# CCMbAS: A Provably Secure CCM-Based Authentication Scheme for Mobile Internet

Authors: Yu Zhang; Guangmin Sun; Peng Zhai
Journal: Mobile Information Systems
 (2022)

---

## Abstract

To improve the security of authentication system and strengthen privacy protection in mobile Internet environment, this paper proposes a provably secure Chebyshev chaotic map (CCM)-based authentication scheme (CCMbAS). The proposed scheme transformed the traditional public key of Chebyshev chaotic map into a private key and combined two private keys to compute a one-time key used to encrypt authentication information. The scheme is verified using security review of BAN logic and ProVerif simulation tool. The verification results confirm that the scheme is well secured against all existing security threats. Compared with similar schemes, the proposed scheme is more efficient and secure. The security analysis shows that the proposed scheme can fulfil secure demands and ensure the security of user’s information in mobile Internet environment.


---

## Body

## 1. Introduction

Mobile Internet is the Internet and service that takes mobile network as access network. It has the characteristics of openness and complexity. With the rapid upgradation of mobile communication and the wide application of intelligent terminal, the application services provided by mobile Internet are more and more widespread. However, the network environment is more and more complex. Identity authentication is the first defender of information system, which can guarantee the security of system data and user information in complex network environment. It plays a key role in application system.Aiming at solving the security threat of identity authentication system and protecting user’s privacy information, Zhu et al. [1] proposed a biometrics-based multi-server key agreement scheme (BbKAS) on chaotic map cryptosystem. The encryption key of the scheme is not secure enough because the attacker can obtain encrypting key and crack encrypted information with dictionary attack of the intercepting information. Jiang et al. [2] proposed a new three-factor scheme. Ali et al. [3] proposed a three-factor identity authentication scheme based on RSA encryption algorithm.To reduce the computational cost, Dong et al. [4] proposed a biometric verification-based authentication scheme (BVbAS) using Chebyshev chaotic mapping. The design of the scheme is unreasonable because the registry centre must provide all concerned information about all users and servers to each other before they request authentication. The design may result in a sharp increase in the communication cost of system. Otherwise, the authentication cannot be performed.In general, the schemes can be classified into five groups in terms of the underlying intractability problem: based on discrete-logarithm problem [5–8], based on pairing [9, 10], based on chaotic map [11–13], based on integer-factorization problem [14], and based on hash function [15–18]. Among them, schemes based on elliptic curve bilinear pairings, such as a robust provable-secure privacy-preserving authentication protocol (PpAP) for Industrial Internet of Things [10], usually require large computation cost. Chaotic cryptography has become increasingly popular due to its lower computational complexity and higher asymmetric key security [19]. In view of the computing and security advantages of chaotic cryptography, CCMbAS is proposed to solve the problems of the above schemes.


## 2. Related Theoretical Knowledge

### 2.1. Fuzzy Extractor

In order to solve the contradiction between the variability of extracted biometric feature data and the input stability of traditional cryptography, Dodis proposed an algorithm of fuzzy extractors [20]. The algorithm could keep the numerical consistency of output results in the case of slight differences in the extracted biometric features.Fuzzy extractor includes generation functionGen⋅ and reproduction function ep⋅, and Gen⋅ is a probabilistic generating function. When the user inputs a biometric feature BIOi, the function will generate a random string bi limited to a fixed length (bi∈0,1m) and a public reproduction parameter Pi (as an auxiliary string), namely, GenBIOi=bi,Pi, and Rep⋅ is a deterministic reproduction function which can reproduce the biometric key according to the input biometric feature BIOi′ and corresponding public reproduction parameter Pi. If the Hamming distance between BIOi and BIOi′ is within the preset fault tolerance threshold, RepBIOi′,Pi=bi. When Gen⋅ and Rep⋅ run in polynomial time, fuzzy extractor is very efficient. Without the aid of the original biometric feature, the biometric key cannot be reproduced with only the public reproduction parameter through calculation [4].The application of fuzzy extractor can be effectively combined with cryptography in the field of authentication. In recent years, fuzzy extractor is used in many multi-factor authentication schemes [21–25].


### 2.2. Chebyshev Map

Definition 1.
Chebyshev polynomial Tnx is the polynomial of n orders about x, where n is a natural number, x∈−1,1, and Tnx=cosn∗arccosx.
According to trigonometric transformation, Chebyshev polynomial iterative relation can be obtained as follows:T0x=1, T1x=x, …, Tnx=2xTn−1x−Tn−2x.Definition 2.
The cryptosystem based on Chebyshev polynomial has the risk that session key is intercepted. In order to remedy the security defect, Zhang et al. [26] extended the domain of x from x∈−1,1 to x∈−∞,+∞ in 2008, that is, extended Chebyshev polynomial:(1)Tnx≡2xTn−1x−Tn−2xmodp,where ≥2, x∈−∞,+∞, and p is a big prime number. It still has the semigroup property:(2)TrTsx≡Trsx≡TsTrxmodp.Definition 3.
It is a very hard problem of discrete logarithm to getr with the value x and y ( Trx=y ). It is impossible in theory.Definition 4.
It is Diffie–Hellman problem to computeTrsx using Trx and Tsx. It is also impossible in theory.


## 2.1. Fuzzy Extractor

In order to solve the contradiction between the variability of extracted biometric feature data and the input stability of traditional cryptography, Dodis proposed an algorithm of fuzzy extractors [20]. The algorithm could keep the numerical consistency of output results in the case of slight differences in the extracted biometric features.Fuzzy extractor includes generation functionGen⋅ and reproduction function ep⋅, and Gen⋅ is a probabilistic generating function. When the user inputs a biometric feature BIOi, the function will generate a random string bi limited to a fixed length (bi∈0,1m) and a public reproduction parameter Pi (as an auxiliary string), namely, GenBIOi=bi,Pi, and Rep⋅ is a deterministic reproduction function which can reproduce the biometric key according to the input biometric feature BIOi′ and corresponding public reproduction parameter Pi. If the Hamming distance between BIOi and BIOi′ is within the preset fault tolerance threshold, RepBIOi′,Pi=bi. When Gen⋅ and Rep⋅ run in polynomial time, fuzzy extractor is very efficient. Without the aid of the original biometric feature, the biometric key cannot be reproduced with only the public reproduction parameter through calculation [4].The application of fuzzy extractor can be effectively combined with cryptography in the field of authentication. In recent years, fuzzy extractor is used in many multi-factor authentication schemes [21–25].


## 2.2. Chebyshev Map

Definition 1.
Chebyshev polynomial Tnx is the polynomial of n orders about x, where n is a natural number, x∈−1,1, and Tnx=cosn∗arccosx.
According to trigonometric transformation, Chebyshev polynomial iterative relation can be obtained as follows:T0x=1, T1x=x, …, Tnx=2xTn−1x−Tn−2x.Definition 2.
The cryptosystem based on Chebyshev polynomial has the risk that session key is intercepted. In order to remedy the security defect, Zhang et al. [26] extended the domain of x from x∈−1,1 to x∈−∞,+∞ in 2008, that is, extended Chebyshev polynomial:(1)Tnx≡2xTn−1x−Tn−2xmodp,where ≥2, x∈−∞,+∞, and p is a big prime number. It still has the semigroup property:(2)TrTsx≡Trsx≡TsTrxmodp.Definition 3.
It is a very hard problem of discrete logarithm to getr with the value x and y ( Trx=y ). It is impossible in theory.Definition 4.
It is Diffie–Hellman problem to computeTrsx using Trx and Tsx. It is also impossible in theory.


## 3. Scheme Design

The authentication system consists of three parts: certificate authority (CA), user terminal, and server.CA includes registration module, important data management module, and user authority management module.User terminal includes registration module, biometric feature authentication module, password verification module, important data management module, and application interface module.Server includes registration module, key agreement module, important data management module, and application platform interface module.


### 3.1. Symbol Definitions

The symbol definitions of the proposed scheme are shown in Table1.Table 1
Symbol definitions.
SymbolDefinitionx,TkxPublic key of CAkPrivate key of CANA large prime numberIDiThe user’s identityPWiThe user’s passwordIDjThe server’s identityGen⋅Generation function of fuzzy extractorRep⋅Reproduction function of fuzzy extractorαiPublic reproduction parameterBiBiometric featurebiBiometric key of the userUih⋅Hash functionri,rjRandom numberra,rb,rcRandom numberΔtValid time interval⊕XOR║Concatenationti,tj,t1,t2,t3Current time


### 3.2. System Settings

CA first generates a private keyk (assuming that the key is absolutely secure), then selects a random string x, and generates Tkx through Chebyshev chaos map. The public key is published. The private key is hidden.


### 3.3. Registration Phase

#### 3.3.1. Server Registration Phase

The registration process of the server is shown in Figure1.Step 1. The server Sj selects a unique identity IDj and sends IDj and the current time tj to CA via secure channel.Step 2. After receiving the registration request message IDj,tj from Sj, CA first checks whether the time tj exceeds the maximum valid time interval Δt or not. If the time interval meets the requirements, CA then checks whether the identity IDj of the server is registered already or not. If the identity IDj is registered already, CA rejects the registration request. Otherwise, CA computes Sjr=hIDj∥k, selects a random number rj, and computes the key Qj=Trjx and rj′=rj⊕k. The key Qj cannot be published. Then, CA stores the data IDj,Sjr,rj′,Qj in the important data management module and sends the message Sjr,Qj to server Sj via secure channel.Step 3. After receiving Sjr,Qj, the server Sj stores them in the important data management module.Figure 1
Server registration phase.


#### 3.3.2. User Registration Phase

The process is shown in Figure2.Step 1. The user Ui selects a unique identity IDi and Wi. Then, the biometric sample Bi is input through the sensor of biometric authentication module. The biometric key bi is obtained by using the fuzzy extractor and its public reproduction parameter αi. That is, Bi=bi,αi.Step 2. The user Ui computes Ur=hIDi∥PWi, gets current time ti, and then sends the registration information Mireg=IDi,Ur,ti to CA via secure channel.Step 3. After receiving Mireg=IDi,Ur,ti, CA first checks whether the time ti exceeds the maximum time interval Δt or not. If it exceeds the maximum time interval, CA rejects the user’s request. If the result is eligible, CA checks whether the identity is registered already or not. CA forbids the user to register again. If the identity IDi is not registered, CA calculates Uir=hhIDi∥PWi∥k, selects a random number ri, and calculates the key Qi=Trix (the public key transformed into private key) and ri′=ri⊕k. Then, CA stores IDi,Uir,ri′,Qi in the important data management module and sends Uir,Qi to user Ui via the secure channel.Step 4. After receiving Uir,Qi, user Ui calculates Ui∗=Uir⊕bi and Tri∗x=Trix⊕PWi and then stores the information IDi,Ui∗,Tri∗x in the important data management module.Figure 2
User registration phase.


### 3.4. Login, Authentication, and Key Agreement Phase

If the user requests to login to the server, successfully authenticates his identity, and accesses resources, he/she must perform the steps shown in Figure3.Step 1. The user Ui inputs biometric feature through the sensor of biometric feature authentication module and uses fuzzy extractors and its public reproduction parameter αi to obtain biometric key bi′ by calculating function RepBi′,αi=bi′. When the Hamming distance from Bi′ and Bi is only less than the default tolerance threshold value, the equation bi′=bi can be set up and the user Ui can pass biometric feature authentication. Then, the user Ui calculates Uir=Ui∗⊕bi.Step 2. The user Ui inputs the correct password Wi and calculates the equation Trix=Tri∗x⊕PWi so as to pass password authentication.Step 3. The user Ui selects a random number ra as the temporary private key, calculates k1=TraTrix, Mi=hIDi∥IDj∥Uir⊕k1, and M1=Mi,IDi,Trax, obtains the current time t1, and sends the message M1,t1 to server Sj via public network. The key k1 is the one-time key generated by calculation after the combination of the private key ra and Qi,Step 4. After receiving M1,t1, server Sj first checks whether the time t1 exceeds the maximum time interval Δt or not. If it exceeds the maximum time interval, the server rejects the user’s request. If the result is eligible, server Sj selects a random number rb as the temporary private key, calculates k2=TrbTrjx, Mj=hIDi∥IDj∥Sjr⊕k2, and M2=Mj,IDj,Trbx,M1, then obtains the current time t2, and sends M2,t2 to CA via public network. The key k2 is the one-time key generated by calculation after the combination of the private key rb and Qj.Step 5. After receiving M2,t2, CA first checks whether the time t2 exceeds the maximum time interval or not. If it exceeds the maximum time interval, CA rejects the request. If it is eligible, CA calculates rj=rj′⊕k, k2′=TrjTrbx, Mj′=Mj⊕k2′, and hIDi∥IDj∥Sjr and verifies hIDi∥IDj∥Sjr=Mj′. If the result is equal, CA authenticates the server Sj.Step 6. Based on M1=Mi,IDi,Trax, CA calculates ri=ri⊕⊕k, k1′=TriTrax, Mi′=Mi⊕k1′, and hIDi∥IDj∥Uir and verifies hIDi∥IDj∥Uir=Mi′. If the result is not equal, CA stops authentication. If the result is equal, CA can authenticate the user Ui which applies for accessing the server Sj.Step 7. CA calculates Ri=hIDi∥Uir⊕k1, Rj=hIDj∥Sjr⊕k2, and M3=Rj,Ri,IDi, obtains the current time t3, and sends M3,t3 to the server Sj via public network.Step 8. After receiving M3,t3, server Sj first checks whether the time t3 exceeds the maximum time interval or not. If it exceeds the maximum time interval, the server will discard the received information. If the result is eligible, the server fetches Rj from M3 and calculates Rj′=Rj⊕k2 and hIDj∥Sjr. Then, the server verifies hIDj∥Sjr=Rj′. If the result is not equal, the server stops authentication. If the result is equal, the server can authenticate CA. Then, the server calculates the session key SK=TrbTrax which will be used with the user Ui, gets the current time t4, and sends M4,t4M4=Ri,Trbx) to the user Ui via public network.Step 9. After receiving M4,t4, user Ui first checks whether the time t4 exceeds the maximum time interval. If it oversteps the maximum time interval, user Ui will discard the received information. If the result is eligible, the user calculates Ri′=Ri⊕k1 and hIDi∥Uir. Then, the user verifies hIDi∥Uir=?Ri′. If the result is not equal, the user stops authentication. If the result is equal, the user can authenticate CA and the server Sj. Then, the user calculates the session key SK=TraTrbx which will be used with the server Sj.Figure 3
Login, authentication, and key agreement phase.


### 3.5. Password Change

If the user wants to change the password, the authentication must be completed of the user on the terminal first. Then, the user changes the password according to the steps of registration. The corresponding information stored in the user terminal and the CA can be updated.


### 3.6. Identity and Biometric Feature Change

If the user needs to change the identity, the identity can be changed by the similar steps of the password change. If the user needs to change the biometric feature, the biometric feature can be changed after the terminal authenticates the legitimate user.


## 3.1. Symbol Definitions

The symbol definitions of the proposed scheme are shown in Table1.Table 1
Symbol definitions.
SymbolDefinitionx,TkxPublic key of CAkPrivate key of CANA large prime numberIDiThe user’s identityPWiThe user’s passwordIDjThe server’s identityGen⋅Generation function of fuzzy extractorRep⋅Reproduction function of fuzzy extractorαiPublic reproduction parameterBiBiometric featurebiBiometric key of the userUih⋅Hash functionri,rjRandom numberra,rb,rcRandom numberΔtValid time interval⊕XOR║Concatenationti,tj,t1,t2,t3Current time


## 3.2. System Settings

CA first generates a private keyk (assuming that the key is absolutely secure), then selects a random string x, and generates Tkx through Chebyshev chaos map. The public key is published. The private key is hidden.


## 3.3. Registration Phase

### 3.3.1. Server Registration Phase

The registration process of the server is shown in Figure1.Step 1. The server Sj selects a unique identity IDj and sends IDj and the current time tj to CA via secure channel.Step 2. After receiving the registration request message IDj,tj from Sj, CA first checks whether the time tj exceeds the maximum valid time interval Δt or not. If the time interval meets the requirements, CA then checks whether the identity IDj of the server is registered already or not. If the identity IDj is registered already, CA rejects the registration request. Otherwise, CA computes Sjr=hIDj∥k, selects a random number rj, and computes the key Qj=Trjx and rj′=rj⊕k. The key Qj cannot be published. Then, CA stores the data IDj,Sjr,rj′,Qj in the important data management module and sends the message Sjr,Qj to server Sj via secure channel.Step 3. After receiving Sjr,Qj, the server Sj stores them in the important data management module.Figure 1
Server registration phase.


### 3.3.2. User Registration Phase

The process is shown in Figure2.Step 1. The user Ui selects a unique identity IDi and Wi. Then, the biometric sample Bi is input through the sensor of biometric authentication module. The biometric key bi is obtained by using the fuzzy extractor and its public reproduction parameter αi. That is, Bi=bi,αi.Step 2. The user Ui computes Ur=hIDi∥PWi, gets current time ti, and then sends the registration information Mireg=IDi,Ur,ti to CA via secure channel.Step 3. After receiving Mireg=IDi,Ur,ti, CA first checks whether the time ti exceeds the maximum time interval Δt or not. If it exceeds the maximum time interval, CA rejects the user’s request. If the result is eligible, CA checks whether the identity is registered already or not. CA forbids the user to register again. If the identity IDi is not registered, CA calculates Uir=hhIDi∥PWi∥k, selects a random number ri, and calculates the key Qi=Trix (the public key transformed into private key) and ri′=ri⊕k. Then, CA stores IDi,Uir,ri′,Qi in the important data management module and sends Uir,Qi to user Ui via the secure channel.Step 4. After receiving Uir,Qi, user Ui calculates Ui∗=Uir⊕bi and Tri∗x=Trix⊕PWi and then stores the information IDi,Ui∗,Tri∗x in the important data management module.Figure 2
User registration phase.


## 3.3.1. Server Registration Phase

The registration process of the server is shown in Figure1.Step 1. The server Sj selects a unique identity IDj and sends IDj and the current time tj to CA via secure channel.Step 2. After receiving the registration request message IDj,tj from Sj, CA first checks whether the time tj exceeds the maximum valid time interval Δt or not. If the time interval meets the requirements, CA then checks whether the identity IDj of the server is registered already or not. If the identity IDj is registered already, CA rejects the registration request. Otherwise, CA computes Sjr=hIDj∥k, selects a random number rj, and computes the key Qj=Trjx and rj′=rj⊕k. The key Qj cannot be published. Then, CA stores the data IDj,Sjr,rj′,Qj in the important data management module and sends the message Sjr,Qj to server Sj via secure channel.Step 3. After receiving Sjr,Qj, the server Sj stores them in the important data management module.Figure 1
Server registration phase.


## 3.3.2. User Registration Phase

The process is shown in Figure2.Step 1. The user Ui selects a unique identity IDi and Wi. Then, the biometric sample Bi is input through the sensor of biometric authentication module. The biometric key bi is obtained by using the fuzzy extractor and its public reproduction parameter αi. That is, Bi=bi,αi.Step 2. The user Ui computes Ur=hIDi∥PWi, gets current time ti, and then sends the registration information Mireg=IDi,Ur,ti to CA via secure channel.Step 3. After receiving Mireg=IDi,Ur,ti, CA first checks whether the time ti exceeds the maximum time interval Δt or not. If it exceeds the maximum time interval, CA rejects the user’s request. If the result is eligible, CA checks whether the identity is registered already or not. CA forbids the user to register again. If the identity IDi is not registered, CA calculates Uir=hhIDi∥PWi∥k, selects a random number ri, and calculates the key Qi=Trix (the public key transformed into private key) and ri′=ri⊕k. Then, CA stores IDi,Uir,ri′,Qi in the important data management module and sends Uir,Qi to user Ui via the secure channel.Step 4. After receiving Uir,Qi, user Ui calculates Ui∗=Uir⊕bi and Tri∗x=Trix⊕PWi and then stores the information IDi,Ui∗,Tri∗x in the important data management module.Figure 2
User registration phase.


## 3.4. Login, Authentication, and Key Agreement Phase

If the user requests to login to the server, successfully authenticates his identity, and accesses resources, he/she must perform the steps shown in Figure3.Step 1. The user Ui inputs biometric feature through the sensor of biometric feature authentication module and uses fuzzy extractors and its public reproduction parameter αi to obtain biometric key bi′ by calculating function RepBi′,αi=bi′. When the Hamming distance from Bi′ and Bi is only less than the default tolerance threshold value, the equation bi′=bi can be set up and the user Ui can pass biometric feature authentication. Then, the user Ui calculates Uir=Ui∗⊕bi.Step 2. The user Ui inputs the correct password Wi and calculates the equation Trix=Tri∗x⊕PWi so as to pass password authentication.Step 3. The user Ui selects a random number ra as the temporary private key, calculates k1=TraTrix, Mi=hIDi∥IDj∥Uir⊕k1, and M1=Mi,IDi,Trax, obtains the current time t1, and sends the message M1,t1 to server Sj via public network. The key k1 is the one-time key generated by calculation after the combination of the private key ra and Qi,Step 4. After receiving M1,t1, server Sj first checks whether the time t1 exceeds the maximum time interval Δt or not. If it exceeds the maximum time interval, the server rejects the user’s request. If the result is eligible, server Sj selects a random number rb as the temporary private key, calculates k2=TrbTrjx, Mj=hIDi∥IDj∥Sjr⊕k2, and M2=Mj,IDj,Trbx,M1, then obtains the current time t2, and sends M2,t2 to CA via public network. The key k2 is the one-time key generated by calculation after the combination of the private key rb and Qj.Step 5. After receiving M2,t2, CA first checks whether the time t2 exceeds the maximum time interval or not. If it exceeds the maximum time interval, CA rejects the request. If it is eligible, CA calculates rj=rj′⊕k, k2′=TrjTrbx, Mj′=Mj⊕k2′, and hIDi∥IDj∥Sjr and verifies hIDi∥IDj∥Sjr=Mj′. If the result is equal, CA authenticates the server Sj.Step 6. Based on M1=Mi,IDi,Trax, CA calculates ri=ri⊕⊕k, k1′=TriTrax, Mi′=Mi⊕k1′, and hIDi∥IDj∥Uir and verifies hIDi∥IDj∥Uir=Mi′. If the result is not equal, CA stops authentication. If the result is equal, CA can authenticate the user Ui which applies for accessing the server Sj.Step 7. CA calculates Ri=hIDi∥Uir⊕k1, Rj=hIDj∥Sjr⊕k2, and M3=Rj,Ri,IDi, obtains the current time t3, and sends M3,t3 to the server Sj via public network.Step 8. After receiving M3,t3, server Sj first checks whether the time t3 exceeds the maximum time interval or not. If it exceeds the maximum time interval, the server will discard the received information. If the result is eligible, the server fetches Rj from M3 and calculates Rj′=Rj⊕k2 and hIDj∥Sjr. Then, the server verifies hIDj∥Sjr=Rj′. If the result is not equal, the server stops authentication. If the result is equal, the server can authenticate CA. Then, the server calculates the session key SK=TrbTrax which will be used with the user Ui, gets the current time t4, and sends M4,t4M4=Ri,Trbx) to the user Ui via public network.Step 9. After receiving M4,t4, user Ui first checks whether the time t4 exceeds the maximum time interval. If it oversteps the maximum time interval, user Ui will discard the received information. If the result is eligible, the user calculates Ri′=Ri⊕k1 and hIDi∥Uir. Then, the user verifies hIDi∥Uir=?Ri′. If the result is not equal, the user stops authentication. If the result is equal, the user can authenticate CA and the server Sj. Then, the user calculates the session key SK=TraTrbx which will be used with the server Sj.Figure 3
Login, authentication, and key agreement phase.


## 3.5. Password Change

If the user wants to change the password, the authentication must be completed of the user on the terminal first. Then, the user changes the password according to the steps of registration. The corresponding information stored in the user terminal and the CA can be updated.


## 3.6. Identity and Biometric Feature Change

If the user needs to change the identity, the identity can be changed by the similar steps of the password change. If the user needs to change the biometric feature, the biometric feature can be changed after the terminal authenticates the legitimate user.


## 4. Scheme Security

### 4.1. Security Analysis

#### 4.1.1. Key Security

The user’s biometric keybi is generated by fuzzy extractor, so the attacker cannot get the user’s biometric key through the fuzzy extractor without the user’s biometric feature. In the proposed scheme, a double key combined encryption mechanism is designed. For example, the key k1 is the one-time key generated by calculation after the combination of the private key ra and Qi. Because the one-time key k1 is newly generated, the information encrypted with k1 is difficult to crack. The user calculates Fi∗=Fi⊕bi, Ui∗=Uir⊕bi, and Tri∗x=Trix⊕PWi in order to hide Uir and Trix and then stores the information IDi,Ui∗,Tri∗x into the important data management module. Suppose that attacker can obtain the data stored in the user’s terminal, and the encrypted information cannot be decrypted. Therefore, the information bi, Uir, and Trix cannot be leaked or stolen.


#### 4.1.2. Terminal Lost Attack

If the terminal device is lost, authentication requires not only the correct biometric feature information but also the correct password. The user’s secret information stored in the terminal device is encrypted data. The attacker cannot provide the correct information and decrypt the stored secret information. Therefore, the system can ensure the security of the secret information in the case of terminal device loss.


#### 4.1.3. Password Guessing Attack

In this scheme, user authentication includes two steps. If user wants to login successfully, the biometric feature and password must be correct. Without biometric feature of the legitimate user, the attacker cannot pass the initial biometric feature authentication. Therefore, the attacker cannot proceed the second step, password authentication. The shared session key generated temporarily is new and different each time. Attacker cannot guess the session key. Therefore, authentication system can effectively avoid password guessing attack.


#### 4.1.4. Impersonation Attack

Because user authentication includes biometric feature and password, the attacker cannot pass through password authentication when he initiates impersonation attack in case of obtaining the user’s biometric feature. If an attacker impersonates a legitimate user or server to transmit information, the user, server, or CA can identify the authenticity of the sender through calculation and the impersonation attack information.


#### 4.1.5. Eavesdropping Attack

The scheme uses the randomness of hash function value to hide the authentication information transmitted in the public network and uses the one-off key randomly generated by Chebyshev chaos map to encrypt the authentication information. Under the premise of this double security, the attacker cannot get useful information by eavesdropping on the messages transmitted in the public network.


#### 4.1.6. Denial-of-Service Attack

Within a certain time period, CA does not allow users using the same ID to apply for registration. Therefore, CA can avoid excessive consumption of server resources and effectively defend against denial-of-service attack.


#### 4.1.7. Man-in-the-Middle Attack

Even if information of legitimate users or servers is intercepted and tampered by attacker, the attacker cannot pass the inspection and authentication of users or servers. Therefore, the attacker cannot steal the content from the information of user and server by attack.


#### 4.1.8. Replay Attack

Time information is added to the transmitted information in the proposed scheme, which has the function of time stamp and can effectively avoid replay attack.


#### 4.1.9. Privileged Insider Attack

In this scheme, CA uses its own private key to perform XOR operation to the key of user or server to hide the important information. The password of user is protected by one-way hash function when applying for registration and authentication, which also achieves the purpose of hiding important information. In this way, privilege attack can be effectively avoided.


#### 4.1.10. Forward Security

The encryption key of authentication information is one-off in the process of certification. The sharing session key is also one-off after key agreement. The scheme has dual security by hiding and encryption. The attacker cannot crack the former session key.


#### 4.1.11. Mutual Authentication

In the proposed scheme, the shared session key calculated only by the legitimate user and server will be the same. Therefore, the scheme can realize mutual authentication among CA, user, and server. Meanwhile, the scheme can ensure the communication security between legitimate user and server.The comparison results in terms of security are shown in Table2.Table 2
Security comparison.
Security issuesBbKAS [1]BVbAS [4]PpAP [10]Proposed schemeForward security×√√√Key security×√√√Mutual authentication√×√√Key agreement√×√√Privilege insider attack√√√√Resist man-in-the-middle attack√√√√Resist replay attack√√×√Resist password guessing attack×√√√Resist terminal loss attack√√√√


### 4.2. BAN Logical Proof

#### 4.2.1. BAN Logic

Among the cryptographic protocol formal verification methods, BAN logic proposed by Burrows et al. in 1989 is the well-known one [27]. BAN logic is a kind of modal logic based on belief, which mainly includes the following three processing objects: subject, key, and formula. P, Q, and R represent the subject variable. K represents the key variable. X and Y represent the formula variable. A and B represent the two common subjects. S is the authentication server. Kab, Kac, and Kbc represent the specific shared key. Ka, Kb, and Kc represent the specific public key. Ka−1, Kb−1, and Kc−1 represent the specific secret key. Na, Nb, and Nc represent the temporary value. hX represents the irreversible hash function of X.(1)
The syntax and semantics of the BAN logical component.The syntax and semantics of the BAN logical component are shown in Table3.(2)
BAN logic inference rules.Table 3
The syntax and semantics of the BAN logical component.
SymbolDefinitionP≡XSubjectP believes X.P⊲XSubjectP receives the message X.P∼XSubjectP has sent out the message X.P⇒XSubjectP has jurisdiction over X.#XX is fresh.P↔KQK is the shared key of subjects A and B, which is unknown to other subjects.⟶KPK is the public key of the subject P. The other subjects do not know the corresponding private key K−1.⟶K−1PK−1 is the private key of the subject P.P⇌XQX is the shared secret between subjects P and Q, which is unknown to other subjects.XKThe ciphertext is obtained by encryptingX with the key K.XYA cascade between messageX and secret Y can prove that the message XY is sent by a certain subject.Message meaning rules: R1–R3. Nonce verification rule: R4. Jurisdiction rule: R5. Seeing rules: R6–R10. Freshness rules: R11. Belief rules: R12–R15. Key and secret rules: R16–R19. BAN logic inference rules are shown in Table4.Table 4
BAN logic inference rules.
Sequence numberRulesR1P≡Q↔KP,P⊲XK├P≡Q∼XR2P≡⟶KQ,P⊲XK−1├P≡Q∼XR3P≡P⇌YQ,P⊲XY├P≡Q∼XR4P≡#X,P≡Q∼X├P≡Q≡XR5P≡Q⇒X,P≡Q≡X├P≡XR6P⊲X,Y├P⊲XR7P⊲XY├P⊲XR8P≡P↔KQ,P⊲XK├P⊲XR9P≡⟶KP,P⊲XK├P⊲XR10P≡P⟶KQ,P⊲XK−1├P⊲XR11P≡#X,├P≡#X,YR12P≡X,P≡Y,├P≡X,YR13P≡X,Y,├P≡XR14P≡Q≡X,Y,├P≡Q≡XR15P≡Q∼X,Y,├P≡Q∼XR16P≡R↔KR′,├P≡R′↔KRR17P≡Q≡R↔KR′,├P≡Q≡R′↔KRR18P│≡R⇌XR′,├P│≡R′⇌XRR19P│≡Q│≡R⇌XR′,├P│≡Q│≡R′⇌XR


### 4.3. Scheme Security Proof

(1)
InitializationSj⊲Trax, Ui⊲Trbx(2)
Establish security goals G1.Sj≡Ui≡Trax, G2. Ui≡Sj≡Trbx, G3. Sj≡Trax, G4. Ui≡Trbx, G5. Sj≡Ui≡Trax,Trbx, G6. Ui≡Sj≡Trax,Trbx(3)
Protocol formalizationF1.Ui≡Trax, Ui⇒Trax, F2. Sj≡Trbx, Sj⇒Trbx, F3. Sj≡Ui∼Trax, Sj≡#Trax, F4. Ui≡Sj∼Trbx, Ui≡#Trbx, F5. Sj≡Ui⇒Trax, F6. Ui≡Sj⇒Trbx, F7.Sj≡Ui↔SKSj, F8. Ui≡Sj↔SKUi,(4)
Concrete proof processV1. According to the rule R4 and formalization F3,Sj≡Ui∼Trax,Sj≡#Trax├Sj≡Ui≡Trax can be got. Therefore, the goal G1 is true.V2. In the same way of V1 above, according to the rule R4 and formalization F4, the goal G2 is true.V3. According to the rule R5 and formalization F5,Sj≡Ui≡Trax,Sj≡Ui⇒Trax├Sj≡Trax can be obtained. Therefore, the goal G3 is true.V4. In the same way of V3 above, according to the rule R5 and formalization F6, the goal G4 is true.V5. According to goal G3, formalization F2, and rule R12,Sj≡Trax,Sj≡Trbx├Sj≡Trax,Trbx can be obtained. Therefore, the goals G5 and G6 are true.Basing on the BAN logic proof, the proposed authentication scheme can achieve the predetermined security goal, which proves that the scheme is secure.


### 4.4. ProVerif Verification

#### 4.4.1. ProVerif Code

(∗----------------channel---------------------∗)free sch: channel [private]. (∗---secure channel----∗)free ch: channel. (∗---unsecure channel----∗)(∗----------------variable and constants---------------------∗)free ID: bitstring. (∗---User ID----∗)const SID: bitstring. (∗---Application server ID----∗)const x: bitstring. (∗---Seed for Chebyshev chaotic map ----∗)const pw: bitstring [private]. (∗---password of user----∗)free treg: bitstring. (∗---the time of registration----∗)free s: bitstring [private]. (∗---key of application server----∗)free u: bitstring [private]. (∗---key of user----∗)free k: bitstring [private]. (∗---key of CA----∗)free B: bitstring [private]. (∗---biometric of user----∗)free w: bitstring [private]. (∗---parameter of fuzzy extraction algorithm----∗)free SK: bitstring [private]. (∗---the session key between user and application server--∗)(∗----------------constructor---------------------∗)fun H(bitstring): bitstring.fun senc(bitstring, bitstring): bitstring.fun T(bitstring, bitstring): bitstring. (∗---the Chebyshev chaotic map algorithm--∗)fun xor(bitstring, bitstring): bitstring.fun Concat(bitstring, bitstring): bitstring.fun GEN(bitstring): bitstring. (∗---the GEN section of fuzzy extraction algorithm--∗)fun REP(bitstring): bitstring. (∗---the REP section of fuzzy extraction algorithm--∗)(∗--------destructors&equations--------------------∗)reduc forall m: bitstring, n: bitstring; sdec(senc(m,n),n) =m.(∗reduc forall a: bitstring, b: bitstring, x:bitstring; T(b,T(a,x)) = T(a,x)∗T(b,x). ---the Chebyshev chaotic map algorithm--∗)equation forall m: bitstring, n: bitstring; xor(xor(m,n),n) =m.(∗----------------events ---------------------∗)event BeginUser(bitstring).event EndUser(bitstring).(∗----------------query ---------------------∗)query attacker(SK).query id:bitstring; inj-event(EndUser(id)) = =>inj-event(BeginUser(id)).(∗----------------process---------------------∗)(∗----------------user process---------------------∗)let user =let (b) = GEN(B) inlet UR=H(Concat(pw, ID)) inout(sch, (ID, UR, treg));event BeginUser(ID);in(sch,(URR:bitstring, Qi:bitstring)); (∗-Input some data -∗)let URb = xor(URR, b) inlet Qip = xor(Qi, pw) innew Bioaut: bitstring;new pw: bitstring;letb = REP(Bioaut) inlet Qi = xor(Qip, pw) innew a: bitstring;let tax = T(a,x) inletk1 = T(u, tax) inlet HU=H(Concat(Concat(ID, SID), URR)) inlet MU = xor(HU, k1) inout(ch,(MU, ID, tax));in(ch,(Ri:bitstring, tbx:bitstring));let Rii = xor(Ri, k1) inlet Hi = H(Concat(ID, URR)) inif Hi = Rii thenlet SK = T(a,tbx) in0).(∗----------------Application Server AS process---------------------∗)let AS =!(new tj:bitstring;out(sch,(SID,tj));in(sch,(SR:bitstring, Qj:bitstring));let SR=H(Concat(SID,k)) inlet Qj = T(s,x) inin(ch,(MU: bitstring, ID: bitstring, tax: bitstring));new b:bitstring;let tbx = T(b,x) inletk2 = T(s, tbx) inlet HS=H(Concat(Concat(ID, SID), SR)) inlet MS = xor(HS, k2) inout(ch,(MS, SID, tbx, MU, ID, tax));in(ch,(Rj: bitstring, Ri: bitstring, ID: bitstring));let Rjj = xor(Rj, k2) inlet Hj = H(Concat(SID, SR)) inif Hj = Rjj thenlet SK = T(b,tax) inout(ch,(Ri, tbx));event EndUser(ID);0).(∗----------------Certificate Authority CA process---------------------∗)let CA =in(sch, (ID:bitstring, UR:bitstring, treg:bitstring));newu: bitstring;let URR=H(Concat (UR,k)) inlet Qi = T(u,x) inlet ui = xor(u,k) inout(sch,(URR, Qi));in(sch, (SID:bitstring, tj: bitstring));new s: bitstring;let SR=H(Concat(SID,k)) inlet Qj = T(s,x) inlet sj = xor(s,k) inout(sch,(SR,Qj));in(ch,(MS:bitstring, SID:bitstring, tbx:bitstring, MU: bitstring, ID: bitstring, tax: bitstring));lets = xor(sj,k) inlet k22 = T(s, tbx) inlet MSS = xor(MS,k22) inlet HUS=H(Concat(Concat(ID,SID),SR)) inif HUS = MSS thenletu = xor(ui,k) inlet k11 = T(u, tax) inlet MUU = xor(MU,k11) inlet HSU=H(Concat(Concat(ID,SID),URR)) inif HSU = MUU thenlet HUR=H(Concat(ID,URR)) inlet Ri = xor(HUR,k11) inlet HSR=H(Concat(SID,SR)) inlet Rj = xor(HSR,k22) inout(ch,(Rj, Ri, ID));0.process (user| AS |CA)


#### 4.4.2. Performance Result

The performance result is shown in Figure4. From the result, we can see that our scheme is secure.Figure 4
Performance result of ProVerif code.


## 4.1. Security Analysis

### 4.1.1. Key Security

The user’s biometric keybi is generated by fuzzy extractor, so the attacker cannot get the user’s biometric key through the fuzzy extractor without the user’s biometric feature. In the proposed scheme, a double key combined encryption mechanism is designed. For example, the key k1 is the one-time key generated by calculation after the combination of the private key ra and Qi. Because the one-time key k1 is newly generated, the information encrypted with k1 is difficult to crack. The user calculates Fi∗=Fi⊕bi, Ui∗=Uir⊕bi, and Tri∗x=Trix⊕PWi in order to hide Uir and Trix and then stores the information IDi,Ui∗,Tri∗x into the important data management module. Suppose that attacker can obtain the data stored in the user’s terminal, and the encrypted information cannot be decrypted. Therefore, the information bi, Uir, and Trix cannot be leaked or stolen.


### 4.1.2. Terminal Lost Attack

If the terminal device is lost, authentication requires not only the correct biometric feature information but also the correct password. The user’s secret information stored in the terminal device is encrypted data. The attacker cannot provide the correct information and decrypt the stored secret information. Therefore, the system can ensure the security of the secret information in the case of terminal device loss.


### 4.1.3. Password Guessing Attack

In this scheme, user authentication includes two steps. If user wants to login successfully, the biometric feature and password must be correct. Without biometric feature of the legitimate user, the attacker cannot pass the initial biometric feature authentication. Therefore, the attacker cannot proceed the second step, password authentication. The shared session key generated temporarily is new and different each time. Attacker cannot guess the session key. Therefore, authentication system can effectively avoid password guessing attack.


### 4.1.4. Impersonation Attack

Because user authentication includes biometric feature and password, the attacker cannot pass through password authentication when he initiates impersonation attack in case of obtaining the user’s biometric feature. If an attacker impersonates a legitimate user or server to transmit information, the user, server, or CA can identify the authenticity of the sender through calculation and the impersonation attack information.


### 4.1.5. Eavesdropping Attack

The scheme uses the randomness of hash function value to hide the authentication information transmitted in the public network and uses the one-off key randomly generated by Chebyshev chaos map to encrypt the authentication information. Under the premise of this double security, the attacker cannot get useful information by eavesdropping on the messages transmitted in the public network.


### 4.1.6. Denial-of-Service Attack

Within a certain time period, CA does not allow users using the same ID to apply for registration. Therefore, CA can avoid excessive consumption of server resources and effectively defend against denial-of-service attack.


### 4.1.7. Man-in-the-Middle Attack

Even if information of legitimate users or servers is intercepted and tampered by attacker, the attacker cannot pass the inspection and authentication of users or servers. Therefore, the attacker cannot steal the content from the information of user and server by attack.


### 4.1.8. Replay Attack

Time information is added to the transmitted information in the proposed scheme, which has the function of time stamp and can effectively avoid replay attack.


### 4.1.9. Privileged Insider Attack

In this scheme, CA uses its own private key to perform XOR operation to the key of user or server to hide the important information. The password of user is protected by one-way hash function when applying for registration and authentication, which also achieves the purpose of hiding important information. In this way, privilege attack can be effectively avoided.


### 4.1.10. Forward Security

The encryption key of authentication information is one-off in the process of certification. The sharing session key is also one-off after key agreement. The scheme has dual security by hiding and encryption. The attacker cannot crack the former session key.


### 4.1.11. Mutual Authentication

In the proposed scheme, the shared session key calculated only by the legitimate user and server will be the same. Therefore, the scheme can realize mutual authentication among CA, user, and server. Meanwhile, the scheme can ensure the communication security between legitimate user and server.The comparison results in terms of security are shown in Table2.Table 2
Security comparison.
Security issuesBbKAS [1]BVbAS [4]PpAP [10]Proposed schemeForward security×√√√Key security×√√√Mutual authentication√×√√Key agreement√×√√Privilege insider attack√√√√Resist man-in-the-middle attack√√√√Resist replay attack√√×√Resist password guessing attack×√√√Resist terminal loss attack√√√√


## 4.1.1. Key Security

The user’s biometric keybi is generated by fuzzy extractor, so the attacker cannot get the user’s biometric key through the fuzzy extractor without the user’s biometric feature. In the proposed scheme, a double key combined encryption mechanism is designed. For example, the key k1 is the one-time key generated by calculation after the combination of the private key ra and Qi. Because the one-time key k1 is newly generated, the information encrypted with k1 is difficult to crack. The user calculates Fi∗=Fi⊕bi, Ui∗=Uir⊕bi, and Tri∗x=Trix⊕PWi in order to hide Uir and Trix and then stores the information IDi,Ui∗,Tri∗x into the important data management module. Suppose that attacker can obtain the data stored in the user’s terminal, and the encrypted information cannot be decrypted. Therefore, the information bi, Uir, and Trix cannot be leaked or stolen.


## 4.1.2. Terminal Lost Attack

If the terminal device is lost, authentication requires not only the correct biometric feature information but also the correct password. The user’s secret information stored in the terminal device is encrypted data. The attacker cannot provide the correct information and decrypt the stored secret information. Therefore, the system can ensure the security of the secret information in the case of terminal device loss.


## 4.1.3. Password Guessing Attack

In this scheme, user authentication includes two steps. If user wants to login successfully, the biometric feature and password must be correct. Without biometric feature of the legitimate user, the attacker cannot pass the initial biometric feature authentication. Therefore, the attacker cannot proceed the second step, password authentication. The shared session key generated temporarily is new and different each time. Attacker cannot guess the session key. Therefore, authentication system can effectively avoid password guessing attack.


## 4.1.4. Impersonation Attack

Because user authentication includes biometric feature and password, the attacker cannot pass through password authentication when he initiates impersonation attack in case of obtaining the user’s biometric feature. If an attacker impersonates a legitimate user or server to transmit information, the user, server, or CA can identify the authenticity of the sender through calculation and the impersonation attack information.


## 4.1.5. Eavesdropping Attack

The scheme uses the randomness of hash function value to hide the authentication information transmitted in the public network and uses the one-off key randomly generated by Chebyshev chaos map to encrypt the authentication information. Under the premise of this double security, the attacker cannot get useful information by eavesdropping on the messages transmitted in the public network.


## 4.1.6. Denial-of-Service Attack

Within a certain time period, CA does not allow users using the same ID to apply for registration. Therefore, CA can avoid excessive consumption of server resources and effectively defend against denial-of-service attack.


## 4.1.7. Man-in-the-Middle Attack

Even if information of legitimate users or servers is intercepted and tampered by attacker, the attacker cannot pass the inspection and authentication of users or servers. Therefore, the attacker cannot steal the content from the information of user and server by attack.


## 4.1.8. Replay Attack

Time information is added to the transmitted information in the proposed scheme, which has the function of time stamp and can effectively avoid replay attack.


## 4.1.9. Privileged Insider Attack

In this scheme, CA uses its own private key to perform XOR operation to the key of user or server to hide the important information. The password of user is protected by one-way hash function when applying for registration and authentication, which also achieves the purpose of hiding important information. In this way, privilege attack can be effectively avoided.


## 4.1.10. Forward Security

The encryption key of authentication information is one-off in the process of certification. The sharing session key is also one-off after key agreement. The scheme has dual security by hiding and encryption. The attacker cannot crack the former session key.


## 4.1.11. Mutual Authentication

In the proposed scheme, the shared session key calculated only by the legitimate user and server will be the same. Therefore, the scheme can realize mutual authentication among CA, user, and server. Meanwhile, the scheme can ensure the communication security between legitimate user and server.The comparison results in terms of security are shown in Table2.Table 2
Security comparison.
Security issuesBbKAS [1]BVbAS [4]PpAP [10]Proposed schemeForward security×√√√Key security×√√√Mutual authentication√×√√Key agreement√×√√Privilege insider attack√√√√Resist man-in-the-middle attack√√√√Resist replay attack√√×√Resist password guessing attack×√√√Resist terminal loss attack√√√√


## 4.2. BAN Logical Proof

### 4.2.1. BAN Logic

Among the cryptographic protocol formal verification methods, BAN logic proposed by Burrows et al. in 1989 is the well-known one [27]. BAN logic is a kind of modal logic based on belief, which mainly includes the following three processing objects: subject, key, and formula. P, Q, and R represent the subject variable. K represents the key variable. X and Y represent the formula variable. A and B represent the two common subjects. S is the authentication server. Kab, Kac, and Kbc represent the specific shared key. Ka, Kb, and Kc represent the specific public key. Ka−1, Kb−1, and Kc−1 represent the specific secret key. Na, Nb, and Nc represent the temporary value. hX represents the irreversible hash function of X.(1)
The syntax and semantics of the BAN logical component.The syntax and semantics of the BAN logical component are shown in Table3.(2)
BAN logic inference rules.Table 3
The syntax and semantics of the BAN logical component.
SymbolDefinitionP≡XSubjectP believes X.P⊲XSubjectP receives the message X.P∼XSubjectP has sent out the message X.P⇒XSubjectP has jurisdiction over X.#XX is fresh.P↔KQK is the shared key of subjects A and B, which is unknown to other subjects.⟶KPK is the public key of the subject P. The other subjects do not know the corresponding private key K−1.⟶K−1PK−1 is the private key of the subject P.P⇌XQX is the shared secret between subjects P and Q, which is unknown to other subjects.XKThe ciphertext is obtained by encryptingX with the key K.XYA cascade between messageX and secret Y can prove that the message XY is sent by a certain subject.Message meaning rules: R1–R3. Nonce verification rule: R4. Jurisdiction rule: R5. Seeing rules: R6–R10. Freshness rules: R11. Belief rules: R12–R15. Key and secret rules: R16–R19. BAN logic inference rules are shown in Table4.Table 4
BAN logic inference rules.
Sequence numberRulesR1P≡Q↔KP,P⊲XK├P≡Q∼XR2P≡⟶KQ,P⊲XK−1├P≡Q∼XR3P≡P⇌YQ,P⊲XY├P≡Q∼XR4P≡#X,P≡Q∼X├P≡Q≡XR5P≡Q⇒X,P≡Q≡X├P≡XR6P⊲X,Y├P⊲XR7P⊲XY├P⊲XR8P≡P↔KQ,P⊲XK├P⊲XR9P≡⟶KP,P⊲XK├P⊲XR10P≡P⟶KQ,P⊲XK−1├P⊲XR11P≡#X,├P≡#X,YR12P≡X,P≡Y,├P≡X,YR13P≡X,Y,├P≡XR14P≡Q≡X,Y,├P≡Q≡XR15P≡Q∼X,Y,├P≡Q∼XR16P≡R↔KR′,├P≡R′↔KRR17P≡Q≡R↔KR′,├P≡Q≡R′↔KRR18P│≡R⇌XR′,├P│≡R′⇌XRR19P│≡Q│≡R⇌XR′,├P│≡Q│≡R′⇌XR


## 4.2.1. BAN Logic

Among the cryptographic protocol formal verification methods, BAN logic proposed by Burrows et al. in 1989 is the well-known one [27]. BAN logic is a kind of modal logic based on belief, which mainly includes the following three processing objects: subject, key, and formula. P, Q, and R represent the subject variable. K represents the key variable. X and Y represent the formula variable. A and B represent the two common subjects. S is the authentication server. Kab, Kac, and Kbc represent the specific shared key. Ka, Kb, and Kc represent the specific public key. Ka−1, Kb−1, and Kc−1 represent the specific secret key. Na, Nb, and Nc represent the temporary value. hX represents the irreversible hash function of X.(1)
The syntax and semantics of the BAN logical component.The syntax and semantics of the BAN logical component are shown in Table3.(2)
BAN logic inference rules.Table 3
The syntax and semantics of the BAN logical component.
SymbolDefinitionP≡XSubjectP believes X.P⊲XSubjectP receives the message X.P∼XSubjectP has sent out the message X.P⇒XSubjectP has jurisdiction over X.#XX is fresh.P↔KQK is the shared key of subjects A and B, which is unknown to other subjects.⟶KPK is the public key of the subject P. The other subjects do not know the corresponding private key K−1.⟶K−1PK−1 is the private key of the subject P.P⇌XQX is the shared secret between subjects P and Q, which is unknown to other subjects.XKThe ciphertext is obtained by encryptingX with the key K.XYA cascade between messageX and secret Y can prove that the message XY is sent by a certain subject.Message meaning rules: R1–R3. Nonce verification rule: R4. Jurisdiction rule: R5. Seeing rules: R6–R10. Freshness rules: R11. Belief rules: R12–R15. Key and secret rules: R16–R19. BAN logic inference rules are shown in Table4.Table 4
BAN logic inference rules.
Sequence numberRulesR1P≡Q↔KP,P⊲XK├P≡Q∼XR2P≡⟶KQ,P⊲XK−1├P≡Q∼XR3P≡P⇌YQ,P⊲XY├P≡Q∼XR4P≡#X,P≡Q∼X├P≡Q≡XR5P≡Q⇒X,P≡Q≡X├P≡XR6P⊲X,Y├P⊲XR7P⊲XY├P⊲XR8P≡P↔KQ,P⊲XK├P⊲XR9P≡⟶KP,P⊲XK├P⊲XR10P≡P⟶KQ,P⊲XK−1├P⊲XR11P≡#X,├P≡#X,YR12P≡X,P≡Y,├P≡X,YR13P≡X,Y,├P≡XR14P≡Q≡X,Y,├P≡Q≡XR15P≡Q∼X,Y,├P≡Q∼XR16P≡R↔KR′,├P≡R′↔KRR17P≡Q≡R↔KR′,├P≡Q≡R′↔KRR18P│≡R⇌XR′,├P│≡R′⇌XRR19P│≡Q│≡R⇌XR′,├P│≡Q│≡R′⇌XR


## 4.3. Scheme Security Proof

(1)
InitializationSj⊲Trax, Ui⊲Trbx(2)
Establish security goals G1.Sj≡Ui≡Trax, G2. Ui≡Sj≡Trbx, G3. Sj≡Trax, G4. Ui≡Trbx, G5. Sj≡Ui≡Trax,Trbx, G6. Ui≡Sj≡Trax,Trbx(3)
Protocol formalizationF1.Ui≡Trax, Ui⇒Trax, F2. Sj≡Trbx, Sj⇒Trbx, F3. Sj≡Ui∼Trax, Sj≡#Trax, F4. Ui≡Sj∼Trbx, Ui≡#Trbx, F5. Sj≡Ui⇒Trax, F6. Ui≡Sj⇒Trbx, F7.Sj≡Ui↔SKSj, F8. Ui≡Sj↔SKUi,(4)
Concrete proof processV1. According to the rule R4 and formalization F3,Sj≡Ui∼Trax,Sj≡#Trax├Sj≡Ui≡Trax can be got. Therefore, the goal G1 is true.V2. In the same way of V1 above, according to the rule R4 and formalization F4, the goal G2 is true.V3. According to the rule R5 and formalization F5,Sj≡Ui≡Trax,Sj≡Ui⇒Trax├Sj≡Trax can be obtained. Therefore, the goal G3 is true.V4. In the same way of V3 above, according to the rule R5 and formalization F6, the goal G4 is true.V5. According to goal G3, formalization F2, and rule R12,Sj≡Trax,Sj≡Trbx├Sj≡Trax,Trbx can be obtained. Therefore, the goals G5 and G6 are true.Basing on the BAN logic proof, the proposed authentication scheme can achieve the predetermined security goal, which proves that the scheme is secure.


## 4.4. ProVerif Verification

### 4.4.1. ProVerif Code

(∗----------------channel---------------------∗)free sch: channel [private]. (∗---secure channel----∗)free ch: channel. (∗---unsecure channel----∗)(∗----------------variable and constants---------------------∗)free ID: bitstring. (∗---User ID----∗)const SID: bitstring. (∗---Application server ID----∗)const x: bitstring. (∗---Seed for Chebyshev chaotic map ----∗)const pw: bitstring [private]. (∗---password of user----∗)free treg: bitstring. (∗---the time of registration----∗)free s: bitstring [private]. (∗---key of application server----∗)free u: bitstring [private]. (∗---key of user----∗)free k: bitstring [private]. (∗---key of CA----∗)free B: bitstring [private]. (∗---biometric of user----∗)free w: bitstring [private]. (∗---parameter of fuzzy extraction algorithm----∗)free SK: bitstring [private]. (∗---the session key between user and application server--∗)(∗----------------constructor---------------------∗)fun H(bitstring): bitstring.fun senc(bitstring, bitstring): bitstring.fun T(bitstring, bitstring): bitstring. (∗---the Chebyshev chaotic map algorithm--∗)fun xor(bitstring, bitstring): bitstring.fun Concat(bitstring, bitstring): bitstring.fun GEN(bitstring): bitstring. (∗---the GEN section of fuzzy extraction algorithm--∗)fun REP(bitstring): bitstring. (∗---the REP section of fuzzy extraction algorithm--∗)(∗--------destructors&equations--------------------∗)reduc forall m: bitstring, n: bitstring; sdec(senc(m,n),n) =m.(∗reduc forall a: bitstring, b: bitstring, x:bitstring; T(b,T(a,x)) = T(a,x)∗T(b,x). ---the Chebyshev chaotic map algorithm--∗)equation forall m: bitstring, n: bitstring; xor(xor(m,n),n) =m.(∗----------------events ---------------------∗)event BeginUser(bitstring).event EndUser(bitstring).(∗----------------query ---------------------∗)query attacker(SK).query id:bitstring; inj-event(EndUser(id)) = =>inj-event(BeginUser(id)).(∗----------------process---------------------∗)(∗----------------user process---------------------∗)let user =let (b) = GEN(B) inlet UR=H(Concat(pw, ID)) inout(sch, (ID, UR, treg));event BeginUser(ID);in(sch,(URR:bitstring, Qi:bitstring)); (∗-Input some data -∗)let URb = xor(URR, b) inlet Qip = xor(Qi, pw) innew Bioaut: bitstring;new pw: bitstring;letb = REP(Bioaut) inlet Qi = xor(Qip, pw) innew a: bitstring;let tax = T(a,x) inletk1 = T(u, tax) inlet HU=H(Concat(Concat(ID, SID), URR)) inlet MU = xor(HU, k1) inout(ch,(MU, ID, tax));in(ch,(Ri:bitstring, tbx:bitstring));let Rii = xor(Ri, k1) inlet Hi = H(Concat(ID, URR)) inif Hi = Rii thenlet SK = T(a,tbx) in0).(∗----------------Application Server AS process---------------------∗)let AS =!(new tj:bitstring;out(sch,(SID,tj));in(sch,(SR:bitstring, Qj:bitstring));let SR=H(Concat(SID,k)) inlet Qj = T(s,x) inin(ch,(MU: bitstring, ID: bitstring, tax: bitstring));new b:bitstring;let tbx = T(b,x) inletk2 = T(s, tbx) inlet HS=H(Concat(Concat(ID, SID), SR)) inlet MS = xor(HS, k2) inout(ch,(MS, SID, tbx, MU, ID, tax));in(ch,(Rj: bitstring, Ri: bitstring, ID: bitstring));let Rjj = xor(Rj, k2) inlet Hj = H(Concat(SID, SR)) inif Hj = Rjj thenlet SK = T(b,tax) inout(ch,(Ri, tbx));event EndUser(ID);0).(∗----------------Certificate Authority CA process---------------------∗)let CA =in(sch, (ID:bitstring, UR:bitstring, treg:bitstring));newu: bitstring;let URR=H(Concat (UR,k)) inlet Qi = T(u,x) inlet ui = xor(u,k) inout(sch,(URR, Qi));in(sch, (SID:bitstring, tj: bitstring));new s: bitstring;let SR=H(Concat(SID,k)) inlet Qj = T(s,x) inlet sj = xor(s,k) inout(sch,(SR,Qj));in(ch,(MS:bitstring, SID:bitstring, tbx:bitstring, MU: bitstring, ID: bitstring, tax: bitstring));lets = xor(sj,k) inlet k22 = T(s, tbx) inlet MSS = xor(MS,k22) inlet HUS=H(Concat(Concat(ID,SID),SR)) inif HUS = MSS thenletu = xor(ui,k) inlet k11 = T(u, tax) inlet MUU = xor(MU,k11) inlet HSU=H(Concat(Concat(ID,SID),URR)) inif HSU = MUU thenlet HUR=H(Concat(ID,URR)) inlet Ri = xor(HUR,k11) inlet HSR=H(Concat(SID,SR)) inlet Rj = xor(HSR,k22) inout(ch,(Rj, Ri, ID));0.process (user| AS |CA)


### 4.4.2. Performance Result

The performance result is shown in Figure4. From the result, we can see that our scheme is secure.Figure 4
Performance result of ProVerif code.


## 4.4.1. ProVerif Code

(∗----------------channel---------------------∗)free sch: channel [private]. (∗---secure channel----∗)free ch: channel. (∗---unsecure channel----∗)(∗----------------variable and constants---------------------∗)free ID: bitstring. (∗---User ID----∗)const SID: bitstring. (∗---Application server ID----∗)const x: bitstring. (∗---Seed for Chebyshev chaotic map ----∗)const pw: bitstring [private]. (∗---password of user----∗)free treg: bitstring. (∗---the time of registration----∗)free s: bitstring [private]. (∗---key of application server----∗)free u: bitstring [private]. (∗---key of user----∗)free k: bitstring [private]. (∗---key of CA----∗)free B: bitstring [private]. (∗---biometric of user----∗)free w: bitstring [private]. (∗---parameter of fuzzy extraction algorithm----∗)free SK: bitstring [private]. (∗---the session key between user and application server--∗)(∗----------------constructor---------------------∗)fun H(bitstring): bitstring.fun senc(bitstring, bitstring): bitstring.fun T(bitstring, bitstring): bitstring. (∗---the Chebyshev chaotic map algorithm--∗)fun xor(bitstring, bitstring): bitstring.fun Concat(bitstring, bitstring): bitstring.fun GEN(bitstring): bitstring. (∗---the GEN section of fuzzy extraction algorithm--∗)fun REP(bitstring): bitstring. (∗---the REP section of fuzzy extraction algorithm--∗)(∗--------destructors&equations--------------------∗)reduc forall m: bitstring, n: bitstring; sdec(senc(m,n),n) =m.(∗reduc forall a: bitstring, b: bitstring, x:bitstring; T(b,T(a,x)) = T(a,x)∗T(b,x). ---the Chebyshev chaotic map algorithm--∗)equation forall m: bitstring, n: bitstring; xor(xor(m,n),n) =m.(∗----------------events ---------------------∗)event BeginUser(bitstring).event EndUser(bitstring).(∗----------------query ---------------------∗)query attacker(SK).query id:bitstring; inj-event(EndUser(id)) = =>inj-event(BeginUser(id)).(∗----------------process---------------------∗)(∗----------------user process---------------------∗)let user =let (b) = GEN(B) inlet UR=H(Concat(pw, ID)) inout(sch, (ID, UR, treg));event BeginUser(ID);in(sch,(URR:bitstring, Qi:bitstring)); (∗-Input some data -∗)let URb = xor(URR, b) inlet Qip = xor(Qi, pw) innew Bioaut: bitstring;new pw: bitstring;letb = REP(Bioaut) inlet Qi = xor(Qip, pw) innew a: bitstring;let tax = T(a,x) inletk1 = T(u, tax) inlet HU=H(Concat(Concat(ID, SID), URR)) inlet MU = xor(HU, k1) inout(ch,(MU, ID, tax));in(ch,(Ri:bitstring, tbx:bitstring));let Rii = xor(Ri, k1) inlet Hi = H(Concat(ID, URR)) inif Hi = Rii thenlet SK = T(a,tbx) in0).(∗----------------Application Server AS process---------------------∗)let AS =!(new tj:bitstring;out(sch,(SID,tj));in(sch,(SR:bitstring, Qj:bitstring));let SR=H(Concat(SID,k)) inlet Qj = T(s,x) inin(ch,(MU: bitstring, ID: bitstring, tax: bitstring));new b:bitstring;let tbx = T(b,x) inletk2 = T(s, tbx) inlet HS=H(Concat(Concat(ID, SID), SR)) inlet MS = xor(HS, k2) inout(ch,(MS, SID, tbx, MU, ID, tax));in(ch,(Rj: bitstring, Ri: bitstring, ID: bitstring));let Rjj = xor(Rj, k2) inlet Hj = H(Concat(SID, SR)) inif Hj = Rjj thenlet SK = T(b,tax) inout(ch,(Ri, tbx));event EndUser(ID);0).(∗----------------Certificate Authority CA process---------------------∗)let CA =in(sch, (ID:bitstring, UR:bitstring, treg:bitstring));newu: bitstring;let URR=H(Concat (UR,k)) inlet Qi = T(u,x) inlet ui = xor(u,k) inout(sch,(URR, Qi));in(sch, (SID:bitstring, tj: bitstring));new s: bitstring;let SR=H(Concat(SID,k)) inlet Qj = T(s,x) inlet sj = xor(s,k) inout(sch,(SR,Qj));in(ch,(MS:bitstring, SID:bitstring, tbx:bitstring, MU: bitstring, ID: bitstring, tax: bitstring));lets = xor(sj,k) inlet k22 = T(s, tbx) inlet MSS = xor(MS,k22) inlet HUS=H(Concat(Concat(ID,SID),SR)) inif HUS = MSS thenletu = xor(ui,k) inlet k11 = T(u, tax) inlet MUU = xor(MU,k11) inlet HSU=H(Concat(Concat(ID,SID),URR)) inif HSU = MUU thenlet HUR=H(Concat(ID,URR)) inlet Ri = xor(HUR,k11) inlet HSR=H(Concat(SID,SR)) inlet Rj = xor(HSR,k22) inout(ch,(Rj, Ri, ID));0.process (user| AS |CA)


## 4.4.2. Performance Result

The performance result is shown in Figure4. From the result, we can see that our scheme is secure.Figure 4
Performance result of ProVerif code.


## 5. Performance

### 5.1. Computation Cost

According to literature [1, 10, 28–31] and the measured consumption time of the relative algorithms of the proposed scheme on our Intel Core i5-3470 platform, the details are shown as follows.TX: XOR. Because XOR operation time is very small, it can be ignored. TH: hash operation. The hash operation time is 0.6 ms. TC (TnxmodP): Chebyshev chaotic map. Its operation takes twice the time of hash operation. TGEN: the time of obtaining public parameters and feature key from biometric feature by fuzzy extractor algorithm. The time is 805 times that of hash operation. TRep: the time of regenerating the biometric key from biometric feature and public parameter by fuzzy extractor algorithm. The time is 187 times that of hash operation. TE and TD: symmetric encryption operation and symmetric decryption operation. The operations of both of them take twice the time of hash operation. TECC: encryption or decryption of elliptic curve public key cryptography. The time is 968 times that of hash operation. TP: the time of an elliptic curve point multiplication. The time is 126 times that of hash operation. TA: the time of an elliptic curve point addition. The time is 14 times that of hash operation. The comparison results of execution time of the related schemes are shown in Table 5.Table 5
Execution time comparison.
SchemeRegistration phaseLogin, authentication, and key agreement phasePassword change phaseBbKAS [1]3TH+TGen=808TH12TH+6TC+8TE+TGen=845TH2TH+TGen=807THBVbAS [4]9TH+TGen=814TH21TH+TRep+4TC=216TH8TH+TRep+TGen=1000THPpAP [10]11TH+9TP+4TA=1201TH17TH+7TP+7TA=1277TH6TH+4TP+2TA=538THProposed scheme3TH+2TC+TGen=814TH8TH+TRep+6TC=207TH2TH+2TC+4TE+TRep=201THAs can be seen from Table5, the computation cost of two phases is the lowest respectively in our proposed scheme. The proposed scheme is superior to the similar scheme in [1, 4, 10].


### 5.2. Communication Cost

Referring to [1, 4, 10], we set the length as follows. LID: the length of identity is 32bits; LH: the length of hash function is 160bits; LM: the output size of chaotic maps is 128bits; LT: the length of time is 128bits because it can be considered as a random number; LE: the length of symmetric encryption/decryption is 128bits; LP: the output size of an elliptic curve point P=Px,Py is 320bits; and Lr: the length of random nonce is 128bits.Here only the often executed login and authentication phases are considered for cost calculations. The comparison results of communication cost for the protocols are presented in Table6. It can be observed that our scheme is more efficient than the schemes [1, 10] in communication cost.Table 6
Communication cost comparison.
SchemeLogin, authentication, and key agreement phase (bits)BbKAS [1]6LM+15LID+8LT=2528BVbAS [4]7LH+3LT=1504PpAP [10]4LH+6LP+4LT=3072Proposed scheme6LH+5LID+4LM+4LT=2144


## 5.1. Computation Cost

According to literature [1, 10, 28–31] and the measured consumption time of the relative algorithms of the proposed scheme on our Intel Core i5-3470 platform, the details are shown as follows.TX: XOR. Because XOR operation time is very small, it can be ignored. TH: hash operation. The hash operation time is 0.6 ms. TC (TnxmodP): Chebyshev chaotic map. Its operation takes twice the time of hash operation. TGEN: the time of obtaining public parameters and feature key from biometric feature by fuzzy extractor algorithm. The time is 805 times that of hash operation. TRep: the time of regenerating the biometric key from biometric feature and public parameter by fuzzy extractor algorithm. The time is 187 times that of hash operation. TE and TD: symmetric encryption operation and symmetric decryption operation. The operations of both of them take twice the time of hash operation. TECC: encryption or decryption of elliptic curve public key cryptography. The time is 968 times that of hash operation. TP: the time of an elliptic curve point multiplication. The time is 126 times that of hash operation. TA: the time of an elliptic curve point addition. The time is 14 times that of hash operation. The comparison results of execution time of the related schemes are shown in Table 5.Table 5
Execution time comparison.
SchemeRegistration phaseLogin, authentication, and key agreement phasePassword change phaseBbKAS [1]3TH+TGen=808TH12TH+6TC+8TE+TGen=845TH2TH+TGen=807THBVbAS [4]9TH+TGen=814TH21TH+TRep+4TC=216TH8TH+TRep+TGen=1000THPpAP [10]11TH+9TP+4TA=1201TH17TH+7TP+7TA=1277TH6TH+4TP+2TA=538THProposed scheme3TH+2TC+TGen=814TH8TH+TRep+6TC=207TH2TH+2TC+4TE+TRep=201THAs can be seen from Table5, the computation cost of two phases is the lowest respectively in our proposed scheme. The proposed scheme is superior to the similar scheme in [1, 4, 10].


## 5.2. Communication Cost

Referring to [1, 4, 10], we set the length as follows. LID: the length of identity is 32bits; LH: the length of hash function is 160bits; LM: the output size of chaotic maps is 128bits; LT: the length of time is 128bits because it can be considered as a random number; LE: the length of symmetric encryption/decryption is 128bits; LP: the output size of an elliptic curve point P=Px,Py is 320bits; and Lr: the length of random nonce is 128bits.Here only the often executed login and authentication phases are considered for cost calculations. The comparison results of communication cost for the protocols are presented in Table6. It can be observed that our scheme is more efficient than the schemes [1, 10] in communication cost.Table 6
Communication cost comparison.
SchemeLogin, authentication, and key agreement phase (bits)BbKAS [1]6LM+15LID+8LT=2528BVbAS [4]7LH+3LT=1504PpAP [10]4LH+6LP+4LT=3072Proposed scheme6LH+5LID+4LM+4LT=2144


## 6. Conclusion

In order to improve security of authentication system and strengthen protection for sensitive information and privacy of users, a provably secure Chebyshev chaotic map (CCM)-based authentication scheme is proposed. The scheme uses hash function to hide user information and uses fuzzy extractor to authenticate user biometric feature. Especially, the proposed scheme transformed the traditional public key of Chebyshev chaotic map into a private key and combined two private keys to compute a one-time key used to encrypt authentication information. The results verified by BAN logic and ProVerif simulation tool confirm that the scheme is well secured against all existing security threats. Compared with similar schemes, the proposed scheme is more efficient and secure. Therefore, the proposed scheme has great application value in high security demands scenarios such as mobile payment and contactless access control. In the future, we will continue to further study authentication schemes for more complex network environment.



---

*Source: 7318948-2022-10-12.xml*