# An Anonymous and Efficient ECC-Based Authentication Scheme for SIP

Authors: Yousheng Zhou; Xinyun Chen
Journal: Wireless Communications and Mobile Computing
 (2020)

---

## Abstract

Session initiation protocol (SIP), a widely used signal protocol for controlling multimedia communication sessions, is under numerous attacks when performing the authentication steps between the user and server. So secure authentication schemes are needed to be presented for SIP. Recently, Arshad et al. advanced novel schemes for SIP using elliptic curve cryptography (ECC) and claimed their schemes can resist various attacks. However, Lu et al. found that Arshad et al.’s scheme cannot resist trace and key-compromise impersonation attacks; hence, it cannot provide proper mutual authentication. Meanwhile, an enhanced scheme was advanced by Lu et al. and they stated that their scheme can stand up to possible known attacks. Nevertheless, in this paper, we conclude that Arshad and Nikooghadam’s scheme is insecure against impersonation attack and Lu et al.’s scheme is still vulnerable to impersonation attack. To overcome these weaknesses of their schemes, we present a novel anonymous ECC-based scheme for SIP. Security analysis and performance analysis show that our proposed scheme can resist various known attacks and efficient in the meantime.


---

## Body

## 1. Introduction

SIP (session initiation protocol), a text-based application layer signaling control protocol, is used to create, modify, and release sessions between participators. These sessions will be initiated when users request Internet multimedia conferences, IP phones, and multimedia distribution. The participants of SIP can communicate with each other by multicast, unicast, or a mixture of two. SIP is widely used since 2002, the time when it was presented by the Internet Engineering Task Force (IETF) [1]. To protect the privacy of users, it is critical for SIP to provide mutual authentication between communicating parties. Therefore, many researchers devote to proposing secure and efficient schemes for SIP to prevent various attacks and provide mutual authentication between a legal user and server nowadays.In 2009, Tsai [2] presented a scheme based on random nonce for SIP. He used one-way hash functions and exclusive or operations to encrypts/decrypts all the necessary information. So Tsai’s scheme can be used in low-computation equipment because its computation cost is very low. Later, Yoon et al. [3] demonstrated that Tsai’s scheme is not secure against off-line password guessing attack, Denning-Sacco attack, and stolen-verifier attack and cannot provide perfect forward secrecy. To overcome the shortcomings of Tsai’s scheme, Yoon et al. proposed a scheme based on the elliptic curve discrete logarithm problem (ECDLP) for SIP and they claimed their scheme can resist various attacks while providing more efficiency than Tsai’s scheme. In 2012, Xie [4] proposed an improved scheme after finding Yoon et al.’s scheme is still too weak to resist stolen-verifier attack and off-line password guessing attack. Shortly afterwards, Farash and Attari [5] demonstrated that Xie’s scheme still suffers from off-line password guessing attack and impersonation attack and proposed an enhanced scheme. Later on, Zhang et al. [6] proposed an authentication scheme with anonymity for SIP based on Farash and Attari’s work. However, Lu et al. [7] found that Zhang et al.’s scheme cannot provide proper security, because it is insecure against insider attack. To cover the demerits of Zhang et al.’s scheme, Lu et al. advanced a new scheme and they demonstrate that their scheme is resistant to possible known attacks while having lower computation cost than other related schemes. In 2016, Chaudhry et al. [8] stated that Lu et al.’s scheme cannot withstand user and sever impersonation attacks, so they proposed their own enhanced scheme to correct these problems. However, Kumari et al. [9] suspected that the Chaudhry et al.’s scheme still has the disadvantages that appeared in Lu et al.’s. Meanwhile, Kumari et al. showed that Lu et al.’s [7] scheme cannot resist impersonation and identity guessing attacks.In 2014, a smart-card-based scheme was advanced by Zhang et al. [10] to overcome the weaknesses of previous schemes. When a legal user attempts to communicate with the server, he must use the smart card as another authentication factor in addition to the password to achieve authentication. Later, Irshad et al. [11] demonstrated that Zhang et al.’s scheme is vulnerable to denial of service (DOS) attack and impersonation attack and advanced an improved scheme while optimizing the cost in their protocol. However, Irshad et al.’s scheme was suspected of being unable to resist user impersonation attack by Arshad and Nikooghadam [12], and Arshad and Nikooghadam advanced a new scheme in their paper. Unfortunately, Lu et al. in [13] found that Arshad et al.’s scheme is still insecure against some attacks, such as key-compromise impersonation attack and trace attack. In order to correct the shortcomings of Arshad and Nikooghadam’s scheme, Lu et al. proposed a robust and efficient authentication scheme by using ECC and demonstrated that their scheme is resistant to possible known attacks. Recently, we find that Arshad and Nikooghadam’s [12] scheme cannot resist user impersonation attack. Meanwhile, we observe that Lu et al.’s [13] scheme is insecure against server impersonation attack.


## 2. Motivations and Contributions

In this paper, we revisit Arshad and Nikooghadam and Lu et al.’s schemes and show that their schemes are vulnerable to impersonation attack. Meanwhile, we propose our enhanced ECC-based scheme for SIP to make up for the shortcomings of Arshad et al.’s and Lu et al.’s schemes.The rest of the paper is organized as follows. Review and cryptanalysis of Arshad and Nikoofhadam’s scheme are showed in Sections3 and 4, separately. Review and cryptanalysis of Lu et al.’s scheme will be put in in Sections 5 and 6, separately. In Section 7, we present our scheme. Security analysis and performance analysis are showed in Sections 8 and 9, separately. Finally, conclusion of this paper is shown in Section 10.


## 3. Review of Arshad and Nikoofhadam’s Scheme

In this section, we will review Arshad and Nikoofhadam’s [12] scheme briefly. Firstly, we will list the notations that were used throughout Arshad et al.’s scheme in Figure 1. Then, we will use four parts to review Arshad et al.’s scheme, including setup phase, registration phase, authentication and key agreement phase, and password change phase.Figure 1
Notations of Arshad et al.’s scheme.


### 3.1. Setup

Firstly, the server selects an elliptic curve equationEpa,b and a secure one-way function h. Then, the server selects a base point P with order n over Epa,b, chooses a integer ks randomly and keeps it as a secret key, and computes public key Ks=ksP. Finally, the server publishes Epa,b,n,P,h,Ks.


### 3.2. Registration

(1)
The client generates a numberNc randomly, chooses a password PWi, computes vi=hIDi∥PWi∥Nc, sends IDi,vi to the server, and stores Nc in the memory device(2)
IfIDi does not exit in database, the server computes Vi=hIDi∥ks⊕vi and stores it in his/her database


### 3.3. Authentication and Key Agreement

In this part, we will introduce the authentication and key agreement phase of Arshad and Nikoofhadam’s scheme and the steps of this phase are also represented by Table1.
(1)
The client selects an integerdc randomly, computes Rc=dcKs=dcksP and sends REQUESTIDi,Rc to the server through the public channel(2)
IfIDi exits in database, the server selects a integer ds randomly, computes Qs=dsP, Qsc=dsks−1Rc, Vs=hIDiQsQsc, and sends CHALLENGErealm,Qs,Vs to the client. If IDi does not exit in database, the server terminates the session(3)
The client computesQcs=dcQs and compares the value of hIDi∥Qs∥Qcs and Vs. If hIDi∥Qs∥Qcs and Vs are not equal, the session will be stopped by the client. Otherwise, the client computes Vc=hIDi∥Qs∥realm∥Qcs∥vi and SK=hIDi∥Qs∥Qcs∥realm. Then, RESPONSEIDi∥realm∥Vc is sent to the server(4)
The server computesvi=Vi⊕hIDi∥ks and compares the value of hIDi∥Qs∥realm∥Qsc∥vi and Vc. If hIDi∥Qs∥realm∥Qsc∥vi is equal to Vc, the server authenticates the clientTable 1
Authentication and key agreement.
ClientServer


### 3.4. Password Change

(1)
Firstly, a new passwordPWi∗ is chosen by the client. Then, the client generates a new random number Nc∗, computes vi∗=hIDi∥PWi∗∥Nc∗, z=hIDi∥PWi∥Nc⊕vi∗, Z=z⊕hIDi∥SK, and sends CHANGEPWDIDi,Z,Vz to server(2)
The server computesvi=Vi⊕hIDi∥ks, vi∗=Z⊕vi⊕hIDi∥SK, and verify whether hIDi∥vi∗∥SK∥vi is equal to Vz or not. If they are equal, the server computes Vi∗=Vi⊕z and replaces Vi with Vi∗ in the database. Then, the server sends ACCEPThIDi∥vi∥accept∥vi∗∥SK to the client(3)
The client calculateshIDi∥vi∥accept∥vi∗∥SK and if it is equal to the ACCEPT, the client replaces Nc with Nc∗ in the memory device


## 3.1. Setup

Firstly, the server selects an elliptic curve equationEpa,b and a secure one-way function h. Then, the server selects a base point P with order n over Epa,b, chooses a integer ks randomly and keeps it as a secret key, and computes public key Ks=ksP. Finally, the server publishes Epa,b,n,P,h,Ks.


## 3.2. Registration

(1)
The client generates a numberNc randomly, chooses a password PWi, computes vi=hIDi∥PWi∥Nc, sends IDi,vi to the server, and stores Nc in the memory device(2)
IfIDi does not exit in database, the server computes Vi=hIDi∥ks⊕vi and stores it in his/her database


## 3.3. Authentication and Key Agreement

In this part, we will introduce the authentication and key agreement phase of Arshad and Nikoofhadam’s scheme and the steps of this phase are also represented by Table1.
(1)
The client selects an integerdc randomly, computes Rc=dcKs=dcksP and sends REQUESTIDi,Rc to the server through the public channel(2)
IfIDi exits in database, the server selects a integer ds randomly, computes Qs=dsP, Qsc=dsks−1Rc, Vs=hIDiQsQsc, and sends CHALLENGErealm,Qs,Vs to the client. If IDi does not exit in database, the server terminates the session(3)
The client computesQcs=dcQs and compares the value of hIDi∥Qs∥Qcs and Vs. If hIDi∥Qs∥Qcs and Vs are not equal, the session will be stopped by the client. Otherwise, the client computes Vc=hIDi∥Qs∥realm∥Qcs∥vi and SK=hIDi∥Qs∥Qcs∥realm. Then, RESPONSEIDi∥realm∥Vc is sent to the server(4)
The server computesvi=Vi⊕hIDi∥ks and compares the value of hIDi∥Qs∥realm∥Qsc∥vi and Vc. If hIDi∥Qs∥realm∥Qsc∥vi is equal to Vc, the server authenticates the clientTable 1
Authentication and key agreement.
ClientServer


## 3.4. Password Change

(1)
Firstly, a new passwordPWi∗ is chosen by the client. Then, the client generates a new random number Nc∗, computes vi∗=hIDi∥PWi∗∥Nc∗, z=hIDi∥PWi∥Nc⊕vi∗, Z=z⊕hIDi∥SK, and sends CHANGEPWDIDi,Z,Vz to server(2)
The server computesvi=Vi⊕hIDi∥ks, vi∗=Z⊕vi⊕hIDi∥SK, and verify whether hIDi∥vi∗∥SK∥vi is equal to Vz or not. If they are equal, the server computes Vi∗=Vi⊕z and replaces Vi with Vi∗ in the database. Then, the server sends ACCEPThIDi∥vi∥accept∥vi∗∥SK to the client(3)
The client calculateshIDi∥vi∥accept∥vi∗∥SK and if it is equal to the ACCEPT, the client replaces Nc with Nc∗ in the memory device


## 4. Cryptanalysis of Arshad and Nikoofhadam’s Scheme

In this part, we will prove that Arshad and Nikoofhadam’s scheme cannot withstand server impersonate attack. To do so, the adversaryA performs the following steps.Step 1.
SupposeA obtains REQUESTIDi,Rc when a client wants to communicate with the server. Then, A forges Qs′=Ks and Qsc′=Rc=dcKs, where Ks is the server’s public key. Then, A computes Vs′=hIDi∥Qs′∥Qsc∗ and sends CHALLENGErealm,Qs′,Vs′ to the client.Step 2.
After receivingCHALLENGE, the client computes Qcs=dcQs′. Since Qs′=Ks, Qcs=dc,Ks=Qsc′. Thus, hIDi∥Qs′∥Qcs=Vs and the verification will hold. The client authenticates the “server.” Then, the client computes vi=hIDi∥PWi∥Nc, Vc=hIDi∥Qs′∥realm∥Qcsvi and SK=hIDi∥Qs′∥Qcs∥realm. Finally, the client sends RESPONSEIDi∥Qs′∥Qcs∥realm to A.Step 3.
After receivingRESPONSEIDi∥Qs′∥Qcs∥realm, A does not need to compute vi and verify whether Vc=hIDi∥Qs′∥realm∥Qcsvi=Vc or not. A only need to computes SK=hIDi∥Qs′∥Qcs∥realm and then can make sure that he/she shares the same SK with the victim client.From what has been discussed above, we can come to the conclusion that Arshad and Nikoofhadam’s scheme cannot resist server impersonation attack.


## 5. Review of Lu et al.’s Scheme

In this part, Lu et al.’s [13] scheme will be reviewed. And the notations that were used throughout their scheme will be showed in Figure 2.Figure 2
Notations of Lu et al.’s scheme.


### 5.1. Registration

(1)
Ui chooses a password PWi, selects secret key kUi, generates a number r1 randomly, computes PWD=hPWi∥kUi and sends SIDi,r1,PWD(2)
S calculates VPW=hIDi∥PWD∥r1⊕hks and stores VPW in database


### 5.2. Authentication and Key Agreement

In this part, we will briefly introduce the authentication and key agreement phase of Lu et al.’s scheme and the steps of this phase are also represented by Table2.
(1)
Ui generates a number r2 randomly, then computes T=hIDi∥PWD∥r1, R=r2P, M1=Tr2P, AID=IDi⊕T, and M2=hIDi∥R. Finally, Ui sends SREQUESTM1,AID,M2(2)
S calculates T=VPW⊕hks, then computes IDi′=AID⊕T′, R′=T−1M1 and checks whether M2′=hIDi′∥R′ equals to M2 or not. If they are equal, S generates a number r3 randomly, computes H=r3P, M3=IDi⊕H, SKs=r3P, and Auths=hSKs∥T∥R and sends CHALLENGErealm,M3,Auths to Ui(3)
Ui computes H=M3⊕IDi, SKUi=r2H and verifies whether Auths′=hSKUi∥T∥R is equal to Auths. If they are equal, Ui computes AuthUi=hSKUi∥T∥H and then sends RESPONSErealm,AuthUi to S(4)
S checks whether AuthUi′=hSKs∥T∥H equals to AuthUi. If the equation holds, S and Ui share the session key SK=SKUi=SKsTable 2
Authentication and key agreement.
UiS


### 5.3. Password Change

(1)
Ui sends the message hhIDi∥r1∥hPWi∥r1∥SK and hIDi∥r1new∥hPWinew to S(2)
IfhhIDi∥r1∥hPWi∥r1∥SK is equal to the value of hhVPW⊕hks∥SK that S just calculated, S then computes VPWnew=SK⊕hIDi∥r1new∥hPWinew∥r1new⊕SK⊕hks and then replaces VPW with VPWnew


## 5.1. Registration

(1)
Ui chooses a password PWi, selects secret key kUi, generates a number r1 randomly, computes PWD=hPWi∥kUi and sends SIDi,r1,PWD(2)
S calculates VPW=hIDi∥PWD∥r1⊕hks and stores VPW in database


## 5.2. Authentication and Key Agreement

In this part, we will briefly introduce the authentication and key agreement phase of Lu et al.’s scheme and the steps of this phase are also represented by Table2.
(1)
Ui generates a number r2 randomly, then computes T=hIDi∥PWD∥r1, R=r2P, M1=Tr2P, AID=IDi⊕T, and M2=hIDi∥R. Finally, Ui sends SREQUESTM1,AID,M2(2)
S calculates T=VPW⊕hks, then computes IDi′=AID⊕T′, R′=T−1M1 and checks whether M2′=hIDi′∥R′ equals to M2 or not. If they are equal, S generates a number r3 randomly, computes H=r3P, M3=IDi⊕H, SKs=r3P, and Auths=hSKs∥T∥R and sends CHALLENGErealm,M3,Auths to Ui(3)
Ui computes H=M3⊕IDi, SKUi=r2H and verifies whether Auths′=hSKUi∥T∥R is equal to Auths. If they are equal, Ui computes AuthUi=hSKUi∥T∥H and then sends RESPONSErealm,AuthUi to S(4)
S checks whether AuthUi′=hSKs∥T∥H equals to AuthUi. If the equation holds, S and Ui share the session key SK=SKUi=SKsTable 2
Authentication and key agreement.
UiS


## 5.3. Password Change

(1)
Ui sends the message hhIDi∥r1∥hPWi∥r1∥SK and hIDi∥r1new∥hPWinew to S(2)
IfhhIDi∥r1∥hPWi∥r1∥SK is equal to the value of hhVPW⊕hks∥SK that S just calculated, S then computes VPWnew=SK⊕hIDi∥r1new∥hPWinew∥r1new⊕SK⊕hks and then replaces VPW with VPWnew


## 6. Cryptanalysis of Lu et al.’s Scheme

In this part, we will analyze the security of Lu et al.’s scheme and prove that their scheme cannot resist user impersonation attack. To do so, suppose an adversaryA obtains IDi of a legal user Ui and intercepts REQUESTM1,AID,M2 when Ui wants to send it to S. A can obtains T by computing T=AID⊕IDi, then masquerades as Ui to communicate with S by following steps.Step 1.
A generates a number r2∗ randomly, computes R∗=r2∗P, M1∗=T·r2∗P, AID=IDi⊕T, and M2∗=hR∗∥IDi. Then, A sends REQUESTM1∗,AID,M2∗ to S.Step 2.
S computes T=VPW⊕hks, IDi=AID⊕T, and R∗=T−1M1∗ and checks if hR∗∥IDi=?M2∗. Obviously, this equation is established. So S authenticates the attacker as Ui. Then, S generates r3 and computes H=r3P, M3=IDi⊕H, SKs∗=r3R∗, and Auths∗=hSKs∥T∥R∗ and sends CHALLENGErealm,M3,Auths∗ to A.Step 3.
A computes H=M3⊕IDi, SKUi∗=r2∗H, and checks whether hSKUi∗∥T∥R∗ equals to Auths∗. If they are equal, then A calculates AuthUi∗=hSKUi∗∥T∥H and sends RESPONSErealm,AuthUi∗ to S.Step 4.
S checks whether hSKs∗∥T∥H equals to AuthUi∗. Obviously, this equation is established. So the attacker A shares the same session key SK=AuthUi∗=Auths∗ with S.From what has been discussed above, we can come to the conclusion that Lu et al.’s scheme cannot resist user impersonation attack.


## 7. Our Proposed Scheme

An enhanced scheme for SIP will be advanced in this section. Our scheme is based on the schemes of Irshad et al and Lu et al. and has corrected the problem that appeared in their schemes. We will list the notations that used throughout our scheme in Figure3. The content of our scheme will be shown as follows:Figure 3
Notations of our scheme.


### 7.1. Setup Phase

Firstly, an elliptic curve equationEpa,b and a secure one-way function h are selected by the server. Then, S chooses a base point P with order n over Epa,b and two random numbers k1,k2, computes public key Kp=s2P. Finally, S keeps s1, s2 as its secret keys, publishes Epa,b,n,P,h,Kp.


### 7.2. Registration

The registration phase will be shown in Table3 and the steps for user registration are as follows:Step 1.
The userUi chooses number γ randomly, chooses a password PWi, computes vi=hhIDi⊕hPWi⊕hγ. Then, Ui sends IDi,vi to S through a secure channel.Step 2.
S calculates Vi=vi⊕hs2, Y=hvi∥s1s2−1P, and Vj=hIDi∥Vi∥s1. Then S stores Vi,Vj and sends Y to Ui through a secure channel.Step 3.
Ui keeps Y,γ in the memory device.Table 3
Steps of the registration phase.
UiS


### 7.3. Authentication and Key Agreement

When a legal userUi attempts to obtain a session key shared with S, the following steps will be performed. Meanwhile, the details of this phase will be shown in Table 4.Step 1.
The userUi selects a integer ru∈RZp∗ randomly, generates a time stamp t, and then computes vi=hhIDi⊕hPWi⊕hγ, Hj=hvi∥Y∥ruP∥t, and X=ruY=rus2−1hvi∥s1P. Finally, Ui computes PID=IDi⊕vi and sends REQUESTPID,X,Hj,t to S.Step 2.
S checks the validity of time stamp t by checking the validity of the predicate t′−t<?Δt, and abort if the check fails. Then, S computes IDi′=Vi⊕hs2⊕PID, Vj′=hIDi′∥Vi∥s1 and compares the values of Vj′ and the stored Vj. If they are equal, S can make sure that the received IDi and Vi is a pair. After that, S computes vi′=Vi⊕hs2, Y′=hvi′∥s1s2−1P, and Q=X·s2·h−1vi′∥s1=ruP and checks whether Hj′=hvi′∥Y′∥Q∥t equals to Hj or not. If they are equal, S authenticates the user Ui. Then, S chooses a integer rs∈RZp∗ randomly, computes Qsc=rsQ=rursP, SK=hIDi∥vi′∥Qsc∥realm, μ=rsP, and η=hSK∥Q∥realm∥vi′. Finally, S sends RESPONSEμ,realm,η to Ui.Step 3.
Ui computes Q′=ruP, Qsc′=ruμ=rursP, and SK=hIDi∥vi∥Qsc′∥realm and then checks whether η′=hSK∥Q′∥realm∥vi equals to received η. If they are equal, Ui authenticates S. Finally, Ui computes Auth=hSK∥μ∥vi and sends message ConfirmAuth,realm to S.Step 4.
S calculates Auth′=hSK∥rsP∥vi′ and compares the values Auth′ and the received Auth. S confirms that he/she shares the same session key SK with Ui if Auth′ is equal to Auth.Table 4
Authentication and key agreement.
UiS


### 7.4. Password Change

Step 1.
Ui chooses a figure γ∗ randomly, selects a new password PWi∗, then Ui computes vi∗=hhIDi⊕hPWi∗⊕hγ∗, I=Y⊕vi∗and sends ESKI∥vi∥IDi to S, where SK is the current session key and ESKm means the encryption of the message m with the symmetric key SK.Step 2.
Once receivingESKI∥vi∥IDi, S computes DSKI∥vi∥IDi, vi∗=I⊕Y, and then computes Y∗=hvi∗∥s1s2−1P, Vi∗=vi∗⊕hs2, and Vj∗=hIDi∥Vi∗∥s1. Finally, S replaces Vi,Vj with Vi∗,Vj∗ and sends ESKY⊕Y∗⊕vi∗ to Ui, where DSKc means the decryption of message c with SK.Step 3.
After receivingESKY⊕Y∗⊕vi∗, Ui computes DSKY⊕Y∗⊕vi∗ and Y∗=Y⊕Y∗⊕vi∗⊕Y⊕vi∗. Finally, Ui replaces Y with Y∗ in the memory device.


## 7.1. Setup Phase

Firstly, an elliptic curve equationEpa,b and a secure one-way function h are selected by the server. Then, S chooses a base point P with order n over Epa,b and two random numbers k1,k2, computes public key Kp=s2P. Finally, S keeps s1, s2 as its secret keys, publishes Epa,b,n,P,h,Kp.


## 7.2. Registration

The registration phase will be shown in Table3 and the steps for user registration are as follows:Step 1.
The userUi chooses number γ randomly, chooses a password PWi, computes vi=hhIDi⊕hPWi⊕hγ. Then, Ui sends IDi,vi to S through a secure channel.Step 2.
S calculates Vi=vi⊕hs2, Y=hvi∥s1s2−1P, and Vj=hIDi∥Vi∥s1. Then S stores Vi,Vj and sends Y to Ui through a secure channel.Step 3.
Ui keeps Y,γ in the memory device.Table 3
Steps of the registration phase.
UiS


## 7.3. Authentication and Key Agreement

When a legal userUi attempts to obtain a session key shared with S, the following steps will be performed. Meanwhile, the details of this phase will be shown in Table 4.Step 1.
The userUi selects a integer ru∈RZp∗ randomly, generates a time stamp t, and then computes vi=hhIDi⊕hPWi⊕hγ, Hj=hvi∥Y∥ruP∥t, and X=ruY=rus2−1hvi∥s1P. Finally, Ui computes PID=IDi⊕vi and sends REQUESTPID,X,Hj,t to S.Step 2.
S checks the validity of time stamp t by checking the validity of the predicate t′−t<?Δt, and abort if the check fails. Then, S computes IDi′=Vi⊕hs2⊕PID, Vj′=hIDi′∥Vi∥s1 and compares the values of Vj′ and the stored Vj. If they are equal, S can make sure that the received IDi and Vi is a pair. After that, S computes vi′=Vi⊕hs2, Y′=hvi′∥s1s2−1P, and Q=X·s2·h−1vi′∥s1=ruP and checks whether Hj′=hvi′∥Y′∥Q∥t equals to Hj or not. If they are equal, S authenticates the user Ui. Then, S chooses a integer rs∈RZp∗ randomly, computes Qsc=rsQ=rursP, SK=hIDi∥vi′∥Qsc∥realm, μ=rsP, and η=hSK∥Q∥realm∥vi′. Finally, S sends RESPONSEμ,realm,η to Ui.Step 3.
Ui computes Q′=ruP, Qsc′=ruμ=rursP, and SK=hIDi∥vi∥Qsc′∥realm and then checks whether η′=hSK∥Q′∥realm∥vi equals to received η. If they are equal, Ui authenticates S. Finally, Ui computes Auth=hSK∥μ∥vi and sends message ConfirmAuth,realm to S.Step 4.
S calculates Auth′=hSK∥rsP∥vi′ and compares the values Auth′ and the received Auth. S confirms that he/she shares the same session key SK with Ui if Auth′ is equal to Auth.Table 4
Authentication and key agreement.
UiS


## 7.4. Password Change

Step 1.
Ui chooses a figure γ∗ randomly, selects a new password PWi∗, then Ui computes vi∗=hhIDi⊕hPWi∗⊕hγ∗, I=Y⊕vi∗and sends ESKI∥vi∥IDi to S, where SK is the current session key and ESKm means the encryption of the message m with the symmetric key SK.Step 2.
Once receivingESKI∥vi∥IDi, S computes DSKI∥vi∥IDi, vi∗=I⊕Y, and then computes Y∗=hvi∗∥s1s2−1P, Vi∗=vi∗⊕hs2, and Vj∗=hIDi∥Vi∗∥s1. Finally, S replaces Vi,Vj with Vi∗,Vj∗ and sends ESKY⊕Y∗⊕vi∗ to Ui, where DSKc means the decryption of message c with SK.Step 3.
After receivingESKY⊕Y∗⊕vi∗, Ui computes DSKY⊕Y∗⊕vi∗ and Y∗=Y⊕Y∗⊕vi∗⊕Y⊕vi∗. Finally, Ui replaces Y with Y∗ in the memory device.


## 8. Security Analysis for our Proposed Scheme

In this part, we use Burrows-Abadi-Needham logic to prove the correctness of our proposed scheme at first. Then, we use informal security analysis to prove that our scheme is secure under various attacks.


### 8.1. Correctness Proof

In this section, we will briefly introduce the BAN logic and then prove the security of our proposed scheme by using BAN logic.


#### 8.1.1. Brief Introduction about BAN Logic

BAN logic is a belief-based logic proposed by Burrow, Abadi, and Needham, and this logic plays a significant role in analyzing authentication protocols. When applying BAN logic to protocol analysis, it is essential to idealize the message of the protocol into a formula that BAN logic can recognize. Then, according to the reasonable initialization hypothesis, and the logical reasoning rules are used to infer whether the protocol can reach the expected goal according to the idealized protocol and initialization protocol. Figure4 lists some of the logical symbols and inference rules for BAN logic.Figure 4
BAN logic notations.


#### 8.1.2. Verifying the Proposed Scheme with BAN Logic

(1)
Goals(g1) U∣≡S∣≡U↔SKS(g2) U∣≡U↔SKS(g3) S∣≡U∣≡U↔SKS(g4) S∣≡U↔SKS(2)
Idealized scheme(a)
Ui→S:ruU↔YS, <IDi>U↔viS, ruP,tU↔vi,YS, U↔SKS,rsPU↔viS(b)
S→Ui: U↔SKS,ruP,realmU↔viS(3)
Initiative premises(n1)U∣≡#γ(n2)U∣≡#ru(n3)S∣≡#rs(n4)U∣≡U↔viS(n5)S∣≡U↔viS(n6)U∣≡U↔YS(n7)S∣≡U↔YS(n8)U∣≡S∣⇒U↔SKS(n9)S∣≡U∣⇒U↔SKS(4)
Proof of the proposed scheme(p1) Fromn4,Ui⊲U↔SKS,ruP,realmU↔viS and by applying the message meaning rule, we deduce,
(1)U∣≡U↔viS,Ui⊲U↔SKS,ruP,realmU↔viSU∣≡S∣~U↔SKS,ruP,realm(p2) Fromn2 and by applying the fresh conjuncatenation rule, we deduce,
(2)U∣≡#ruU∣≡#U↔SKS,ruP,realm(p3) Fromp1, p2 and by applying the nonce-verification rule, we deduce,
(3)U∣≡#U↔SKS,ruP,realm,U∣≡S∣~U↔SKS,ruP,realmU∣≡S∣≡U↔SKS,ruP,realm(p4) From deductionp3 and by applying the belief rule, we deduce,
(4)U∣≡S∣≡U↔SKS,ruP,realmU∣≡S∣≡U↔SKSgoalg1(p5) Fromp4, n8 and by applying the jurusdiction rlue, we deduce,
(5)U∣≡S∣⇒U↔SKS,U∣≡S∣≡U↔SKSU∣≡U↔SKSgoalg2(p6) Fromn5, S⊲U↔SKS,rsPU↔viS and by applying the message meaning rule, we deduce,
(6)S∣≡U↔viS,S⊲U↔SKS,rsPU↔viSS∣≡U∣~U↔SKS,rsP(p7) Fromn3 and by applying the fresh conjuncatenation rule, we deduce,
(7)S∣≡#rsS∣≡#U↔SKS,rsP(p8) Fromp6, p7 and by applying the nonce-verification rule, we deduce,
(8)S∣≡#U↔SKS,rsP,S∣≡U∣~U↔SKS,rsPS∣≡U∣≡U↔SKS,rsP(p9) From deductionp8 and by applying the belief rule, we deduce,
(9)S∣≡U∣≡U↔SKS,rsPS∣≡U∣≡U↔SKSgoalg3(p10) Fromp9, n9 and by applying the jurusdiction rlue, we deduce,
(10)S∣≡U∣⇒U↔SKS,S∣≡U∣≡U↔SKSS∣≡U↔SKSgoalg4Therefore, our proposed scheme achieves mutual authentication and key agreement betweenS and Ui.


### 8.2. Informal Security Analysis

The security of our proposed scheme will be discussed in this section. We will prove our scheme is secure in the face of various attacks. We draw on the experience of [14] and define the capabilities of the attacker A as follows:(c1)A can off-line enumerate the Cartesian product Sid∗SPW, where Sid, SPW means the size of the identity space and password space, separately(c2)A has full control of the communication channel(c3)A may either learn the victim’s password via malicious card readers, or extract the secret data in the card by side-channel attacks, but cannot realize both(c4)A can learn the previous session key(s)(c5)A can learn the server’s long-time private key(s) as well as all other data stored in the server only when evaluating the eventual failure of the server


#### 8.2.1. Denning-Sacco Attack

In Denning-Sacco attack [15], when the client or server leaks the previous session key, then A tries to get other session keys or a long-term key (for example, the client’s password or the server’s key).SupposeA has gained a session key SK=hIDi∥vi∥Qsc∥realm. A cannot obtain use’s password PWi since PWi is hidden in a hash function vi=hhIDi⊕hPWi⊕hγ. Besides, it is impossible for A to obtain the other session keys as he/she does not know the values of rursP and vi.


#### 8.2.2. Man-in-the-Middle Attack (MITM)

In this attack,A intercepts communication channels between users and the server and attempts to make them believe that they are communicating with each other directly.In our proposed scheme, assumeA intercepts REQUESTPID,X,Hj,t and RESPONSEμ,realm,η. However, A does not know Y and vi so that he/she is not able to figure out the right PID,X and Hj. A will fail to cheat server as a legal user. At the same time, A is unaware of the server’s secret keys s2 and s1. So A cannot masquerade as a legal server since he/she cannot compute the right Q=ruP and Qsc=rursP.


#### 8.2.3. Off-Line Password Guessing Attack

Off-line password guessing attack meansA keeps previous authentication messages. Then, A selects a set of candidate passwords and uses stored messages to verify whether there is a appropriate password.In our proposed scheme,A can obtain PID, X, Hj, μ, realm, and η from the communicating channels between users and server. But A cannot compute the values of hSK∥ruP∥realm∥hhIDi⊕hPWi⊕hγ and hhhIDi⊕hPWi⊕hγ∥Y∥ruP∥t to verify the candidate password since A does not know the values of γ, ruP, rursP, s1, and s2.


#### 8.2.4. Replay Attack

In this attack, supposeA grabs REQUESTPID,X,Hj,t when a legal user Ui try to send REQUEST to server, then A replays it to server to impersonate Ui. However, on account of the attacker is unaware of vi and Y, the server can easily find out if the attacker modified the time stamp t. If A replay REQUEST to server without any changing, the server can figure out the message is invalid since the verification of t will not hold.


#### 8.2.5. Impersonation Attack

In this attack, the goal ofA is impersonating a legal server or a legal user. Suppose a legal user attempts to use what he/she has got to masquerade other users, and all IDs are available for him/her.That means one of the legal users is A now. Then, A can intercept REQUEST and compute vi=IDi⊕PID obviously. However, since s1 is unknown for the attacker and the hardness of ECDLP, A cannot compute the correct Y=hvi∥s1s2−1P. If A use his/her own vi′ and the victim user’s IDi to compute PID=IDi⊕vi′, then use his/her own Y′, vi′ to compute Hj=hvi′∥Y′∥ruP∥t and attempt to impersonate Ui. The verification Vj′=hIDi′∥Vi∥s1=?Vj will not hold since Vi is matched with vi and IDi when server computes Vj. Thus, our proposed scheme can withstand user impersonation attack.SupposeA tries to impersonate a legal server. Since the server’s secret key S1 and s2 are unknown for A, he/she cannot figure out the correct Q=Xs2h−1vi′∥s1=ruP. Thus, the verification η′=hSK∥Q′∥realm∥vi=η will fail on the user’s side.


#### 8.2.6. Privileged inside Attack

Suppose a privileged inside userA of the server obtains vi, IDi, and PWi of a legal user Ui, and then A tries to impersonate Ui to access server. Since Y is only stored in memory device which is kept by Ui and server’s secret key s1, s2 are kept by server, the attacker cannot get the right Y. Thus, the verification Hj′=hvi′∥Y′∥Q=?Hj will not hold if a privileged inside attacker want to masquerade the victim user.


#### 8.2.7. Known Session Key Attack

If a previous session keySK has been divulged, and A attempts to compute a new session key. The attacker will not make it since each session key is independent from others. Only if the attacker has the newest ru and rs could him/her have opportunity to compute the newest SK=IDi∥vi∥Qsc∥realm.


#### 8.2.8. Perfect Forward Secrecy

Perfect forward secrecy means thatA cannot obtain old session keys even if the secret key of server or the user’s password has leaked. In our scheme, SK=hIDi∥vi∥Qsc∥realm. And A cannot figure out previous session keys even if he gains user’s password PWi and server’s secret key s2 because ru and rs are unknown for A. Due to the hardness of ECDLP, it is hardly impossible for A to obtain rs from μ=rsP and ru from X=ruHi. Consequently, the proposed scheme achieves perfect forward secrecy.


#### 8.2.9. Anonymous and Untraceable

SupposeA intercepts REQUESTPID,X,Hj,t and RESPONSEμ,realm,η. Since vi is unknown for A, he/she cannot compute IDi=PID⊕vi. Thus, our proposed scheme is anonymous to third parties. Besides, since a legal user use a random number ru to compute X and Hj for each session, so A cannot trace who is communicating with S.


#### 8.2.10. Stolen Verifier Attack

SupposeA obtains Vi,Vj from server’s database and tries to impersonate a legal user. Since the server’s secret s2 is unavailable for A, A cannot figure out vi of a legal user as vi=Vi⊕hs2.


#### 8.2.11. Stolen Memory Device Attack

SupposeA had stolen the smart card of user and can extract the secret parameters from the smart card, then A tries to attack the user by using impersonation attack or off-line password guessing attack. Since the password is unknown for A, A will fail when he wants to impersonate the legal user. When A obtains previous PID from the communication channel and decides to use off-line password guessing attack to find user’s IDi,PWi pair. However, vi is computed as vi=hhIDi⊕hPWi⊕hγ, and A will be frustrated because there are Sid∗SPW≈240 candidates of IDi,PWi, where Sid=SPW=106 [16, 17] and Sid, SPW mean the size of the identity space and password space, separately.


## 8.1. Correctness Proof

In this section, we will briefly introduce the BAN logic and then prove the security of our proposed scheme by using BAN logic.


### 8.1.1. Brief Introduction about BAN Logic

BAN logic is a belief-based logic proposed by Burrow, Abadi, and Needham, and this logic plays a significant role in analyzing authentication protocols. When applying BAN logic to protocol analysis, it is essential to idealize the message of the protocol into a formula that BAN logic can recognize. Then, according to the reasonable initialization hypothesis, and the logical reasoning rules are used to infer whether the protocol can reach the expected goal according to the idealized protocol and initialization protocol. Figure4 lists some of the logical symbols and inference rules for BAN logic.Figure 4
BAN logic notations.


### 8.1.2. Verifying the Proposed Scheme with BAN Logic

(1)
Goals(g1) U∣≡S∣≡U↔SKS(g2) U∣≡U↔SKS(g3) S∣≡U∣≡U↔SKS(g4) S∣≡U↔SKS(2)
Idealized scheme(a)
Ui→S:ruU↔YS, <IDi>U↔viS, ruP,tU↔vi,YS, U↔SKS,rsPU↔viS(b)
S→Ui: U↔SKS,ruP,realmU↔viS(3)
Initiative premises(n1)U∣≡#γ(n2)U∣≡#ru(n3)S∣≡#rs(n4)U∣≡U↔viS(n5)S∣≡U↔viS(n6)U∣≡U↔YS(n7)S∣≡U↔YS(n8)U∣≡S∣⇒U↔SKS(n9)S∣≡U∣⇒U↔SKS(4)
Proof of the proposed scheme(p1) Fromn4,Ui⊲U↔SKS,ruP,realmU↔viS and by applying the message meaning rule, we deduce,
(1)U∣≡U↔viS,Ui⊲U↔SKS,ruP,realmU↔viSU∣≡S∣~U↔SKS,ruP,realm(p2) Fromn2 and by applying the fresh conjuncatenation rule, we deduce,
(2)U∣≡#ruU∣≡#U↔SKS,ruP,realm(p3) Fromp1, p2 and by applying the nonce-verification rule, we deduce,
(3)U∣≡#U↔SKS,ruP,realm,U∣≡S∣~U↔SKS,ruP,realmU∣≡S∣≡U↔SKS,ruP,realm(p4) From deductionp3 and by applying the belief rule, we deduce,
(4)U∣≡S∣≡U↔SKS,ruP,realmU∣≡S∣≡U↔SKSgoalg1(p5) Fromp4, n8 and by applying the jurusdiction rlue, we deduce,
(5)U∣≡S∣⇒U↔SKS,U∣≡S∣≡U↔SKSU∣≡U↔SKSgoalg2(p6) Fromn5, S⊲U↔SKS,rsPU↔viS and by applying the message meaning rule, we deduce,
(6)S∣≡U↔viS,S⊲U↔SKS,rsPU↔viSS∣≡U∣~U↔SKS,rsP(p7) Fromn3 and by applying the fresh conjuncatenation rule, we deduce,
(7)S∣≡#rsS∣≡#U↔SKS,rsP(p8) Fromp6, p7 and by applying the nonce-verification rule, we deduce,
(8)S∣≡#U↔SKS,rsP,S∣≡U∣~U↔SKS,rsPS∣≡U∣≡U↔SKS,rsP(p9) From deductionp8 and by applying the belief rule, we deduce,
(9)S∣≡U∣≡U↔SKS,rsPS∣≡U∣≡U↔SKSgoalg3(p10) Fromp9, n9 and by applying the jurusdiction rlue, we deduce,
(10)S∣≡U∣⇒U↔SKS,S∣≡U∣≡U↔SKSS∣≡U↔SKSgoalg4Therefore, our proposed scheme achieves mutual authentication and key agreement betweenS and Ui.


## 8.1.1. Brief Introduction about BAN Logic

BAN logic is a belief-based logic proposed by Burrow, Abadi, and Needham, and this logic plays a significant role in analyzing authentication protocols. When applying BAN logic to protocol analysis, it is essential to idealize the message of the protocol into a formula that BAN logic can recognize. Then, according to the reasonable initialization hypothesis, and the logical reasoning rules are used to infer whether the protocol can reach the expected goal according to the idealized protocol and initialization protocol. Figure4 lists some of the logical symbols and inference rules for BAN logic.Figure 4
BAN logic notations.


## 8.1.2. Verifying the Proposed Scheme with BAN Logic

(1)
Goals(g1) U∣≡S∣≡U↔SKS(g2) U∣≡U↔SKS(g3) S∣≡U∣≡U↔SKS(g4) S∣≡U↔SKS(2)
Idealized scheme(a)
Ui→S:ruU↔YS, <IDi>U↔viS, ruP,tU↔vi,YS, U↔SKS,rsPU↔viS(b)
S→Ui: U↔SKS,ruP,realmU↔viS(3)
Initiative premises(n1)U∣≡#γ(n2)U∣≡#ru(n3)S∣≡#rs(n4)U∣≡U↔viS(n5)S∣≡U↔viS(n6)U∣≡U↔YS(n7)S∣≡U↔YS(n8)U∣≡S∣⇒U↔SKS(n9)S∣≡U∣⇒U↔SKS(4)
Proof of the proposed scheme(p1) Fromn4,Ui⊲U↔SKS,ruP,realmU↔viS and by applying the message meaning rule, we deduce,
(1)U∣≡U↔viS,Ui⊲U↔SKS,ruP,realmU↔viSU∣≡S∣~U↔SKS,ruP,realm(p2) Fromn2 and by applying the fresh conjuncatenation rule, we deduce,
(2)U∣≡#ruU∣≡#U↔SKS,ruP,realm(p3) Fromp1, p2 and by applying the nonce-verification rule, we deduce,
(3)U∣≡#U↔SKS,ruP,realm,U∣≡S∣~U↔SKS,ruP,realmU∣≡S∣≡U↔SKS,ruP,realm(p4) From deductionp3 and by applying the belief rule, we deduce,
(4)U∣≡S∣≡U↔SKS,ruP,realmU∣≡S∣≡U↔SKSgoalg1(p5) Fromp4, n8 and by applying the jurusdiction rlue, we deduce,
(5)U∣≡S∣⇒U↔SKS,U∣≡S∣≡U↔SKSU∣≡U↔SKSgoalg2(p6) Fromn5, S⊲U↔SKS,rsPU↔viS and by applying the message meaning rule, we deduce,
(6)S∣≡U↔viS,S⊲U↔SKS,rsPU↔viSS∣≡U∣~U↔SKS,rsP(p7) Fromn3 and by applying the fresh conjuncatenation rule, we deduce,
(7)S∣≡#rsS∣≡#U↔SKS,rsP(p8) Fromp6, p7 and by applying the nonce-verification rule, we deduce,
(8)S∣≡#U↔SKS,rsP,S∣≡U∣~U↔SKS,rsPS∣≡U∣≡U↔SKS,rsP(p9) From deductionp8 and by applying the belief rule, we deduce,
(9)S∣≡U∣≡U↔SKS,rsPS∣≡U∣≡U↔SKSgoalg3(p10) Fromp9, n9 and by applying the jurusdiction rlue, we deduce,
(10)S∣≡U∣⇒U↔SKS,S∣≡U∣≡U↔SKSS∣≡U↔SKSgoalg4Therefore, our proposed scheme achieves mutual authentication and key agreement betweenS and Ui.


## 8.2. Informal Security Analysis

The security of our proposed scheme will be discussed in this section. We will prove our scheme is secure in the face of various attacks. We draw on the experience of [14] and define the capabilities of the attacker A as follows:(c1)A can off-line enumerate the Cartesian product Sid∗SPW, where Sid, SPW means the size of the identity space and password space, separately(c2)A has full control of the communication channel(c3)A may either learn the victim’s password via malicious card readers, or extract the secret data in the card by side-channel attacks, but cannot realize both(c4)A can learn the previous session key(s)(c5)A can learn the server’s long-time private key(s) as well as all other data stored in the server only when evaluating the eventual failure of the server


### 8.2.1. Denning-Sacco Attack

In Denning-Sacco attack [15], when the client or server leaks the previous session key, then A tries to get other session keys or a long-term key (for example, the client’s password or the server’s key).SupposeA has gained a session key SK=hIDi∥vi∥Qsc∥realm. A cannot obtain use’s password PWi since PWi is hidden in a hash function vi=hhIDi⊕hPWi⊕hγ. Besides, it is impossible for A to obtain the other session keys as he/she does not know the values of rursP and vi.


### 8.2.2. Man-in-the-Middle Attack (MITM)

In this attack,A intercepts communication channels between users and the server and attempts to make them believe that they are communicating with each other directly.In our proposed scheme, assumeA intercepts REQUESTPID,X,Hj,t and RESPONSEμ,realm,η. However, A does not know Y and vi so that he/she is not able to figure out the right PID,X and Hj. A will fail to cheat server as a legal user. At the same time, A is unaware of the server’s secret keys s2 and s1. So A cannot masquerade as a legal server since he/she cannot compute the right Q=ruP and Qsc=rursP.


### 8.2.3. Off-Line Password Guessing Attack

Off-line password guessing attack meansA keeps previous authentication messages. Then, A selects a set of candidate passwords and uses stored messages to verify whether there is a appropriate password.In our proposed scheme,A can obtain PID, X, Hj, μ, realm, and η from the communicating channels between users and server. But A cannot compute the values of hSK∥ruP∥realm∥hhIDi⊕hPWi⊕hγ and hhhIDi⊕hPWi⊕hγ∥Y∥ruP∥t to verify the candidate password since A does not know the values of γ, ruP, rursP, s1, and s2.


### 8.2.4. Replay Attack

In this attack, supposeA grabs REQUESTPID,X,Hj,t when a legal user Ui try to send REQUEST to server, then A replays it to server to impersonate Ui. However, on account of the attacker is unaware of vi and Y, the server can easily find out if the attacker modified the time stamp t. If A replay REQUEST to server without any changing, the server can figure out the message is invalid since the verification of t will not hold.


### 8.2.5. Impersonation Attack

In this attack, the goal ofA is impersonating a legal server or a legal user. Suppose a legal user attempts to use what he/she has got to masquerade other users, and all IDs are available for him/her.That means one of the legal users is A now. Then, A can intercept REQUEST and compute vi=IDi⊕PID obviously. However, since s1 is unknown for the attacker and the hardness of ECDLP, A cannot compute the correct Y=hvi∥s1s2−1P. If A use his/her own vi′ and the victim user’s IDi to compute PID=IDi⊕vi′, then use his/her own Y′, vi′ to compute Hj=hvi′∥Y′∥ruP∥t and attempt to impersonate Ui. The verification Vj′=hIDi′∥Vi∥s1=?Vj will not hold since Vi is matched with vi and IDi when server computes Vj. Thus, our proposed scheme can withstand user impersonation attack.SupposeA tries to impersonate a legal server. Since the server’s secret key S1 and s2 are unknown for A, he/she cannot figure out the correct Q=Xs2h−1vi′∥s1=ruP. Thus, the verification η′=hSK∥Q′∥realm∥vi=η will fail on the user’s side.


### 8.2.6. Privileged inside Attack

Suppose a privileged inside userA of the server obtains vi, IDi, and PWi of a legal user Ui, and then A tries to impersonate Ui to access server. Since Y is only stored in memory device which is kept by Ui and server’s secret key s1, s2 are kept by server, the attacker cannot get the right Y. Thus, the verification Hj′=hvi′∥Y′∥Q=?Hj will not hold if a privileged inside attacker want to masquerade the victim user.


### 8.2.7. Known Session Key Attack

If a previous session keySK has been divulged, and A attempts to compute a new session key. The attacker will not make it since each session key is independent from others. Only if the attacker has the newest ru and rs could him/her have opportunity to compute the newest SK=IDi∥vi∥Qsc∥realm.


### 8.2.8. Perfect Forward Secrecy

Perfect forward secrecy means thatA cannot obtain old session keys even if the secret key of server or the user’s password has leaked. In our scheme, SK=hIDi∥vi∥Qsc∥realm. And A cannot figure out previous session keys even if he gains user’s password PWi and server’s secret key s2 because ru and rs are unknown for A. Due to the hardness of ECDLP, it is hardly impossible for A to obtain rs from μ=rsP and ru from X=ruHi. Consequently, the proposed scheme achieves perfect forward secrecy.


### 8.2.9. Anonymous and Untraceable

SupposeA intercepts REQUESTPID,X,Hj,t and RESPONSEμ,realm,η. Since vi is unknown for A, he/she cannot compute IDi=PID⊕vi. Thus, our proposed scheme is anonymous to third parties. Besides, since a legal user use a random number ru to compute X and Hj for each session, so A cannot trace who is communicating with S.


### 8.2.10. Stolen Verifier Attack

SupposeA obtains Vi,Vj from server’s database and tries to impersonate a legal user. Since the server’s secret s2 is unavailable for A, A cannot figure out vi of a legal user as vi=Vi⊕hs2.


### 8.2.11. Stolen Memory Device Attack

SupposeA had stolen the smart card of user and can extract the secret parameters from the smart card, then A tries to attack the user by using impersonation attack or off-line password guessing attack. Since the password is unknown for A, A will fail when he wants to impersonate the legal user. When A obtains previous PID from the communication channel and decides to use off-line password guessing attack to find user’s IDi,PWi pair. However, vi is computed as vi=hhIDi⊕hPWi⊕hγ, and A will be frustrated because there are Sid∗SPW≈240 candidates of IDi,PWi, where Sid=SPW=106 [16, 17] and Sid, SPW mean the size of the identity space and password space, separately.


## 8.2.1. Denning-Sacco Attack

In Denning-Sacco attack [15], when the client or server leaks the previous session key, then A tries to get other session keys or a long-term key (for example, the client’s password or the server’s key).SupposeA has gained a session key SK=hIDi∥vi∥Qsc∥realm. A cannot obtain use’s password PWi since PWi is hidden in a hash function vi=hhIDi⊕hPWi⊕hγ. Besides, it is impossible for A to obtain the other session keys as he/she does not know the values of rursP and vi.


## 8.2.2. Man-in-the-Middle Attack (MITM)

In this attack,A intercepts communication channels between users and the server and attempts to make them believe that they are communicating with each other directly.In our proposed scheme, assumeA intercepts REQUESTPID,X,Hj,t and RESPONSEμ,realm,η. However, A does not know Y and vi so that he/she is not able to figure out the right PID,X and Hj. A will fail to cheat server as a legal user. At the same time, A is unaware of the server’s secret keys s2 and s1. So A cannot masquerade as a legal server since he/she cannot compute the right Q=ruP and Qsc=rursP.


## 8.2.3. Off-Line Password Guessing Attack

Off-line password guessing attack meansA keeps previous authentication messages. Then, A selects a set of candidate passwords and uses stored messages to verify whether there is a appropriate password.In our proposed scheme,A can obtain PID, X, Hj, μ, realm, and η from the communicating channels between users and server. But A cannot compute the values of hSK∥ruP∥realm∥hhIDi⊕hPWi⊕hγ and hhhIDi⊕hPWi⊕hγ∥Y∥ruP∥t to verify the candidate password since A does not know the values of γ, ruP, rursP, s1, and s2.


## 8.2.4. Replay Attack

In this attack, supposeA grabs REQUESTPID,X,Hj,t when a legal user Ui try to send REQUEST to server, then A replays it to server to impersonate Ui. However, on account of the attacker is unaware of vi and Y, the server can easily find out if the attacker modified the time stamp t. If A replay REQUEST to server without any changing, the server can figure out the message is invalid since the verification of t will not hold.


## 8.2.5. Impersonation Attack

In this attack, the goal ofA is impersonating a legal server or a legal user. Suppose a legal user attempts to use what he/she has got to masquerade other users, and all IDs are available for him/her.That means one of the legal users is A now. Then, A can intercept REQUEST and compute vi=IDi⊕PID obviously. However, since s1 is unknown for the attacker and the hardness of ECDLP, A cannot compute the correct Y=hvi∥s1s2−1P. If A use his/her own vi′ and the victim user’s IDi to compute PID=IDi⊕vi′, then use his/her own Y′, vi′ to compute Hj=hvi′∥Y′∥ruP∥t and attempt to impersonate Ui. The verification Vj′=hIDi′∥Vi∥s1=?Vj will not hold since Vi is matched with vi and IDi when server computes Vj. Thus, our proposed scheme can withstand user impersonation attack.SupposeA tries to impersonate a legal server. Since the server’s secret key S1 and s2 are unknown for A, he/she cannot figure out the correct Q=Xs2h−1vi′∥s1=ruP. Thus, the verification η′=hSK∥Q′∥realm∥vi=η will fail on the user’s side.


## 8.2.6. Privileged inside Attack

Suppose a privileged inside userA of the server obtains vi, IDi, and PWi of a legal user Ui, and then A tries to impersonate Ui to access server. Since Y is only stored in memory device which is kept by Ui and server’s secret key s1, s2 are kept by server, the attacker cannot get the right Y. Thus, the verification Hj′=hvi′∥Y′∥Q=?Hj will not hold if a privileged inside attacker want to masquerade the victim user.


## 8.2.7. Known Session Key Attack

If a previous session keySK has been divulged, and A attempts to compute a new session key. The attacker will not make it since each session key is independent from others. Only if the attacker has the newest ru and rs could him/her have opportunity to compute the newest SK=IDi∥vi∥Qsc∥realm.


## 8.2.8. Perfect Forward Secrecy

Perfect forward secrecy means thatA cannot obtain old session keys even if the secret key of server or the user’s password has leaked. In our scheme, SK=hIDi∥vi∥Qsc∥realm. And A cannot figure out previous session keys even if he gains user’s password PWi and server’s secret key s2 because ru and rs are unknown for A. Due to the hardness of ECDLP, it is hardly impossible for A to obtain rs from μ=rsP and ru from X=ruHi. Consequently, the proposed scheme achieves perfect forward secrecy.


## 8.2.9. Anonymous and Untraceable

SupposeA intercepts REQUESTPID,X,Hj,t and RESPONSEμ,realm,η. Since vi is unknown for A, he/she cannot compute IDi=PID⊕vi. Thus, our proposed scheme is anonymous to third parties. Besides, since a legal user use a random number ru to compute X and Hj for each session, so A cannot trace who is communicating with S.


## 8.2.10. Stolen Verifier Attack

SupposeA obtains Vi,Vj from server’s database and tries to impersonate a legal user. Since the server’s secret s2 is unavailable for A, A cannot figure out vi of a legal user as vi=Vi⊕hs2.


## 8.2.11. Stolen Memory Device Attack

SupposeA had stolen the smart card of user and can extract the secret parameters from the smart card, then A tries to attack the user by using impersonation attack or off-line password guessing attack. Since the password is unknown for A, A will fail when he wants to impersonate the legal user. When A obtains previous PID from the communication channel and decides to use off-line password guessing attack to find user’s IDi,PWi pair. However, vi is computed as vi=hhIDi⊕hPWi⊕hγ, and A will be frustrated because there are Sid∗SPW≈240 candidates of IDi,PWi, where Sid=SPW=106 [16, 17] and Sid, SPW mean the size of the identity space and password space, separately.


## 9. Performance Analysis

The performance comparison of our scheme and other related schemes [10–13] will be presented in this section.In Table5, we compute the total computational costs of three phases (registration phase, authentication and key agreement phase and password change phase) of our scheme and make a comparison with other schemes. In order to represent each computation cost of time, we define some notations in Figure 5.Table 5
Comparison of computational cost.
SchemesTotal comparison of computational costTime (ms)Our scheme9TEPM+21TH+3TINV+4TR22.2551 msZhang et al.’s scheme [10]10TEPM+19TH+2TINV+2TEAM+5TR25.0675 msIrshad et al.’s scheme [11]9TEPM+19TH+2TINV+5TR22.7839 msArshad et al.’s scheme [12]4TEPM+20TH+1TINV+4TR11.1116 msLu et al.’s scheme [13]6TEPM+14TH+5TR16.0832 msFigure 5
Notations for computation cost of times.According to [18, 19], an elliptic curve point multiplication operation takes 2.226 ms, an elliptic curve point addition operation costs 0.0288 ms, a one-way hash function takes 0.0023 ms, a modular inversion operation takes 0.0056 ms, and generating a random number needs 0.539 ms.Figure6 shows the comparison of security attributes between our scheme and other schemes. We can notice that our scheme is resistant to various attacks. On the contrary, Zhang et al. [10] and Irshad et al.’s [11] schemes cannot withstand impersonation attack and are not anonymous and untraceable, and Arshad et al.’s [12] scheme fails to achieve anonymity and untraceability and cannot stand up to impersonation attack. Meanwhile, Lu et al.’s [13] scheme cannot resist impersonation attack. So our scheme’s computational cost is lower than Irshad et al. and Zhang et al.’s schemes while providing better security. Despite having a little more computational cost, our scheme performance better in security attributes than Arshad et al. and Lu et al.’s schemes. From what we have discussed above, we can draw a conclusion that our proposed scheme is efficient and can withstand virous known attacks.Figure 6
Comparison of security attributes.


## 10. Conclusion

In this paper, we have demonstrated that Arshad et al.’s scheme cannot withstand user impersonation attack and Lu et al.’s scheme is not secure against server impersonation attack. In order to remedy the weaknesses of their schemes, we present an enhanced anonymous and efficient ECC-based authentication scheme for SIP. Our scheme inherits the merits of Arshad and Nikooghadam and Lu et al.’s schemes while standing up to user and server impersonation attacks that their schemes failed to satisfy. We use BAN logic and informal analysis to demonstrate the correctness and security of our scheme. Therefore, our proposed scheme is suitable and practical for SIP.



---

*Source: 8886585-2020-11-21.xml*