user, RC, and server processes in our code, respectively. Five events were involved: UserAuthed, UserStarted, RCAcUser, ServerAcRC, and UserAcServer. Event UserAuthed means that Useri has been successfully authenticated. Event UserStarted means that Useri has started authentication. Event RCAcUser means that the RC has successfully authenticated the Useri. Event ServerAcRC means that Serverj has successfully authenticated the RC. Event UserAcServer means that Useri has successfully authenticated Serverj.Figure 4
The terms definition in the ProVerif tool.Figure 5
Process ofUseri in ProVerif tool.Figure 6
Process of RC in ProVerif tool.Figure 7
Process ofServerj in ProVerif tool.Next, we used ProVerif to query whether the attacker can obtain the identities ofUseri and Serverj as well as the SK and whether the events above were executed in sequence. Figure 8 shows the events and queries in the code.Figure 8
Queries and events in ProVerif tool.Finally, we executed the code to perform authentication, and the results are shown in Figure9. The result shows that ProVerif confirmed the security of our scheme. Therefore, the attacker cannot obtain parameters SKi,SKj,IDi,SIDj, and all events are executed normally. Note that Figures 4–9 are shown in Appendix.Figure 9
Results obtained.


### 5.4. Informal Security Analysis

#### 5.4.1. Known Session-Specific Temporary Information Attacks

Upon completing the login and authentication phase, ifN1 or N2 is compromised, then A intercepts information Rs,Fi and computes Ei=N1RS, but it cannot compute Ai=HxHIDiIDidi and Ci=HGiPpub=HHN1⊕Ai′⊕HIDi′Ppub. Therefore, A cannot compute the SK, and the scheme successfully overcomes known session-specific temporary information attacks.


#### 5.4.2. User Impersonation Attacks

Assume that theA pretends to be a user and forges a message M1=Di,HIDi,Li. Even if A forges a random number N1′, it cannot compute Ai to forge Di and Li. A cannot obtain Ai for two reasons. First, upon completing the login and entering the authentication phase, Ai is encrypted by Ci, and A cannot compute Ci to decrypt Ai; therefore, Ai cannot be obtained. Second, in the registration phase, if the SC is stolen by a malicious user, then A can obtain Bi. However, because Ai=Bi⊕Pi, A requires PWi,bi,ri to compute Pi, which is impossible. Therefore, the scheme successfully overcomes user impersonation attacks.


#### 5.4.3. Server Impersonation Attacks

Assume thatA pretends to be the server and forges a message M3=Rs,Fi. Therefore, A must generate a random number NA and compute RA=NAP,EA=N2Ri,SKA=HEAHAiCi. However, A cannot obtain Ri,Ai,Ci. Even if A can obtain temporary information N1, it cannot compute Ri,Ai,Ci, nor can it obtain sensitive information by decrypting Li. Therefore, the scheme can overcome server impersonation attacks.


#### 5.4.4. Man-in-the-Middle Attacks

Upon completing the login and authentication phase, theA intercepts the messages transmitted between Useri and Serverj to impersonate the user or server. The A may intercept M3 to impersonate Serverj. However, A cannot compute Fi=HHIDiSKjRSSIDj; therefore, the session is terminated. In another case, A may intercept M1,M2 to impersonate Useri. However, A cannot compute Ai; therefore, it cannot pass the RC verification. Therefore, the scheme can overcome man-in-the-middle attacks.


#### 5.4.5. Replay Attacks

Suppose that messageM1, M2, or M3 is replayed by A. However, our scheme overcomes this attack by refreshing random numbers N1,N2. By replaying one of the messages M1,M2,M3, the mutual authentication values Fi for the user will not pass, and the session will be terminated. Therefore, this scheme can overcome replay attacks.


#### 5.4.6. StolenSC Attacks

Suppose that theSC is stolen by a malicious user A who will obtain Bi,Vi,Ekey⋅,P,Ppub,n,ri. However, based on those values, A cannot compute Ai=HxHIDiIDidi. In addition, A cannot obtain N1 to compute Ci=HGiPpub=HHN1⊕Ai′⊕HIDi′Ppub and Ei=N1RS. Therefore, A cannot compute SK=HEiHAiCi. Hence, it is clear that the scheme can successfully overcome stolen SC attacks.


#### 5.4.7. Offline Password-Guessing Attacks

According to,A obtains Bi,Vi,Ekey⋅,P,Ppub,n,ri. Moreover, A can be biometric bi by shoulder surfing. A launches an offline password-guessing attack by comparing Pi (Pi=HPWihbiri). In addition, Pi=Ai⊕Bi=HxHIDiIDidi⊕Bi. However, A cannot obtain HIDi, x, and di; therefore, the attacker cannot compute Pi. Hence, the scheme can overcome offline password-guessing attacks.


#### 5.4.8. Privileged Insider Attacks

Assume that the privileged insiderA is HIDi,IDi,di stored in the RC database. However, A cannot obtain x and the user’s IDi; therefore, it cannot compute Ai=HxHIDiIDidi. Because Ei=N2Ri=N2HN1⊕Ai′⊕HIDi′P and SK=HEiHAiCi, A cannot compute the SK. Therefore, the scheme can overcome privileged insider attacks.


#### 5.4.9. Perfect Forward Secrecy

Suppose thatA obtains the RC’s long-term key x and attempts to obtain the SK. If A obtains N1 and intercepts Rs,Fi, then it computes Ei=N1RS. However, A cannot compute Ai=HxHIDiIDidi and Ci=HGiPpub=HHN1⊕Ai′⊕HIDi′Ppub. In other words, A cannot compute SK=HEiHAiCi. Therefore, this scheme provides perfect forward secrecy.


#### 5.4.10. User Anonymity

In the registration phase of the improved scheme,Useri computes HIDi=HIDi⊕ri to protect the real identity of the user. In the authentication phase, the user transmits the virtual identity HIDi, and the attacker cannot obtain the real identity of the user. Therefore, our scheme provides user anonymity.


#### 5.4.11. Three-Factor Secrecy

The three factors refer to the password,SC, and biometrics. Based on a previous analysis, Ai and Ci are the key parameters for launching an attack to compute the SK. A obtains two of the three factors, i.e., the password and SC. Even if A obtains the password and extracts the parameters from the SC, it cannot compute Ai and Ci to perform any attack. Passwords and biometrics: if A obtains the password and biometrics to calculate Ai, it must obtain Bi and Pi. However, Bi is stored in an SC, whereas Pi is protected by a random number. Biometrics and smart cards: if A obtains the biometrics and SC to calculate Pi, it must obtain the PWi. Therefore, A cannot compute Ai=Bi⊕Pi.After analyzing the security of our improved scheme, we can conclude that our proposed scheme is “provably secure” against several well-known attacks with a higher probability. However, it not means that our scheme is a “perfectly secure” authentication scheme because many special attack approaches or tricks exist [19].


## 5.1. Formal Security Analysis

In this section, we show the security analysis of our improved scheme in the random oracle model [42]. First, we define the adversarial model [25, 26, 43–47] and simulate the adversary capabilities in a real attack. In the proposed scheme, three participants, Useri, Serverj, and RC, are involved. We use ∏​Ux, ∏​Sy, and ∏​RCz to represent the xth communication of Useri, the y th communication of Serverj, and the z th communication of RC, respectively. To perform a formal security analysis, we defined the following query model for the attacker A.Execute∏​Ux,∏​Sy,∏​RCz: A performs this query to eavesdrop and record the messages transmitted on the public channel, such as the messages between the U and the RC, the messages between the RC and the S, and the messages between the S and the UHash∏​EK,M: based on this query, A can get the hash value if each item in the hash function is known, where E=U,S,RCSend∏​EK,M: A executes this query with message M and then receives the response message from the entity EReveal∏​EK: A executes this query to obtain the return result of current session key SK generated by ECorrupt∏​EK: A executes this query to obtain information Bi,Vi,ri,Ekey⋅,P,Ppub,n in the smart cardTest∏​EK: based on this query, an unbiased coin c begins to be flipped. If c=0, A returns SK to a random string, and if c=1, A returns SK to a session keyIn the ROR model, the following theorem describes the security of our proposed schemeP.Theorem 1.
IfA runs P in an ROR model against a scheme in polynomial time, l represents the total number of bits of the biometric. The AdvAAKE that A’s advantage breaks the security of SK in AKE scheme, and then AdvAP≤qh2/Hash+2maxC′⋅qsends,qsend/2l+2AdvΩPk, where qsend and qh are the number of Send∏​EK,M and Hash∏​EK,M; Hash is the range space of ℎ (∙); C′ and s are parameters of Zipf’s law [48]; AdvΩPk is the advantage of A breaking the symmetric cipher Ω.Proof.
We define a sequence of five games, namely,GMii=0,1,2,3,4. Let SuccAGMi represent the event that UA wins GMi. The AdvA,GMiP=PrSuccAGMi represents the advantage of A winning GMi, where PrE is the probability of event E. The AdvAP represents the advantage of UA that breaks the security of SK in the proposed scheme. The detailed description of GMi is as follows.GameGM0:GM0 is the first game that represents a real attack on the ROR model. At this point, select coin c to start GM0. From semantic security, we can get AdvAP=2⋅AdvA,GM0P−1.GameGM1:GM1 means that A can perform the Execute query and get the message Di,HIDi,Li,Mi and RS,Fi transmitted in the scheme. At the end of the game, A will perform Reveal and Test queries to determine whether SK=HEiHAiCi can be obtained. But A cannot derive Ei,Ai,andCi, so the probability of GM1 is the same as that of GM0, that is, AdvA,GM1P=AdvA,GM0P.GameGM2:GM2 has added Hash and Send queries, Ei,Ai,andCi, which are all protected by ℎ (∙). But Ei,Ai,andCi are not directly obtained in the transmission channel, and according to the birthday paradox, we can get AdvA,GM1P−AdvA,GM2P≤qh2/2Hash.GameGM3:Corrupt query is added in GM3 and A can get the information Bi,Vi,ri,Ekey⋅,P,Ppub,n in the smart card. The Useri uses the password and biometric information to register, and A wants to guess Pi=HPWihbiri, but the probability of guessing the biometrics is 1/2l [49], which is almost negligible. Using Zipf’s law [48], we can get AdvA,GM2P−AdvA,GM3P≤maxC′⋅qsends,qsend/2l.GameGM4:GM4 is the last part of the game. At this time, A attempts to decrypt the information Li,Mi and uses the obtained information Bi,Vi,ri,Ekey⋅,P,Ppub,n to infer SK. Without the master key x of RC, A cannot compute Ai=HxHIDiIDidi and Ci=HGiPpub=HHN1⊕Ai′⊕HIDi′Ppub. According to the security of Ω symmetric encryption algorithm, we can obtain AdvA,GM3P−AdvA,GM4P≤AdvΩPk.
All queries are performed byA. After querying the test query, only the coin c of GM4 is left. Thus, the probability of guessing coin c is AdvA,GM4P=1/2. In summary, we can deduce(32)12AdvAP=AdvA,GM0P−12=AdvA,GM1P−12=AdvA,GM1P−AdvA,GM4P≤AdvA,GM1P−AdvA,GM2P+AdvA,GM2P−AdvA,GM3P+AdvA,GM3P−AdvA,GM4P≤qh22Hash+maxC′⋅qsends,qsend2l+AdvΩPk.
Therefore, the advantage ofA breaking the scheme is AdvAP≤qh2/Hash+2maxC′⋅qsends,qsend/2l+2AdvΩPk.


## 5.2. Formal Security Analysis by BAN Logic

In this subsection, we demonstrate through the BAN logic that after our scheme verifies the authenticity of each other’s identity and that the determinedSK will not be obtained by others. In fact, the BAN logic is a rule used to define and analyze the communication process between two parties. Specifically, the conclusions obtained by the BAN logic are through rigorous logic analysis, which further explains the confidentiality and credibility of the communication information. The notations and rules of the BAN logic used in the BAN logic calculation performed in this study are cited in [24, 27, 28, 30, 31, 36, 50, 51]. The proof of our scheme is as follows:


### 5.2.1. Rules

rule1 Nonce verification rule: P|≡#X,P|≡Q|∼X/P|≡Q|≡Xrule2 Message meaning rule: P|≡P↔KQ,P⊲XK/P|≡Q|∼Xrule3 Jurisdiction rule: P|≡Q|≡X,P|≡Q|⟹X/P|≡Xrule4 Jurisdiction rule: P|≡#X/P|≡#X,Y


### 5.2.2. Goals

Goal 1.U|≡S|≡U↔SKjSGoal 2.U|≡U↔SKjSGoal 3.S|≡U|≡U↔SKiSGoal 4.S|≡U↔SKiS


### 5.2.3. Idealize the Communication Messages

M1:U⟶RC:Di,HIDi′,HIDi′,U↔AiRC,SIDjCiM2:RC⟶S:HIDi′,Ri′,Yi,U↔HAi′Ci′SSMjM3:S⟶U:Rs,HIDi′,U↔SKjS,Rs,SIDjHAi′Ci′


### 5.2.4. Initial Assumptions

A1:S|≡S↔SMjRCA2:S|≡#N1A3:S|≡RC|⇒U↔HAi′Ci′SA4:U|≡U↔HAi′Ci′SA5:U|≡#N2A6:U|≡S|⇒U↔SKjSA7:S|≡#N2A8:S|≡U|⇒U↔SKiS


### 5.2.5. The Proof of Our Proposed Scheme

ForGoal1 By M2, we have S1:S⊲HIDi′,Ri′,Yi,U↔HAi′Ci′SSMj. Based on A1, S1, and rule (2), we have S2:S|≡RC|∼HIDi′,Ri′,Yi,U↔HAi′Ci′S. Based on A2 and rule (4), we obtain S3:S|≡#HIDi′,Ri′,Yi,U↔HAi′Ci′S. Using S3, S2, and rule (1), S4:S|≡RC|≡HIDi′,Ri′,Yi,U↔HAi′Ci′S. Subsequently, we have S5:S|≡RC|≡U↔HAi′Ci′S. Based on A3, S5, and rule (3), we have S6:S|≡U↔HAi′Ci′S. By M3, we have S7:U⊲HIDi′,U↔SKjS,Rs,SIDjHAi′Ci′. Based on A4, S7, and rule (2), we have S8:U|≡S|∼HIDi′,U↔SKjS,Rs,SIDj. Based on A5, S8, rule (4), and rule (1), we obtain S9:U|≡S|≡HIDi′,U↔SKjS,Rs,SIDj and the following: S10:U|≡S|≡U↔SKjS.Goal1.ForGoal2, based on A6, S10, and rule (3), we have S11:U|≡U↔SKjS.Goal2.ForGoal3, based on M3, we have S12:S⊲U↔SKiS,RsHAi′Ci′. Subsequently, based on S6,S12,and rule2, we have S13:S|≡U|∼U↔SKiS,Rs. Based on A7, S13, rule (4), and rule (1), we obtain S14:S|≡U|≡U↔SKiS,Rs. Therefore, we have S15:S|≡U|≡U↔SKiS.Goal3.ForGoal4, based on A8, S15, and rule (3), we have S16:S|≡U↔SKiS.Goal4.


## 5.2.1. Rules

rule1 Nonce verification rule: P|≡#X,P|≡Q|∼X/P|≡Q|≡Xrule2 Message meaning rule: P|≡P↔KQ,P⊲XK/P|≡Q|∼Xrule3 Jurisdiction rule: P|≡Q|≡X,P|≡Q|⟹X/P|≡Xrule4 Jurisdiction rule: P|≡#X/P|≡#X,Y


## 5.2.2. Goals

Goal 1.U|≡S|≡U↔SKjSGoal 2.U|≡U↔SKjSGoal 3.S|≡U|≡U↔SKiSGoal 4.S|≡U↔SKiS


## 5.2.3. Idealize the Communication Messages

M1:U⟶RC:Di,HIDi′,HIDi′,U↔AiRC,SIDjCiM2:RC⟶S:HIDi′,Ri′,Yi,U↔HAi′Ci′SSMjM3:S⟶U:Rs,HIDi′,U↔SKjS,Rs,SIDjHAi′Ci′


## 5.2.4. Initial Assumptions

A1:S|≡S↔SMjRCA2:S|≡#N1A3:S|≡RC|⇒U↔HAi′Ci′SA4:U|≡U↔HAi′Ci′SA5:U|≡#N2A6:U|≡S|⇒U↔SKjSA7:S|≡#N2A8:S|≡U|⇒U↔SKiS


## 5.2.5. The Proof of Our Proposed Scheme

ForGoal1 By M2, we have S1:S⊲HIDi′,Ri′,Yi,U↔HAi′Ci′SSMj. Based on A1, S1, and rule (2), we have S2:S|≡RC|∼HIDi′,Ri′,Yi,U↔HAi′Ci′S. Based on A2 and rule (4), we obtain S3:S|≡#HIDi′,Ri′,Yi,U↔HAi′Ci′S. Using S3, S2, and rule (1), S4:S|≡RC|≡HIDi′,Ri′,Yi,U↔HAi′Ci′S. Subsequently, we have S5:S|≡RC|≡U↔HAi′Ci′S. Based on A3, S5, and rule (3), we have S6:S|≡U↔HAi′Ci′S. By M3, we have S7:U⊲HIDi′,U↔SKjS,Rs,SIDjHAi′Ci′. Based on A4, S7, and rule (2), we have S8:U|≡S|∼HIDi′,U↔SKjS,Rs,SIDj. Based on A5, S8, rule (4), and rule (1), we obtain S9:U|≡S|≡HIDi′,U↔SKjS,Rs,SIDj and the following: S10:U|≡S|≡U↔SKjS.Goal1.ForGoal2, based on A6, S10, and rule (3), we have S11:U|≡U↔SKjS.Goal2.ForGoal3, based on M3, we have S12:S⊲U↔SKiS,RsHAi′Ci′. Subsequently, based on S6,S12,and rule2, we have S13:S|≡U|∼U↔SKiS,Rs. Based on A7, S13, rule (4), and rule (1), we obtain S14:S|≡U|≡U↔SKiS,Rs. Therefore, we have S15:S|≡U|≡U↔SKiS.Goal3.ForGoal4, based on A8, S15, and rule (3), we have S16:S|≡U↔SKiS.Goal4.


## 5.3. Security Verification by ProVerif

We used the verification tool ProVerif to test the security of our proposed scheme. ProVerif is an important verification tool for verifying security fundamentals such as authentication, confidentiality, anonymity, and privacy [11, 24, 51, 52]. Furthermore, ProVerif can automatically verify the security of a scheme. It handles basic elements such as public key cryptography and the Diffie–Hellman mechanism.The definition of the ProVerif code is shown in Figure4. Our scheme comprised three entities: Useri, RC, and Serverj. Figures 5–7 show the user, RC, and server processes in our code, respectively. Five events were involved: UserAuthed, UserStarted, RCAcUser, ServerAcRC, and UserAcServer. Event UserAuthed means that Useri has been successfully authenticated. Event UserStarted means that Useri has started authentication. Event RCAcUser means that the RC has successfully authenticated the Useri. Event ServerAcRC means that Serverj has successfully authenticated the RC. Event UserAcServer means that Useri has successfully authenticated Serverj.Figure 4
The terms definition in the ProVerif tool.Figure 5
Process ofUseri in ProVerif tool.Figure 6
Process of RC in ProVerif tool.Figure 7
Process ofServerj in ProVerif tool.Next, we used ProVerif to query whether the attacker can obtain the identities ofUseri and Serverj as well as the SK and whether the events above were executed in sequence. Figure 8 shows the events and queries in the code.Figure 8
Queries and events in ProVerif tool.Finally, we executed the code to perform authentication, and the results are shown in Figure9. The result shows that ProVerif confirmed the security of our scheme. Therefore, the attacker cannot obtain parameters SKi,SKj,IDi,SIDj, and all events are executed normally. Note that Figures 4–9 are shown in Appendix.Figure 9
Results obtained.


## 5.4. Informal Security Analysis

### 5.4.1. Known Session-Specific Temporary Information Attacks

Upon completing the login and authentication phase, ifN1 or N2 is compromised, then A intercepts information Rs,Fi and computes Ei=N1RS, but it cannot compute Ai=HxHIDiIDidi and Ci=HGiPpub=HHN1⊕Ai′⊕HIDi′Ppub. Therefore, A cannot compute the SK, and the scheme successfully overcomes known session-specific temporary information attacks.


### 5.4.2. User Impersonation Attacks

Assume that theA pretends to be a user and forges a message M1=Di,HIDi,Li. Even if A forges a random number N1′, it cannot compute Ai to forge Di and Li. A cannot obtain Ai for two reasons. First, upon completing the login and entering the authentication phase, Ai is encrypted by Ci, and A cannot compute Ci to decrypt Ai; therefore, Ai cannot be obtained. Second, in the registration phase, if the SC is stolen by a malicious user, then A can obtain Bi. However, because Ai=Bi⊕Pi, A requires PWi,bi,ri to compute Pi, which is impossible. Therefore, the scheme successfully overcomes user impersonation attacks.


### 5.4.3. Server Impersonation Attacks

Assume thatA pretends to be the server and forges a message M3=Rs,Fi. Therefore, A must generate a random number NA and compute RA=NAP,EA=N2Ri,SKA=HEAHAiCi. However, A cannot obtain Ri,Ai,Ci. Even if A can obtain temporary information N1, it cannot compute Ri,Ai,Ci, nor can it obtain sensitive information by decrypting Li. Therefore, the scheme can overcome server impersonation attacks.


### 5.4.4. Man-in-the-Middle Attacks

Upon completing the login and authentication phase, theA intercepts the messages transmitted between Useri and Serverj to impersonate the user or server. The A may intercept M3 to impersonate Serverj. However, A cannot compute Fi=HHIDiSKjRSSIDj; therefore, the session is terminated. In another case, A may intercept M1,M2 to impersonate Useri. However, A cannot compute Ai; therefore, it cannot pass the RC verification. Therefore, the scheme can overcome man-in-the-middle attacks.


### 5.4.5. Replay Attacks

Suppose that messageM1, M2, or M3 is replayed by A. However, our scheme overcomes this attack by refreshing random numbers N1,N2. By replaying one of the messages M1,M2,M3, the mutual authentication values Fi for the user will not pass, and the session will be terminated. Therefore, this scheme can overcome replay attacks.


### 5.4.6. StolenSC Attacks

Suppose that theSC is stolen by a malicious user A who will obtain Bi,Vi,Ekey⋅,P,Ppub,n,ri. However, based on those values, A cannot compute Ai=HxHIDiIDidi. In addition, A cannot obtain N1 to compute Ci=HGiPpub=HHN1⊕Ai′⊕HIDi′Ppub and Ei=N1RS. Therefore, A cannot compute SK=HEiHAiCi. Hence, it is clear that the scheme can successfully overcome stolen SC attacks.


### 5.4.7. Offline Password-Guessing Attacks

According to,A obtains Bi,Vi,Ekey⋅,P,Ppub,n,ri. Moreover, A can be biometric bi by shoulder surfing. A launches an offline password-guessing attack by comparing Pi (Pi=HPWihbiri). In addition, Pi=Ai⊕Bi=HxHIDiIDidi⊕Bi. However, A cannot obtain HIDi, x, and di; therefore, the attacker cannot compute Pi. Hence, the scheme can overcome offline password-guessing attacks.


### 5.4.8. Privileged Insider Attacks

Assume that the privileged insiderA is HIDi,IDi,di stored in the RC database. However, A cannot obtain x and the user’s IDi; therefore, it cannot compute Ai=HxHIDiIDidi. Because Ei=N2Ri=N2HN1⊕Ai′⊕HIDi′P and SK=HEiHAiCi, A cannot compute the SK. Therefore, the scheme can overcome privileged insider attacks.


### 5.4.9. Perfect Forward Secrecy

Suppose thatA obtains the RC’s long-term key x and attempts to obtain the SK. If A obtains N1 and intercepts Rs,Fi, then it computes Ei=N1RS. However, A cannot compute Ai=HxHIDiIDidi and Ci=HGiPpub=HHN1⊕Ai′⊕HIDi′Ppub. In other words, A cannot compute SK=HEiHAiCi. Therefore, this scheme provides perfect forward secrecy.


### 5.4.10. User Anonymity

In the registration phase of the improved scheme,Useri computes HIDi=HIDi⊕ri to protect the real identity of the user. In the authentication phase, the user transmits the virtual identity HIDi, and the attacker cannot obtain the real identity of the user. Therefore, our scheme provides user anonymity.


### 5.4.11. Three-Factor Secrecy

The three factors refer to the password,SC, and biometrics. Based on a previous analysis, Ai and Ci are the key parameters for launching an attack to compute the SK. A obtains two of the three factors, i.e., the password and SC. Even if A obtains the password and extracts the parameters from the SC, it cannot compute Ai and Ci to perform any attack. Passwords and biometrics: if A obtains the password and biometrics to calculate Ai, it must obtain Bi and Pi. However, Bi is stored in an SC, whereas Pi is protected by a random number. Biometrics and smart cards: if A obtains the biometrics and SC to calculate Pi, it must obtain the PWi. Therefore, A cannot compute Ai=Bi⊕Pi.After analyzing the security of our improved scheme, we can conclude that our proposed scheme is “provably secure” against several well-known attacks with a higher probability. However, it not means that our scheme is a “perfectly secure” authentication scheme because many special attack approaches or tricks exist [19].


## 5.4.1. Known Session-Specific Temporary Information Attacks

Upon completing the login and authentication phase, ifN1 or N2 is compromised, then A intercepts information Rs,Fi and computes Ei=N1RS, but it cannot compute Ai=HxHIDiIDidi and Ci=HGiPpub=HHN1⊕Ai′⊕HIDi′Ppub. Therefore, A cannot compute the SK, and the scheme successfully overcomes known session-specific temporary information attacks.


## 5.4.2. User Impersonation Attacks

Assume that theA pretends to be a user and forges a message M1=Di,HIDi,Li. Even if A forges a random number N1′, it cannot compute Ai to forge Di and Li. A cannot obtain Ai for two reasons. First, upon completing the login and entering the authentication phase, Ai is encrypted by Ci, and A cannot compute Ci to decrypt Ai; therefore, Ai cannot be obtained. Second, in the registration phase, if the SC is stolen by a malicious user, then A can obtain Bi. However, because Ai=Bi⊕Pi, A requires PWi,bi,ri to compute Pi, which is impossible. Therefore, the scheme successfully overcomes user impersonation attacks.


## 5.4.3. Server Impersonation Attacks

Assume thatA pretends to be the server and forges a message M3=Rs,Fi. Therefore, A must generate a random number NA and compute RA=NAP,EA=N2Ri,SKA=HEAHAiCi. However, A cannot obtain Ri,Ai,Ci. Even if A can obtain temporary information N1, it cannot compute Ri,Ai,Ci, nor can it obtain sensitive information by decrypting Li. Therefore, the scheme can overcome server impersonation attacks.


## 5.4.4. Man-in-the-Middle Attacks

Upon completing the login and authentication phase, theA intercepts the messages transmitted between Useri and Serverj to impersonate the user or server. The A may intercept M3 to impersonate Serverj. However, A cannot compute Fi=HHIDiSKjRSSIDj; therefore, the session is terminated. In another case, A may intercept M1,M2 to impersonate Useri. However, A cannot compute Ai; therefore, it cannot pass the RC verification. Therefore, the scheme can overcome man-in-the-middle attacks.


## 5.4.5. Replay Attacks

Suppose that messageM1, M2, or M3 is replayed by A. However, our scheme overcomes this attack by refreshing random numbers N1,N2. By replaying one of the messages M1,M2,M3, the mutual authentication values Fi for the user will not pass, and the session will be terminated. Therefore, this scheme can overcome replay attacks.


## 5.4.6. StolenSC Attacks

Suppose that theSC is stolen by a malicious user A who will obtain Bi,Vi,Ekey⋅,P,Ppub,n,ri. However, based on those values, A cannot compute Ai=HxHIDiIDidi. In addition, A cannot obtain N1 to compute Ci=HGiPpub=HHN1⊕Ai′⊕HIDi′Ppub and Ei=N1RS. Therefore, A cannot compute SK=HEiHAiCi. Hence, it is clear that the scheme can successfully overcome stolen SC attacks.


## 5.4.7. Offline Password-Guessing Attacks

According to,A obtains Bi,Vi,Ekey⋅,P,Ppub,n,ri. Moreover, A can be biometric bi by shoulder surfing. A launches an offline password-guessing attack by comparing Pi (Pi=HPWihbiri). In addition, Pi=Ai⊕Bi=HxHIDiIDidi⊕Bi. However, A cannot obtain HIDi, x, and di; therefore, the attacker cannot compute Pi. Hence, the scheme can overcome offline password-guessing attacks.


## 5.4.8. Privileged Insider Attacks

Assume that the privileged insiderA is HIDi,IDi,di stored in the RC database. However, A cannot obtain x and the user’s IDi; therefore, it cannot compute Ai=HxHIDiIDidi. Because Ei=N2Ri=N2HN1⊕Ai′⊕HIDi′P and SK=HEiHAiCi, A cannot compute the SK. Therefore, the scheme can overcome privileged insider attacks.


## 5.4.9. Perfect Forward Secrecy

Suppose thatA obtains the RC’s long-term key x and attempts to obtain the SK. If A obtains N1 and intercepts Rs,Fi, then it computes Ei=N1RS. However, A cannot compute Ai=HxHIDiIDidi and Ci=HGiPpub=HHN1⊕Ai′⊕HIDi′Ppub. In other words, A cannot compute SK=HEiHAiCi. Therefore, this scheme provides perfect forward secrecy.


## 5.4.10. User Anonymity

In the registration phase of the improved scheme,Useri computes HIDi=HIDi⊕ri to protect the real identity of the user. In the authentication phase, the user transmits the virtual identity HIDi, and the attacker cannot obtain the real identity of the user. Therefore, our scheme provides user anonymity.


## 5.4.11. Three-Factor Secrecy

The three factors refer to the password,SC, and biometrics. Based on a previous analysis, Ai and Ci are the key parameters for launching an attack to compute the SK. A obtains two of the three factors, i.e., the password and SC. Even if A obtains the password and extracts the parameters from the SC, it cannot compute Ai and Ci to perform any attack. Passwords and biometrics: if A obtains the password and biometrics to calculate Ai, it must obtain Bi and Pi. However, Bi is stored in an SC, whereas Pi is protected by a random number. Biometrics and smart cards: if A obtains the biometrics and SC to calculate Pi, it must obtain the PWi. Therefore, A cannot compute Ai=Bi⊕Pi.After analyzing the security of our improved scheme, we can conclude that our proposed scheme is “provably secure” against several well-known attacks with a higher probability. However, it not means that our scheme is a “perfectly secure” authentication scheme because many special attack approaches or tricks exist [19].


## 6. Performance Comparison

In this section, we compare our improved scheme with those of Ali and Pal [34] and Wang et al. [36] in terms of security and efficiency. Table 3 presents a comparison of security among the abovementioned schemes. It is evident that our scheme is secure against well-known attacks. Ali and Pal’s scheme [34] could not overcome known session-specific temporary information, user impersonation, and server impersonation attacks, nor could it provide three-factor and perfect forward secrecy. Although Wang et al.‘s scheme [36] guaranteed perfect forward secrecy, it could not overcome known session-specific temporary information, user impersonation, and server impersonation attacks. Hence, it is clear that only our proposed protocol successfully overcame all known attacks and achieved a certain degree of security.Table 3
Security comparison.
Attack methodsAli and Pal’s scheme [34]Wang et al.’s scheme [36]Our schemeUser anonymity√×√Offline password attacks√√√Stolen smart card attacks√√√Known session-specific temporary information attack× [36]×√User impersonation attack× [36]×√Server impersonation attack× [36]×√Replay attacks√√√Perfect forward secrecy× [36]√√Three-factor secrecy× [36]√√Note. √, able to overcome the attack, and ×, unable to overcome the attack.A comparison of the computational costs is shown in Table4. We used JPBC-2.0.0 (Pairing-Based Cryptography Library) [53], IntelliJ IDEA 2020.2.1 community edition, and a Windows 10 computer with a 2.3 GHz Intel (R) Core i5 processor and 16 GB of memory to simulate the computational costs. It is noteworthy that a widely accepted Type A pairing was constructed on the curve y2 = x3 + x over Fq, where q is a prime satisfying q = 3 mod 4. In our experimental results,Tm was 13.5 ms,Tp was 0.48 ms, and Ts was 0.12 ms. As shown in Table 4, the computational cost of our scheme was lower than that of the scheme in [34], whereas it was 13.5 ms higher than that of the scheme in [36]. However, when our scheme was utilized in a practical application, the 13.5 ms difference was almost negligible. Meanwhile, the scheme in [36] was subject to known session-specific temporary information, user impersonation, and server impersonation attacks. However, our improved scheme overcame all known attacks.Table 4
Computation cost comparison.
SchemeUser computationsServer computationsRCTotalAli et al.’s scheme [34]3Tm+4Tp≈42.42ms4Tm+3Tp+1Ts≈55.56ms3Tm+3Tp+2Ts≈42.18ms10Tm+10Tp+3Ts≈140.16msWang et al.’s scheme [36]3Tm+1Ts≈40.62ms2Tm+1Ts≈27.12ms1Tm+2Ts≈13.74ms6Tm+4Ts≈71.01msOur scheme3Tm+1Ts≈40.62ms2Tm+1Ts≈27.12ms2Tm+2Ts≈27.24ms7Tm+4Ts≈94.98msTm, time for executing elliptic curve scalar point multiplication. Tp, time for performing elliptic curve point addition operation. Ts, time for executing symmetric encryption/decryption operation.Table5 shows a comparison of the communication costs. We assumed that the ECC points accounted for 320 bits because two 160-bit parameters form an ECC point. The hash operation was considered to be 256 bits, and the identity was 64 bits. The length of the ciphertext for a symmetric encryption was 256 bits. In Ali et al.’s scheme, the messages in the login and authentication phase were DIDi,Ei,Ci,Di,DIDinew,Ki,Li,Fi, DIDinew,Qi,Mi,Ki, and Zi, where {Ei, Ci, Ki, Qi, Zi} belong to ECC, {Di, Li, Mi} are hash values, and {DIDi, DIDinew, Fi} are ciphertexts. The total communication cost of Ali et al.’s scheme was 3712 bits. In Wang et al.’s scheme, the messages in the login and authentication phase were Ri,Li,Mi, RS,Fi, and Qi, where {Ri, RS} belong to ECC, {Fi, Qi} are hash values, and {Li, Mi} are ciphertexts. The total communication cost of Wang et al.’s scheme was 1664 bits. In our scheme, the messages in the login and authentication phases were Di,HIDi′,Li,Mi, and RS,Fi, where {RS} belongs to ECC, {Di, HIDi′, Fi} are hash values, and {Li, Mi} are ciphertexts. The total communication cost of our scheme was 1600 bits.Table 5
Comparison of communication and massage rounds.
SchemeCommunication cost (bits)Massage roundsAli and Pal’s scheme [34]37124Wang et al.’s scheme [36]16644Our scheme16003Through the analysis of computation cost and communication cost, the communication cost of our scheme is significantly lower than [34, 36] and the computation cost is also acceptable. Combined with the previous security analysis mentioned in Table 3, our scheme also has strong security. Hence, our scheme is worthy of being adopted in secure three-factor authentication.


## 7. Conclusion

In this study, we performed a security analysis of Wang et al.’s scheme and discovered that their scheme could not overcome known session-specific temporary information, user impersonation, and server impersonation attacks. Additionally, we have proven the security of our proposed scheme through formal and informal security analysis. Subsequently, the communication security of our scheme was validated by the ProVerif tool, and the BAN logic indicated that mutual authentication can be completed safely. Finally, through a comparison of performance and security, the security and efficiency of our proposed scheme was proven. However, the computational cost of our scheme is still high. It will lead us to design lightweight authentication schemes in the future.



---

*Source: 6627956-2021-01-19.xml*