# Efficient and Secure Biometric-Based User Authenticated Key Agreement Scheme with Anonymity

Authors: Dongwoo Kang; Jaewook Jung; Hyoungshick Kim; Youngsook Lee; Dongho Won
Journal: Security and Communication Networks
 (2018)

---

## Abstract

At present, a number of users employ an authentication protocol so as to enjoy protected electronic transactions in wireless networks. In order to establish an efficient and robust the transaction system, numerous researches have been conducted relating to authentication protocols. Recently, Kaul and Awasthi presented an user authentication and key agreement scheme, arguing that their scheme is able to resist various types of attacks and preserve diverse security properties. However, this scheme possesses critical vulnerabilities. First, the scheme cannot prevent two kinds of attacks, including off-line password guessing attacks and user impersonation attacks. Second, user anonymity rule cannot be upheld. Third, session key can be compromised by an attacker. Fourth, there is high possibility that the time synchronization trouble occurs. Therefore, we suggest an upgraded version of the user authenticated key agreement method that provides enhanced security. Our security and performance analysis shows that compared, to other associated protocols, our method not only improves the security level but also ensures efficiency.


---

## Body

## 1. Introduction

The rapid evolution of mobile devices and the development of Information and Communication Technology (ICT) are providing convenience to our lives. This development has particularly affected the computer science environment, which has adhered to not only conventional but also inefficient ways. While the users enjoy simplicity and efficiency in their transaction systems, the issue of security has emerged as a major interest in both academic and industrial fields. In order to guarantee reliability among the communication parties, authentication protocol supports security when users access to foreign network.Lamport [1] first proposed an authentication mechanism and, since then, many related studies have been carried out [2–5] to enhance efficiency and security. In 2004, Das et al. [6] presented an authentication mechanism using dynamic identity technique in order to avoid exposure of user’s identity. However, Wang et al. [7] claimed that their mechanism [6] cannot guarantee mutual authentication and fails to secure against server spoofing attack, and they then presented a new version. In 2010, Khan et al. [8] proved that Wang et al.’s version [7] is imperfect because their scheme leads to anonymity problem and server internal attack. Khan et al. [8] also presented an upgraded authentication method so as to treat Wang et al.’s deficiency. However, An [9] and Chou et al. [10] then separately pointed out that Khan et al.’s method [8] has an anonymity problem and unsteady under the various attacks such as off-line password guessing attack and forgery attack, with each proposing an improved new scheme. In Chou et al.’s research [10], they did not only demonstrate the deficiencies of Khan et al.’s method [8] but also criticized Song’s scheme [11] that it cannot guarantee to protect off-line password guessing attack. In 2013, Chang et al. [12] corrected Wang et al.’s [7] flaw to expose private data including user’s identity in the process of messages transmitted and suggested enhanced mechanism. However, Kumari et al. [13] claimed that Chang et al.’s mechanism [12] cannot guarantee protecting against off-line password guessing attack, user disguise attack, and server masquerading attack, and their scheme also cannot keep user’s identity and mutual authentication property. Like their predecessor, this was also followed by Kumari et al.’s [13] proposal for enhanced authentication technique.Recently, Kaul and Awasthi [14] proved that Kumari et al.’s proposal [13] fails to protect important security parameters and session key shared between communication parties. With compensating these defections, they presented their own authentication method [14], claiming it can resist different types of attacks. However, we discovered that they compromise several security flaws. Their scheme (i) cannot withstand off-line password guessing attack and user impersonation attacks, (ii) is unable to support user anonymity, (iii) cannot achieve session key security, and (iv) encounters time synchronization trouble. In this research, we explain how the previously stated attacks operate and present a more developed version.The remainder of this paper is arranged as follows: Section2 introduces preliminary knowledges. Kaul and Awasthi’s authentication mechanism is described in Section 3. Section 4 demonstrates that vulnerabilities of Kaul and Awasthi’s mechanism. Our proposed method with detailed explanation is provided in Section 5. Sections 6 and 7 deal with informal security analysis and formal security analysis, respectively. In Section 8, we analyze the performance of the proposed scheme and, lastly, Section 9 contains the conclusion to this paper.


## 2. Preliminary Knowledge

In this section, we will describe basic knowledge in terms of threat model and introduce bio-hash function [15], which is used in our proposed scheme.


### 2.1. Threat Model

This subsection describes the threat model. Based on previous researches [5–14, 16–19], we constructed several common assumptions, including the capabilities of an attacker.(1)
All existing smart cards have vulnerabilities because confidential information stored within them can be extracted by physically monitoring the power consumption [20], meaning that an attacker can read and acquire data stored on the smart card.(2)
An attacker can control the public channels between the user and the server, meaning that the attacker can intercept any messages that are transmitted via the public channel [16–18].(3)
An attacker can modify and resend the intercepted/eavesdropped message [16].


### 2.2. Biohashing

A user’s biometric data is very sensitive information. Thus, when user identification is employed using biometric data, secure and accurate matching is needed. To address this concern, Jin et al. [15] suggested fingerprint-based function to identify user’s legitimacy in 2004. According to prior research [15], bio-hash technique employs particular tokenized pseudo-random numbers to each of users measuring biometric feature arbitrarily onto twofold strands. Bio-hash function H(·) is a one-way function with a feature that the probability of denial of service can be reduced. To date, many authentication studies have been carried out [19, 21–23] based on the bio-hash technique. In order to improve security, our proposed scheme also adopts user’s biometric information applied bio-hash function, and the details are as follows in Section 5.


## 2.1. Threat Model

This subsection describes the threat model. Based on previous researches [5–14, 16–19], we constructed several common assumptions, including the capabilities of an attacker.(1)
All existing smart cards have vulnerabilities because confidential information stored within them can be extracted by physically monitoring the power consumption [20], meaning that an attacker can read and acquire data stored on the smart card.(2)
An attacker can control the public channels between the user and the server, meaning that the attacker can intercept any messages that are transmitted via the public channel [16–18].(3)
An attacker can modify and resend the intercepted/eavesdropped message [16].


## 2.2. Biohashing

A user’s biometric data is very sensitive information. Thus, when user identification is employed using biometric data, secure and accurate matching is needed. To address this concern, Jin et al. [15] suggested fingerprint-based function to identify user’s legitimacy in 2004. According to prior research [15], bio-hash technique employs particular tokenized pseudo-random numbers to each of users measuring biometric feature arbitrarily onto twofold strands. Bio-hash function H(·) is a one-way function with a feature that the probability of denial of service can be reduced. To date, many authentication studies have been carried out [19, 21–23] based on the bio-hash technique. In order to improve security, our proposed scheme also adopts user’s biometric information applied bio-hash function, and the details are as follows in Section 5.


## 3. Review of the Kaul and Awasthi’s Scheme

In this section, we briefly review the Kaul and Awasthi’s scheme [14] to examine the cryptanalysis on their scheme. It consists of the following phases: registration, login, authentication, and password change. Figure 1 describes the Kaul and Awasthi’s scheme, and Table 1 displays the notations employed in the remainder of this paper.Table 1
Notations.
Notations Description Ui The user S The server IDi Identity ofUi PWi Password ofUi Bi Biometric information ofUi x Secret key ofS y Secret number generated byS yi Random number ofith Ui generated by S r 1, r2 Random number generated byUi T, Ts Time-stamp values h(⋅) One-way hash function H(⋅) Bio-hash function X||Y Concatenate operation ⊕ XOR operationFigure 1
Kaul and Awasthi’s scheme.


### 3.1. Registration Phase

(1)
U i inputs IDi and PWi and then Ui generates a random number b that is only kept to user Ui. Ui computes RPWi=h(PWi∥b) and sends a registration request IDi,RPWi to S through a secure channel. (2)
S generates a random number yi and computes αi=h((IDi⊕x)∥y), βi=αi⊕h(IDi⊕RPWi), γi=yi⊕h(αi⊕RPWi) and χi=h(IDi∥RPWi∥yi∥αi). (3)
S then issues a smart card with the parameters {βi,h(·),γi,χi} and sends it to Ui through a secure channel. (4)
Upon receiving the smart card,Ui computes ηi=b⊕h(IDi⊕PWi) and enters the ηi in its memory, and, finally, the smart card includes the information {βi,h(·),γi,χi,ηi}.


### 3.2. Login Phase

(1)
U i inserts Ui’s smart card into a card reader and inputs his/her IDi∗ and PWi∗. (2)
Smart card computesb=ηi⊕h(IDi∗⊕PWi∗), RPWi∗=h(PWi∗∥b), αi∗=βi⊕h(IDi∗⊕RPWi∗), yi∗=γi⊕h(αi∗⊕RPWi∗) and χi∗=h(IDi∗∥RPWi∗∥yi∗∥αi∗). The smart card then compares χi∗ with χi. If this condition is satisfied, the smart card acknowledges the legitimacy of Ui and proceeds with the next step. If not, this phase is terminated. (3)
Smart card computesωi=yi⊕h(IDi⊕αi)⊕h(IDi⊕αi⊕T) and ϑi=h(IDi∥αi∥yi∥(αi⊕yi)∥T). (4)
Finally,Ui sends the login request ωi,ϑi,IDi,T to S through a public network.


### 3.3. Authentication Phase

(1)
S verifies the time-stamp T through (T′-T)≤ΔT. If it holds, S proceeds with the next step. Otherwise, this phase is terminated. (2)
S computes αi∗=h((IDi∗⊕x)∥y), yi∗=ωi∗⊕h(IDi∗⊕αi∗)⊕h(IDi∗⊕αi∗⊕T) and ϑi∗=h(IDi∗αi∗yi∗(αi∗⊕yi∗)T). S then verifies whether ϑi∗=ϑi. If this comparison is satisfied, S accepts the login request and proceeds with the next step. Otherwise, S rejects the login request and this phase is terminated. (3)
S computes μi=h(IDi∥yi∥(αi⊕yi)∥Ts) and sends an authentication request μi,Ts to Ui through a public network. (4)
U i verifies the time-stamp Ts through (Ts′-Ts)≤ΔT. If it holds, Ui proceeds with the next step. Otherwise, this phase is terminated. (5)
U i computes μi∗=h(IDi∥yi∥(αi⊕yi)∥Ts) and verifies whether μi∗=μi. If this comparison is satisfied, Ui accepts the authentication request and proceeds with the next step. Otherwise, Ui rejects the authentication request and this phase is terminated. (6)
Finally,Ui computes a shared session key SK=h(IDi⊕αi⊕yi⊕T⊕Ts) and S also computes the same session key SK successfully.


### 3.4. Password Change Phase

(1)
U i inserts Ui’s smart card into a card reader and inputs IDi∗, old password PWi∗, and new password PWinew. The smart card computes b=ηi⊕h(IDi∗⊕PWi∗) and RPWi∗=h(PWi∗∥b). (2)
Smart card further computesαi∗=βi⊕h(IDi∗⊕RPWi∗), yi∗=γi⊕h(αi∗⊕RPWi∗) and χi∗=h(IDi∗∥RPWi∗∥yi∗∥αi∗). Smart card then verifies whether χi∗=χi. If this comparison is satisfied, smart card proceeds with the next step. Otherwise, this phase is terminated. (3)
Using the new passwordPWinew, smart card computes RPWinew=h(PWinew∥b), βinew=αi⊕h(IDi⊕RPWinew), γinew=yi⊕h(αi⊕RPWinew), χinew=h(IDi∥RPWinew∥yi∥αi) and ηinew=b⊕h(IDi⊕PWinew). (4)
Smart card replaces{βi,γi,χi,ηi} with the new parameters {βinew,γinew,χinew,ηinew}. Consequently, the smart card contains the information {βinew,h(·),γinew,χinew,ηinew}.


## 3.1. Registration Phase

(1)
U i inputs IDi and PWi and then Ui generates a random number b that is only kept to user Ui. Ui computes RPWi=h(PWi∥b) and sends a registration request IDi,RPWi to S through a secure channel. (2)
S generates a random number yi and computes αi=h((IDi⊕x)∥y), βi=αi⊕h(IDi⊕RPWi), γi=yi⊕h(αi⊕RPWi) and χi=h(IDi∥RPWi∥yi∥αi). (3)
S then issues a smart card with the parameters {βi,h(·),γi,χi} and sends it to Ui through a secure channel. (4)
Upon receiving the smart card,Ui computes ηi=b⊕h(IDi⊕PWi) and enters the ηi in its memory, and, finally, the smart card includes the information {βi,h(·),γi,χi,ηi}.


## 3.2. Login Phase

(1)
U i inserts Ui’s smart card into a card reader and inputs his/her IDi∗ and PWi∗. (2)
Smart card computesb=ηi⊕h(IDi∗⊕PWi∗), RPWi∗=h(PWi∗∥b), αi∗=βi⊕h(IDi∗⊕RPWi∗), yi∗=γi⊕h(αi∗⊕RPWi∗) and χi∗=h(IDi∗∥RPWi∗∥yi∗∥αi∗). The smart card then compares χi∗ with χi. If this condition is satisfied, the smart card acknowledges the legitimacy of Ui and proceeds with the next step. If not, this phase is terminated. (3)
Smart card computesωi=yi⊕h(IDi⊕αi)⊕h(IDi⊕αi⊕T) and ϑi=h(IDi∥αi∥yi∥(αi⊕yi)∥T). (4)
Finally,Ui sends the login request ωi,ϑi,IDi,T to S through a public network.


## 3.3. Authentication Phase

(1)
S verifies the time-stamp T through (T′-T)≤ΔT. If it holds, S proceeds with the next step. Otherwise, this phase is terminated. (2)
S computes αi∗=h((IDi∗⊕x)∥y), yi∗=ωi∗⊕h(IDi∗⊕αi∗)⊕h(IDi∗⊕αi∗⊕T) and ϑi∗=h(IDi∗αi∗yi∗(αi∗⊕yi∗)T). S then verifies whether ϑi∗=ϑi. If this comparison is satisfied, S accepts the login request and proceeds with the next step. Otherwise, S rejects the login request and this phase is terminated. (3)
S computes μi=h(IDi∥yi∥(αi⊕yi)∥Ts) and sends an authentication request μi,Ts to Ui through a public network. (4)
U i verifies the time-stamp Ts through (Ts′-Ts)≤ΔT. If it holds, Ui proceeds with the next step. Otherwise, this phase is terminated. (5)
U i computes μi∗=h(IDi∥yi∥(αi⊕yi)∥Ts) and verifies whether μi∗=μi. If this comparison is satisfied, Ui accepts the authentication request and proceeds with the next step. Otherwise, Ui rejects the authentication request and this phase is terminated. (6)
Finally,Ui computes a shared session key SK=h(IDi⊕αi⊕yi⊕T⊕Ts) and S also computes the same session key SK successfully.


## 3.4. Password Change Phase

(1)
U i inserts Ui’s smart card into a card reader and inputs IDi∗, old password PWi∗, and new password PWinew. The smart card computes b=ηi⊕h(IDi∗⊕PWi∗) and RPWi∗=h(PWi∗∥b). (2)
Smart card further computesαi∗=βi⊕h(IDi∗⊕RPWi∗), yi∗=γi⊕h(αi∗⊕RPWi∗) and χi∗=h(IDi∗∥RPWi∗∥yi∗∥αi∗). Smart card then verifies whether χi∗=χi. If this comparison is satisfied, smart card proceeds with the next step. Otherwise, this phase is terminated. (3)
Using the new passwordPWinew, smart card computes RPWinew=h(PWinew∥b), βinew=αi⊕h(IDi⊕RPWinew), γinew=yi⊕h(αi⊕RPWinew), χinew=h(IDi∥RPWinew∥yi∥αi) and ηinew=b⊕h(IDi⊕PWinew). (4)
Smart card replaces{βi,γi,χi,ηi} with the new parameters {βinew,γinew,χinew,ηinew}. Consequently, the smart card contains the information {βinew,h(·),γinew,χinew,ηinew}.


## 4. Security Weaknesses of the Kaul and Awasthi’s Scheme

In this section, we show that Kaul and Awasthi’s scheme [14] possesses some security vulnerabilities. Based on the threat model as mentioned in Section 2.1, the following problems have been found and their detailed descriptions are given as follows.


### 4.1. Lack of User’s Anonymity

In modern networks environments, user’s sensitive information leakage such as identity or password can expedite an outside attacker to identify every specific user. In this case, user’s privacy data is at risk of being exposed to a untrusted third party that disobey his/her will. Therefore, user anonymity is must be taken seriously as a satisfied property for user authentication scheme. However, in Kaul and Awasthi’s scheme [14], an attacker can easily acquire the user’s identity IDi through monitoring the public channels [16–18] because a user’s identity IDi is transmitted in a plain text without any encryption during the login phase. Attacker also can abuse acquired user’s identity to launch various types of attacks, leading to many malicious scenarios. For this reason, user anonymity cannot be preserved in Kaul and Awasthi’s authentication scheme.


### 4.2. Off-Line Password Guessing Attack

This attack is the attempted identification of a password until the correct password is found due to the tendency of many users to create simple, brief passwords for the sake of convenience. For this reason, authentication schemes for all password-based users should be designed to prevent a guessing attack; however, Kaul and Awasthi’s scheme has a weakness in this situation, and we therefore propose a scenario for an off-line password guessing attack. The following is a detailed description.Step 1.
After an attacker has stolen a smart card, the attacker can extract{βi,h(·),γi,χi,ηi} from the user’s smart card.Step 2.
The attacker can use an eavesdropped login requestωi,ϑi,IDi,T from the public channel.Step 3.
The attacker selects a password candidatePWi∗ and computes RPWi∗=h(PWi∗∥b)=h(PWi∗∥ηi⊕h(IDi⊕PWi∗)).Step 4.
The attacker computes the following:(1)χi∗=hIDi∥RPWi∗∥yi∥αi=hIDi∥RPWi∗∥γi⊕hαi⊕RPWi∗∥αi=hIDi∥RPWi∗∥γi⊕hβi⊕hIDi⊕RPWi∗⊕RPWi∗∥βi⊕hIDi⊕RPWi∗=hIDi∥hPWi∗∥ηi⊕hIDi⊕PWi∗∥γi⊕hβi⊕hIDi⊕hPWi∗∥ηi⊕hIDi⊕PWi∗⊕hPWi∗∥ηi⊕hIDi⊕PWi∗∥βi⊕hIDi⊕hPWi∗∥ηi⊕hIDi⊕PWi∗Step 5.
The attacker iterates the comparison process until the computed resultχi∗ equals the extracted value χi.Step 6.
If they corresponded with each other,PWi∗ would be an accurate password.Through the above description, we demonstrate that Kaul and Awasthi’s scheme [14] does not guarantee to protect off-line password guessing attack.


### 4.3. User Impersonation Attack

Generally speaking, many password-based authentication schemes’ security is based on knowledge of the password; therefore, if an attacker acquires an user’s password, the attacker can impersonate a legitimate user. Unfortunately, Kaul and Awasthi’s scheme has a weakness under this case. After obtaining the user’s passwordPWi, as described in Section 4.2, an attacker can successfully impersonate a legitimate user by performing the following steps.Step 1.
Attacker extracts{βi,h(·),γi,χi,ηi} after stolen smart card.Step 2.
The attacker getsIDi and T in the eavesdropped request ωi,ϑi,IDi,T.Step 3.
The attacker computesb,RPWi,αi,yi using obtained IDi,PWi,T and further computes ωi,ϑi.Step 4.
The attacker constructs login requestωi,ϑi,IDi,T and sends it to S.Step 5.
Upon getting the login request,S checks whether T and ϑi are normal values or not.Step 6.
If the above checking process is done,S assures that the received login request is a legal message.In Step 6, it is obvious thatS can successfully verify ϑi, since the values in attacker’s login request are exactly equal to user’s login request. Therefore, the attacker can successfully disguise a legitimate user in Kaul and Awasthi’s scheme [14].


### 4.4. Session Key Compromise

In Kaul and Awasthi’s scheme, if an attacker successfully guessesUi’s password by off-line password guessing attack, the attacker can construct the session key SK shared between user and server. First, the attacker can acquire IDi,T and Ts after eavesdropping the login and authentication request. Then, the attacker can compute αi and yi using obtained PWi, which is previously compromised value through the Section 4.2. With combined these values, attacker can successfully establish SK=h(IDi⊕αi⊕yi⊕T⊕Ts).


### 4.5. Time Synchronize Problem

It is time-stamp method that a hitherto commonly used method against replay attack. Kaul and Awasthi also mentioned a time-stamp method to prevent replay attack. However, this method may cause time synchronization problem between servers and users, since the current network system is large-scale wireless network composed of multitudinous users employing various devices contrary to past small scale network environment. Besides, it is inefficient to synchronize all system in real time. Nonce-based method applying random number is recommended instead of time-stamp method to settle synchronization problem [24]. Kaul and Awasthi’s scheme is required to switch to nonce-based method to resolve time synchronization problem.


## 4.1. Lack of User’s Anonymity

In modern networks environments, user’s sensitive information leakage such as identity or password can expedite an outside attacker to identify every specific user. In this case, user’s privacy data is at risk of being exposed to a untrusted third party that disobey his/her will. Therefore, user anonymity is must be taken seriously as a satisfied property for user authentication scheme. However, in Kaul and Awasthi’s scheme [14], an attacker can easily acquire the user’s identity IDi through monitoring the public channels [16–18] because a user’s identity IDi is transmitted in a plain text without any encryption during the login phase. Attacker also can abuse acquired user’s identity to launch various types of attacks, leading to many malicious scenarios. For this reason, user anonymity cannot be preserved in Kaul and Awasthi’s authentication scheme.


## 4.2. Off-Line Password Guessing Attack

This attack is the attempted identification of a password until the correct password is found due to the tendency of many users to create simple, brief passwords for the sake of convenience. For this reason, authentication schemes for all password-based users should be designed to prevent a guessing attack; however, Kaul and Awasthi’s scheme has a weakness in this situation, and we therefore propose a scenario for an off-line password guessing attack. The following is a detailed description.Step 1.
After an attacker has stolen a smart card, the attacker can extract{βi,h(·),γi,χi,ηi} from the user’s smart card.Step 2.
The attacker can use an eavesdropped login requestωi,ϑi,IDi,T from the public channel.Step 3.
The attacker selects a password candidatePWi∗ and computes RPWi∗=h(PWi∗∥b)=h(PWi∗∥ηi⊕h(IDi⊕PWi∗)).Step 4.
The attacker computes the following:(1)χi∗=hIDi∥RPWi∗∥yi∥αi=hIDi∥RPWi∗∥γi⊕hαi⊕RPWi∗∥αi=hIDi∥RPWi∗∥γi⊕hβi⊕hIDi⊕RPWi∗⊕RPWi∗∥βi⊕hIDi⊕RPWi∗=hIDi∥hPWi∗∥ηi⊕hIDi⊕PWi∗∥γi⊕hβi⊕hIDi⊕hPWi∗∥ηi⊕hIDi⊕PWi∗⊕hPWi∗∥ηi⊕hIDi⊕PWi∗∥βi⊕hIDi⊕hPWi∗∥ηi⊕hIDi⊕PWi∗Step 5.
The attacker iterates the comparison process until the computed resultχi∗ equals the extracted value χi.Step 6.
If they corresponded with each other,PWi∗ would be an accurate password.Through the above description, we demonstrate that Kaul and Awasthi’s scheme [14] does not guarantee to protect off-line password guessing attack.


## 4.3. User Impersonation Attack

Generally speaking, many password-based authentication schemes’ security is based on knowledge of the password; therefore, if an attacker acquires an user’s password, the attacker can impersonate a legitimate user. Unfortunately, Kaul and Awasthi’s scheme has a weakness under this case. After obtaining the user’s passwordPWi, as described in Section 4.2, an attacker can successfully impersonate a legitimate user by performing the following steps.Step 1.
Attacker extracts{βi,h(·),γi,χi,ηi} after stolen smart card.Step 2.
The attacker getsIDi and T in the eavesdropped request ωi,ϑi,IDi,T.Step 3.
The attacker computesb,RPWi,αi,yi using obtained IDi,PWi,T and further computes ωi,ϑi.Step 4.
The attacker constructs login requestωi,ϑi,IDi,T and sends it to S.Step 5.
Upon getting the login request,S checks whether T and ϑi are normal values or not.Step 6.
If the above checking process is done,S assures that the received login request is a legal message.In Step 6, it is obvious thatS can successfully verify ϑi, since the values in attacker’s login request are exactly equal to user’s login request. Therefore, the attacker can successfully disguise a legitimate user in Kaul and Awasthi’s scheme [14].


## 4.4. Session Key Compromise

In Kaul and Awasthi’s scheme, if an attacker successfully guessesUi’s password by off-line password guessing attack, the attacker can construct the session key SK shared between user and server. First, the attacker can acquire IDi,T and Ts after eavesdropping the login and authentication request. Then, the attacker can compute αi and yi using obtained PWi, which is previously compromised value through the Section 4.2. With combined these values, attacker can successfully establish SK=h(IDi⊕αi⊕yi⊕T⊕Ts).


## 4.5. Time Synchronize Problem

It is time-stamp method that a hitherto commonly used method against replay attack. Kaul and Awasthi also mentioned a time-stamp method to prevent replay attack. However, this method may cause time synchronization problem between servers and users, since the current network system is large-scale wireless network composed of multitudinous users employing various devices contrary to past small scale network environment. Besides, it is inefficient to synchronize all system in real time. Nonce-based method applying random number is recommended instead of time-stamp method to settle synchronization problem [24]. Kaul and Awasthi’s scheme is required to switch to nonce-based method to resolve time synchronization problem.


## 5. The Proposed Scheme

In this section, we suggest the refined version of authentication protocol to offer enhanced security by resolving Kaul and Awasthi’s [14] vulnerabilities. In our proposed scheme, in order to conceal the user’s identity, we employ dynamic identity technique that is combined form of IDi and random number. We also use biometrics information with Biohashing H(·) [15] to avoid off-line password guessing attack and impersonation attack. In addition, we apply nonce-based method to prevent replay attack instead of unsteady time-stamp method. Our proposed method also consists of four phases: registration, login, authentication, and password change. Figure 2 describes our proposed scheme, and the notations employed to the proposed scheme are displayed in Table 1.Figure 2
Our proposed scheme.


### 5.1. Registration Phase

(1)
U i inputs IDi and PWi and imprints his/her biometrics Bi. Then Ui computes RPWi=h(PWi∥H(Bi)) and sends a registration request IDi,RPWi to server S through a secure channel. (2)
S computes αi=h(IDi⊕x), βi=αi⊕h(IDi∥RPWi), and γi=h(αi∥RPWi)⊕x. (3)
S then issues a smart card with the parameters {βi,h(·),γi} and sends it to Ui through a secure channel. (4)
Upon receiving the smart card,Ui computes ηi=h(IDi∥PWi∥H(Bi)) and enters the ηi in its memory, and, finally, the smart card includes the information {βi,h(·),γi,ηi}.


### 5.2. Login Phase

(1)
U i inserts Ui’s smart card into a card reader and inputs IDi, PWi and also imprints biometric Bi. Smart card then computes ηi∗=h(IDi∥PWi∥H(Bi)) and compares it with the stored ηi in the smart card. If this comparison is satisfied, the smart card acknowledges the legitimacy of the Ui and proceeds with the next step. Otherwise, it terminates this phase. (2)
Smart card computesRPWi=h(PWi∥H(Bi)) and αi=βi⊕h(IDi∥RPWi). (3)
Smart card selects a random numberr1 and computes χi=IDi⊕r1, ωi=IDi⊕h(αi∥RPWi) and ϑi=h(IDi∥r1∥αi). (4)
Finally,Ui sends the login request ωi,ϑi,χi,γi to S through a public network.


### 5.3. Authentication Phase

(1)
S computes IDi∗=ωi⊕γi⊕x, r1∗=χi⊕IDi∗ and ϑi∗=h(IDi∗∥r1∗∥h(IDi∗⊕x)). S then verifies whether ϑi∗=ϑi. If this comparison is satisfied, S accepts the login request and proceeds with the next step. Otherwise, S rejects the login request and this phase is terminated. (2)
S selects a random number r2 and computes μi=r2⊕h(r1∗∥ϑi∗), SK=h(r1∗∥r2∥h(IDi∗⊕x)∥IDi∗) and νi=h(SK∥r1∗∥r2). (3)
S sends an authentication request μi,νi to Ui through a public network. (4)
U i computes r2∗=μi⊕h(r1∥ϑi), SK=h(r1∥r2∗∥αi∥IDi) and νi∗=h(SK∥r1∥r2∗). (5)
U i then verifies whether νi∗=νi. If this comparison is satisfied, Ui accepts the authentication request and successfully authenticates S. Otherwise, Ui rejects the authentication request and this phase is terminated.


### 5.4. Password Change Phase

(1)
U i inserts Ui’s smart card into a card reader and inputs IDi, PWi and also imprints biometric Bi. Smart card then computes ηi∗=h(IDi∥PWi∥H(Bi)) and compares it with the stored ηi in the smart card. If this comparison is satisfied, the smart card acknowledges the legitimacy of Ui and proceeds with the next step. Otherwise, it terminates this phase. (2)
U i inputs a new password PWinew, and smart card computes RPWinew=h(PWinew∥H(Bi)). (3)
Smart card further computes(2)βinew=αi⊕hIDi∥RPWinewγinew=γi⊕hαi∥RPWi⊕hαi∥RPWinewηinew=hIDi∥PWinew∥HBi (4)
Smart card replaces{βi,γi,ηi} with the new parameters {βinew,γinew,ηinew}. Consequently, the smart card contains the information {βinew,h(·),γinew,ηinew}.


## 5.1. Registration Phase

(1)
U i inputs IDi and PWi and imprints his/her biometrics Bi. Then Ui computes RPWi=h(PWi∥H(Bi)) and sends a registration request IDi,RPWi to server S through a secure channel. (2)
S computes αi=h(IDi⊕x), βi=αi⊕h(IDi∥RPWi), and γi=h(αi∥RPWi)⊕x. (3)
S then issues a smart card with the parameters {βi,h(·),γi} and sends it to Ui through a secure channel. (4)
Upon receiving the smart card,Ui computes ηi=h(IDi∥PWi∥H(Bi)) and enters the ηi in its memory, and, finally, the smart card includes the information {βi,h(·),γi,ηi}.


## 5.2. Login Phase

(1)
U i inserts Ui’s smart card into a card reader and inputs IDi, PWi and also imprints biometric Bi. Smart card then computes ηi∗=h(IDi∥PWi∥H(Bi)) and compares it with the stored ηi in the smart card. If this comparison is satisfied, the smart card acknowledges the legitimacy of the Ui and proceeds with the next step. Otherwise, it terminates this phase. (2)
Smart card computesRPWi=h(PWi∥H(Bi)) and αi=βi⊕h(IDi∥RPWi). (3)
Smart card selects a random numberr1 and computes χi=IDi⊕r1, ωi=IDi⊕h(αi∥RPWi) and ϑi=h(IDi∥r1∥αi). (4)
Finally,Ui sends the login request ωi,ϑi,χi,γi to S through a public network.


## 5.3. Authentication Phase

(1)
S computes IDi∗=ωi⊕γi⊕x, r1∗=χi⊕IDi∗ and ϑi∗=h(IDi∗∥r1∗∥h(IDi∗⊕x)). S then verifies whether ϑi∗=ϑi. If this comparison is satisfied, S accepts the login request and proceeds with the next step. Otherwise, S rejects the login request and this phase is terminated. (2)
S selects a random number r2 and computes μi=r2⊕h(r1∗∥ϑi∗), SK=h(r1∗∥r2∥h(IDi∗⊕x)∥IDi∗) and νi=h(SK∥r1∗∥r2). (3)
S sends an authentication request μi,νi to Ui through a public network. (4)
U i computes r2∗=μi⊕h(r1∥ϑi), SK=h(r1∥r2∗∥αi∥IDi) and νi∗=h(SK∥r1∥r2∗). (5)
U i then verifies whether νi∗=νi. If this comparison is satisfied, Ui accepts the authentication request and successfully authenticates S. Otherwise, Ui rejects the authentication request and this phase is terminated.


## 5.4. Password Change Phase

(1)
U i inserts Ui’s smart card into a card reader and inputs IDi, PWi and also imprints biometric Bi. Smart card then computes ηi∗=h(IDi∥PWi∥H(Bi)) and compares it with the stored ηi in the smart card. If this comparison is satisfied, the smart card acknowledges the legitimacy of Ui and proceeds with the next step. Otherwise, it terminates this phase. (2)
U i inputs a new password PWinew, and smart card computes RPWinew=h(PWinew∥H(Bi)). (3)
Smart card further computes(2)βinew=αi⊕hIDi∥RPWinewγinew=γi⊕hαi∥RPWi⊕hαi∥RPWinewηinew=hIDi∥PWinew∥HBi (4)
Smart card replaces{βi,γi,ηi} with the new parameters {βinew,γinew,ηinew}. Consequently, the smart card contains the information {βinew,h(·),γinew,ηinew}.


## 6. Security Analysis and Proof of the Proposed Scheme

In this section, we first analyze whether our proposed technique satisfies numerous security requirements. After that, we will apply Burrows-Abadi-Needham (BAN) logic [25] to validate that the generated session key is precisely distributed to user Ui and server S.


### 6.1. Security Analysis of Proposed Scheme

We evaluate whether our proposal is secure against various attacks and satisfies various authentication requirements. In addition, comparative analysis of related schemes [9, 10, 12–14] is carried out, and the results are shown in Table 2.Table 2
Security comparison.
Security attributes/Schemes An Chou et al. Chang et al. Kumari et al. Kaul & Awasthi’s Proposed [9] [10] [12] [13] [14] scheme User anonymity × × × × × √ Privileged insider attack √ × × √ √ √ Replay attack √ √ √ √ √ √ Off-line password guessing attack × × × √ × √ User impersonation attack × × × × × √ Mutual authentication × × × × √ √ Session key Compromise × × N/A × × √ Password verification process × × × √ √ √ Convenient password change N/A √ × √ √ √ No time synchronization × × × × × √


#### 6.1.1. User Anonymity

Our scheme protects the user’s identityIDi sent by messages from the possible dangers of exposure in order to accomplish user anonymity. Even if an attacker captures χi by snatching login request ωi,ϑi,χi,γi, it is unachievable to derive IDi since the attacker cannot acquire random number r1.


#### 6.1.2. Privileged Insider Attack

In our scheme, whenUi sends a registration request IDi,RPWi to S, PWi is transmitted not as uncovered, but as a form of RPWi=h(PWi∥H(Bi)) with a value H(Bi),to preclude insider attack. Thus, our scheme guarantees to hinder an insider attack.


#### 6.1.3. Replay Attack

Assumes that an attacker steals the former login requestωi,ϑi,χi,γi. Then, the attacker might try to pose as a valid user by sending this request in order to login the server. However, if the attacker sends prior login request, the server would apparently turn down the request because our scheme can find out the invalid random number through the comparison of ϑi value. In addition, in each session, our proposed scheme handles distinct random numbers. As a result, our scheme can provide safety against replay attack.


#### 6.1.4. Off-Line Password Guessing Attack

From the stolen smart card and snatch the login requestωi,ϑi,χi,γi, an attacker can procure {βi,h(·),H(·),γi,ηi}, and, using these values, the attacker may try to predict the precise password PWi. However, the attacker cannot conjecture the PWi unless IDi and H(Bi) are given. Furthermore, an user Ui only knows H(Bi) since it is a hashed biometric information. For this reason, our scheme guarantees to defend off-line password guessing attack.


#### 6.1.5. User Impersonation Attack

In our scheme, an attacker should generate the values ofωi, ϑi, χi, and γi after obtaining the value of IDi or a random number, r1 to achieve impersonation attack. Still, as we mentioned above, it is impossible for an attacker to get the value of IDi or r1. Thus, an attacker cannot create an appropriate login request to cheat S.


#### 6.1.6. Mutual Authentication

In the authentication phase of our scheme,Ui and S can attest each other according to several procedures. To be specific, S first confirms the login request by examining whether ϑi is accurate. Ui also makes sure the authentication request by checking whether νi is correct. If all these verification processes are executed successfully, mutual authentication has succeeded properly.


#### 6.1.7. Session Key Compromise

In our scheme, in order to compromise the session keySK=h(r1∥r2∗∥αi∥IDi), an attacker should have the random numbers r1 and r2. Moreover, to acquire the random numbers, the attacker should know IDi in advance. However, the attacker has no way to derive the user’s IDi, all things considered. In this manner, our authentication mechanism guarantees session key security.


#### 6.1.8. Password Verification Process

There is a feasibility that a user accidentally inputs an inaccurate password, but, for password verification procedure, a server will detect the wrong password after executing authentication phase [19]. Considering this kind of inefficient situation, our scheme evaluates the correctness of password by checking the value ηi in an early login phase.


#### 6.1.9. Convenient Password Change

In general, it is encouraged to implement verification process by itself when password adjustment occurs [24]. The performance of a security scheme can be enhanced through its own mechanism without communicating to server S. Our proposed scheme carries out extant password checking in self-verification process within smart card. After testing, calculated values {βinew,γinew,ηinew} from new password will substitute the existed values in an efficient and appropriate way.


#### 6.1.10. No Time Synchronization

In timestamp-based authentication protocols, when a user and a server transmit a packet, the clocks of all devices should be set accurately. For this reason, there is a strong likelihood that error occurs. On the contrary, our scheme handles random numbersr1 and r2 rather than time-stamp technique to avert this problem.


### 6.2. Authentication Proof with BAN Logic

We use Burrows-Abadi-Needham (BAN) logic [25] to demonstrate that the user and server participating in communication are each correctly assigned the session key SK. The basic symbols of BAN logic are as follows:(i)
(F)K: formula F is hashed with K.(ii)
U⊲F: U perceives formula F.(iii)
<F>K: combine formula F using K.(iv)
♯(F): formula F is fresh.(v)
U∣~F: U said formula F.(vi)
U∣≡F: U trusts formula F.(vii)
U⇒F: U can manage formula F.(viii)
U↔KS: U and S assign a secret key K.The ban logic also provides the following basic rules:(1)
Message meaning rule:U∣≡U↔KS,U⊲<F>K/U∣≡S∣~F.(2)
Nonce verification rule:U∣≡#(F),U∣≡S∣~F/A∣≡S∣≡F.(3)
The believe rule:U∣≡F,U∣≡G/U∣≡(F,G).(4)
Freshness conjuncatenation rule:A∣≡#(F)/A∣≡#(F,G).(5)
Jurisdiction rule:U∣≡S∣⇒F,U∣≡S∣≡F/U∣≡F.Using ban logic, we will accomplish the following goals:(i)
Goal 1:U∣≡(U↔SKS).(ii)
Goal 2:S∣≡(U↔SKS).The login and authentication messages used in our scheme can be translated into an ideal form shown as follows:(i)
Message 1:U→S: 〈IDi〉x, r1, (IDi,r1,Bi)x.(ii)
Message 2:S→U: r2, (IDi,r1,r2,SK)x.To proceed with the proof, we have defined the following assumptions:(i)
A1:U∣≡♯(r1)(ii)
A2:S∣≡♯(r2)(iii)
A3:U∣≡(U↔xS)(iv)
A4:S∣≡(U↔xS)(v)
A5:U∣≡S∣≡(U↔xS)(vi)
A6:S∣≡U∣≡(U↔xS)Our verification procedure is as follows:Based on Message 1, we could derive:(i)
S1:S⊲(IDi,r1,Bi)x,r1Based on assumption A4, we adapt the message meaning rule to derive:(ii)
S2:S∣≡U∣~r1Based on assumption A1 and the freshness conjuncatenation rule, we derive:(iii)
S3:S∣≡♯(IDi,r1,Bi)xBased on S2, S3 and the nonce verification rule, we derive:(iv)
S4:S∣≡U∣≡(IDi,r1,Bi)xBased on A4, S4 and the jurisdiction rule, we derive:(v)
S5:S∣≡r1Based on V5, assumption A2, and SK, we derive:(vi)
S6.S∣≡(U↔SKS)(Goal 2.)Based on Message 2, we could derive:(vii)
S7:U⊲r2,(IDi,r1,r2,SK)xBased on assumption A3, we adapt the message meaning rule to derive:(viii)
S8:U∣≡S∣~r2Based on assumption A2 and the freshness conjuncatenation rule, we derive:(ix)
S9:U∣≡♯(IDi,r1,r2,SK)xBased on S8, S9 and the nonce verification rule, we derive:(x)
S10:U∣≡S∣≡(IDi,r1,r2,SK)xBased on A3, S10 and the jurisdiction rule, we derive:(xi)
S11:U∣≡r2Based on V11, assumption A1, and SK, we derive:(xii)
S12.U∣≡(U↔SKS)(Goal 1.)Based on (Goal.1) and (Goal.2), we can assure that our proposed scheme provides the mutual authentication and agreement of the session keySK, which is correctly distributed between Ui and S.


## 6.1. Security Analysis of Proposed Scheme

We evaluate whether our proposal is secure against various attacks and satisfies various authentication requirements. In addition, comparative analysis of related schemes [9, 10, 12–14] is carried out, and the results are shown in Table 2.Table 2
Security comparison.
Security attributes/Schemes An Chou et al. Chang et al. Kumari et al. Kaul & Awasthi’s Proposed [9] [10] [12] [13] [14] scheme User anonymity × × × × × √ Privileged insider attack √ × × √ √ √ Replay attack √ √ √ √ √ √ Off-line password guessing attack × × × √ × √ User impersonation attack × × × × × √ Mutual authentication × × × × √ √ Session key Compromise × × N/A × × √ Password verification process × × × √ √ √ Convenient password change N/A √ × √ √ √ No time synchronization × × × × × √


### 6.1.1. User Anonymity

Our scheme protects the user’s identityIDi sent by messages from the possible dangers of exposure in order to accomplish user anonymity. Even if an attacker captures χi by snatching login request ωi,ϑi,χi,γi, it is unachievable to derive IDi since the attacker cannot acquire random number r1.


### 6.1.2. Privileged Insider Attack

In our scheme, whenUi sends a registration request IDi,RPWi to S, PWi is transmitted not as uncovered, but as a form of RPWi=h(PWi∥H(Bi)) with a value H(Bi),to preclude insider attack. Thus, our scheme guarantees to hinder an insider attack.


### 6.1.3. Replay Attack

Assumes that an attacker steals the former login requestωi,ϑi,χi,γi. Then, the attacker might try to pose as a valid user by sending this request in order to login the server. However, if the attacker sends prior login request, the server would apparently turn down the request because our scheme can find out the invalid random number through the comparison of ϑi value. In addition, in each session, our proposed scheme handles distinct random numbers. As a result, our scheme can provide safety against replay attack.


### 6.1.4. Off-Line Password Guessing Attack

From the stolen smart card and snatch the login requestωi,ϑi,χi,γi, an attacker can procure {βi,h(·),H(·),γi,ηi}, and, using these values, the attacker may try to predict the precise password PWi. However, the attacker cannot conjecture the PWi unless IDi and H(Bi) are given. Furthermore, an user Ui only knows H(Bi) since it is a hashed biometric information. For this reason, our scheme guarantees to defend off-line password guessing attack.


### 6.1.5. User Impersonation Attack

In our scheme, an attacker should generate the values ofωi, ϑi, χi, and γi after obtaining the value of IDi or a random number, r1 to achieve impersonation attack. Still, as we mentioned above, it is impossible for an attacker to get the value of IDi or r1. Thus, an attacker cannot create an appropriate login request to cheat S.


### 6.1.6. Mutual Authentication

In the authentication phase of our scheme,Ui and S can attest each other according to several procedures. To be specific, S first confirms the login request by examining whether ϑi is accurate. Ui also makes sure the authentication request by checking whether νi is correct. If all these verification processes are executed successfully, mutual authentication has succeeded properly.


### 6.1.7. Session Key Compromise

In our scheme, in order to compromise the session keySK=h(r1∥r2∗∥αi∥IDi), an attacker should have the random numbers r1 and r2. Moreover, to acquire the random numbers, the attacker should know IDi in advance. However, the attacker has no way to derive the user’s IDi, all things considered. In this manner, our authentication mechanism guarantees session key security.


### 6.1.8. Password Verification Process

There is a feasibility that a user accidentally inputs an inaccurate password, but, for password verification procedure, a server will detect the wrong password after executing authentication phase [19]. Considering this kind of inefficient situation, our scheme evaluates the correctness of password by checking the value ηi in an early login phase.


### 6.1.9. Convenient Password Change

In general, it is encouraged to implement verification process by itself when password adjustment occurs [24]. The performance of a security scheme can be enhanced through its own mechanism without communicating to server S. Our proposed scheme carries out extant password checking in self-verification process within smart card. After testing, calculated values {βinew,γinew,ηinew} from new password will substitute the existed values in an efficient and appropriate way.


### 6.1.10. No Time Synchronization

In timestamp-based authentication protocols, when a user and a server transmit a packet, the clocks of all devices should be set accurately. For this reason, there is a strong likelihood that error occurs. On the contrary, our scheme handles random numbersr1 and r2 rather than time-stamp technique to avert this problem.


## 6.1.1. User Anonymity

Our scheme protects the user’s identityIDi sent by messages from the possible dangers of exposure in order to accomplish user anonymity. Even if an attacker captures χi by snatching login request ωi,ϑi,χi,γi, it is unachievable to derive IDi since the attacker cannot acquire random number r1.


## 6.1.2. Privileged Insider Attack

In our scheme, whenUi sends a registration request IDi,RPWi to S, PWi is transmitted not as uncovered, but as a form of RPWi=h(PWi∥H(Bi)) with a value H(Bi),to preclude insider attack. Thus, our scheme guarantees to hinder an insider attack.


## 6.1.3. Replay Attack

Assumes that an attacker steals the former login requestωi,ϑi,χi,γi. Then, the attacker might try to pose as a valid user by sending this request in order to login the server. However, if the attacker sends prior login request, the server would apparently turn down the request because our scheme can find out the invalid random number through the comparison of ϑi value. In addition, in each session, our proposed scheme handles distinct random numbers. As a result, our scheme can provide safety against replay attack.


## 6.1.4. Off-Line Password Guessing Attack

From the stolen smart card and snatch the login requestωi,ϑi,χi,γi, an attacker can procure {βi,h(·),H(·),γi,ηi}, and, using these values, the attacker may try to predict the precise password PWi. However, the attacker cannot conjecture the PWi unless IDi and H(Bi) are given. Furthermore, an user Ui only knows H(Bi) since it is a hashed biometric information. For this reason, our scheme guarantees to defend off-line password guessing attack.


## 6.1.5. User Impersonation Attack

In our scheme, an attacker should generate the values ofωi, ϑi, χi, and γi after obtaining the value of IDi or a random number, r1 to achieve impersonation attack. Still, as we mentioned above, it is impossible for an attacker to get the value of IDi or r1. Thus, an attacker cannot create an appropriate login request to cheat S.


## 6.1.6. Mutual Authentication

In the authentication phase of our scheme,Ui and S can attest each other according to several procedures. To be specific, S first confirms the login request by examining whether ϑi is accurate. Ui also makes sure the authentication request by checking whether νi is correct. If all these verification processes are executed successfully, mutual authentication has succeeded properly.


## 6.1.7. Session Key Compromise

In our scheme, in order to compromise the session keySK=h(r1∥r2∗∥αi∥IDi), an attacker should have the random numbers r1 and r2. Moreover, to acquire the random numbers, the attacker should know IDi in advance. However, the attacker has no way to derive the user’s IDi, all things considered. In this manner, our authentication mechanism guarantees session key security.


## 6.1.8. Password Verification Process

There is a feasibility that a user accidentally inputs an inaccurate password, but, for password verification procedure, a server will detect the wrong password after executing authentication phase [19]. Considering this kind of inefficient situation, our scheme evaluates the correctness of password by checking the value ηi in an early login phase.


## 6.1.9. Convenient Password Change

In general, it is encouraged to implement verification process by itself when password adjustment occurs [24]. The performance of a security scheme can be enhanced through its own mechanism without communicating to server S. Our proposed scheme carries out extant password checking in self-verification process within smart card. After testing, calculated values {βinew,γinew,ηinew} from new password will substitute the existed values in an efficient and appropriate way.


## 6.1.10. No Time Synchronization

In timestamp-based authentication protocols, when a user and a server transmit a packet, the clocks of all devices should be set accurately. For this reason, there is a strong likelihood that error occurs. On the contrary, our scheme handles random numbersr1 and r2 rather than time-stamp technique to avert this problem.


## 6.2. Authentication Proof with BAN Logic

We use Burrows-Abadi-Needham (BAN) logic [25] to demonstrate that the user and server participating in communication are each correctly assigned the session key SK. The basic symbols of BAN logic are as follows:(i)
(F)K: formula F is hashed with K.(ii)
U⊲F: U perceives formula F.(iii)
<F>K: combine formula F using K.(iv)
♯(F): formula F is fresh.(v)
U∣~F: U said formula F.(vi)
U∣≡F: U trusts formula F.(vii)
U⇒F: U can manage formula F.(viii)
U↔KS: U and S assign a secret key K.The ban logic also provides the following basic rules:(1)
Message meaning rule:U∣≡U↔KS,U⊲<F>K/U∣≡S∣~F.(2)
Nonce verification rule:U∣≡#(F),U∣≡S∣~F/A∣≡S∣≡F.(3)
The believe rule:U∣≡F,U∣≡G/U∣≡(F,G).(4)
Freshness conjuncatenation rule:A∣≡#(F)/A∣≡#(F,G).(5)
Jurisdiction rule:U∣≡S∣⇒F,U∣≡S∣≡F/U∣≡F.Using ban logic, we will accomplish the following goals:(i)
Goal 1:U∣≡(U↔SKS).(ii)
Goal 2:S∣≡(U↔SKS).The login and authentication messages used in our scheme can be translated into an ideal form shown as follows:(i)
Message 1:U→S: 〈IDi〉x, r1, (IDi,r1,Bi)x.(ii)
Message 2:S→U: r2, (IDi,r1,r2,SK)x.To proceed with the proof, we have defined the following assumptions:(i)
A1:U∣≡♯(r1)(ii)
A2:S∣≡♯(r2)(iii)
A3:U∣≡(U↔xS)(iv)
A4:S∣≡(U↔xS)(v)
A5:U∣≡S∣≡(U↔xS)(vi)
A6:S∣≡U∣≡(U↔xS)Our verification procedure is as follows:Based on Message 1, we could derive:(i)
S1:S⊲(IDi,r1,Bi)x,r1Based on assumption A4, we adapt the message meaning rule to derive:(ii)
S2:S∣≡U∣~r1Based on assumption A1 and the freshness conjuncatenation rule, we derive:(iii)
S3:S∣≡♯(IDi,r1,Bi)xBased on S2, S3 and the nonce verification rule, we derive:(iv)
S4:S∣≡U∣≡(IDi,r1,Bi)xBased on A4, S4 and the jurisdiction rule, we derive:(v)
S5:S∣≡r1Based on V5, assumption A2, and SK, we derive:(vi)
S6.S∣≡(U↔SKS)(Goal 2.)Based on Message 2, we could derive:(vii)
S7:U⊲r2,(IDi,r1,r2,SK)xBased on assumption A3, we adapt the message meaning rule to derive:(viii)
S8:U∣≡S∣~r2Based on assumption A2 and the freshness conjuncatenation rule, we derive:(ix)
S9:U∣≡♯(IDi,r1,r2,SK)xBased on S8, S9 and the nonce verification rule, we derive:(x)
S10:U∣≡S∣≡(IDi,r1,r2,SK)xBased on A3, S10 and the jurisdiction rule, we derive:(xi)
S11:U∣≡r2Based on V11, assumption A1, and SK, we derive:(xii)
S12.U∣≡(U↔SKS)(Goal 1.)Based on (Goal.1) and (Goal.2), we can assure that our proposed scheme provides the mutual authentication and agreement of the session keySK, which is correctly distributed between Ui and S.


## 7. Formal Security Proof Using AVISPA Tool

In this section, we demonstrate that our proposed scheme can resist both passive and active attacks by simulating its use in the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool [26].


### 7.1. Overview of AVISPA Tool

The AVISPA is a formal tool that is generally used to verify protocol security. The protocol specification is written in High Level Protocols Specification Language (HLPSL) [27] and is translated into the Intermediate Format (IF) by a Translator HLPSL2IF. The result is then treated as the input value of the different back-end procedures. In this paper, we first stipulate our authentication mechanism based on HLPSL and then derive the results of the simulation using two back-ends OFMC and CL-AtSe.


### 7.2. Stipulating the Proposed Scheme

This section supports descriptions of the specifications of our proposed scheme in HLPSL. We have assigned the fundamental roles for a userUi and a server S for each phase, and we then stipulate the other roles for the session, environment, and goal. Box 1 shows that the role specification of the user Ui for our proposed scheme.Box 1:Role specification in HLPSL for the user Ui.
role user (Ui,Sj: agent, SKuisj: symmetric_key, %H  : one-way/bio hash function H  : hash_func, Snd,Rcv: channel(dy)) played_by Ui def= local State  : nat, IDi, PWi, RPWi, BIOi, X, Ai, Bi, Ci, R1, Di, Ei, Fi, R2, Gi, Vi  : text const user_server_r1, server_user_r2, subs1, subs2  : protocol_id init State≔ 0 transition %%%%% Registration phase 1. State = 0∧ Rcv(start) =∣> State＇≔ 1 ∧ RPWi＇ ≔ H(PWi.H(BIOi)) ∧Snd(IDi.RPWi＇_SKuisj) ∧secret({X}, subs1, Sj) ∧secret({IDi,PWi,BIOi}, subs2, Ui) 2. State = 1∧ Rcv(xor(H(xor(IDi, X)), H(IDi.H(PWi.H(BIOi)))).xor(H(xor(IDi, X).H(PWi.H(BIOi))), X)​ _SKuisj) =∣> %%%%% Login phase State＇≔ 2 ∧ R1＇ ≔ new() ∧ RPWi＇ ≔ H(PWi.H(BIOi)) ∧ Ai＇ ≔ xor(xor(H(xor(IDi, X)), H(IDi.H(PWi.H(BIOi)))), H(IDi.RPWi＇)) ∧ Ci＇ ≔ xor(H(Ai＇.H(PWi.H(BIOi))), X) ∧ Di＇ ≔ xor(IDi, R1＇) ∧ Ei＇ ≔ xor(IDi, H(Ai＇.RPWi＇)) ∧ Fi＇ ≔ H(IDi.R1＇.Ai＇) ∧ Snd(Ci＇.Di＇.Ei＇.Fi＇) ∧ witness(Ui, Sj, user_server_r1, R1＇) %%%%% Verification phase 3. State = 2∧ Rcv(xor(R2＇, H(R1＇.H(IDi.R1＇.Ai＇))).H(H(R1＇.R2＇.H(xor(IDi, X)).IDi).R1＇.R2＇)) =∣> State＇≔ 3 ∧ request(Sj, Ui, server_user_r2, R2＇) end roleDuring the registration phase,Ui sends IDi,RPWi to S through a secure channel using the Snd() operation and a symmetric key SKuisj. The type declaration channel(dy) expressed that the channel is effected by the Dolev-Yao threat model [28]. Under this threat model, the attacker can, some malignancy action such as intercept, eavesdrop on any messages by agents. The declaration secret({IDi,PWi,BIOi},sub2,Ui) expressed that the personal private information (IDi,PWi,Bioi) is only known to Ui. new() operation is used to generate a random number r1 during the login and authentication phase. Ui then computes RPWi=h(PWi∥H(Bi)), αi=βi⊕h(IDi∥RPWi), χi=IDi⊕r1, ωi=IDi⊕h(αi∥RPWi), and ϑi=h(IDi∥r1∥αi) and sends the login request ωi,ϑi,χi,γi to S via a public network. The declaration witness(Ui,Sj,user_server_r1,R1′) expresses that Ui has recently generated a random number r1 for S to communicate. Ui finally receives the authentication message μi,νi from S via a public channel.The role specification of the serverS for our scheme is shown in Box 2. In the registration phase, S receives the registration request message IDi,RPWi from Ui. After receiving the message, S issues a smart card which contains parameters {βi,h(·),γi} and sends it to Ui using Snd() operation and symmetric key SKuisj. During the login and authentication phase, S receives the login request message ωi,ϑi,χi,γi from Ui. Then, similar to user Ui’s role, Server S uses new() operation to generate a random number r2. The declaration witness(Sj,Ui,server_user_r2,R2′) expresses that S has recently generated a random number r2 for Ui to communicate. The declaration request(Ui,Sj,user_server_r1,R1′) expresses that S authenticates user Ui.Box 2:Role specification in HLPSL for the server S.
role server (Ui,Sj: agent, SKuisj: symmetric_key, H  : hash_func, Snd,Rcv: channel(dy)) played_by Sj def= local State  : nat, IDi, PWi, RPWi, BIOi, X, Ai, Bi, Ci, R1, Di, Ei, Fi, R2, Gi, Vi  : text const user_server_r1, server_user_r2, subs1, subs2  : protocol_id init State≔ 0 transition %%%%% Registration phase 1. State = 0∧ Rcv(IDi.H(PWi.H(BIOi)) _SKuisj) =∣> State＇≔ 1 ∧ secret({X}, subs1, Sj) ∧ secret({IDi,PWi,BIOi}, subs2, Ui) ∧ Snd(xor(H(xor(IDi, X)), H(IDi.H(PWi.H(BIOi)))).xor(H(xor(IDi, X).H(PWi.H(BIOi))), X) _SKuisj) %%%%% Login phase 2. State = 1∧ Rcv(xor(H(H(xor(IDi, X)).H(PWi.H(BIOi))), X).xor(IDi, R1＇).xor(IDi, H(H(xor(IDi, X)).RPWi＇)).H(IDi.R1＇.H(xor(IDi, X))))=∣> %%%%% Verification phase State＇≔ 2 ∧ R2＇ ≔ new() ∧ IDi＇ ≔ xor(xor(IDi, H(H(xor(IDi, X)).RPWi＇)), Ci＇, X) ∧ R1＇ ≔ xor(xor(IDi, R1＇), IDi) ∧ Fi＇ ≔ H(IDi.R1＇.H(xor(IDi, X))) ∧ Gi＇ ≔ xor(R2＇, H(R1＇.H(IDi.R1＇.Ai＇))) ∧ Vi＇ ≔ H(H(R1＇.R2＇.H(xor(IDi, X)).IDi).R1＇.R2＇) ∧ Snd(Gi＇.Vi＇) ∧ witness(Sj, Ui, server_user_r2, R2＇) ∧ request(Ui, Sj, user_server_r1, R1＇) end roleThe rest segment in HLPSL, session, environment, and goal is described in Box3. Each segment’s specifics are as follows:(i)
Session segment: the participants in the communication, including the user and server, and other basic roles being instanced as concrete arguments(ii)
Environment segment: cover the global constant, session composition, and intruder knowledge(iii)
Goal segment: secrecy goals and authentication goals.Box 3:Role specification in HLPSL for the session, environment, and goal.
role session(Ui, Sj: agent, SKuisj  : symmetric_key, H  : hash_func) def= local SI, SJ, RI, RJ: channel (dy) composition user(Ui, Sj, SKuisj, H, SI, RI) ∧ server(Ui, Sj, SKuisj, H, SJ, RJ) end role  goal secrecy_of subs1 secrecy_of subs2 authentication_on user_server_r1 authentication_on server_user_r2 end goal  environment() role environment() def= const ui, sj: agent, skuisj  : symmetric_key, h  : hash_func, %H  : one-way/bio hash function idi, pwi, bioi, x, r1, r2: text, user_server_r1, server_user_r2, subs1, subs2  : protocol_id intruder_knowledge = {ui,sj,h} composition session(ui, sj, skuisj, h) ∧ session(ui, sj, skuisj, h) end role


### 7.3. Simulation Results

This section describes the output results of the simulation conducted for our proposed scheme. The results of the simulation under the OFMC and CL-AtSe back-ends are shown in Box4, which clearly shows that our scheme is SAFE under each back-end. Therefore, it is obvious that our proposed scheme can prevent passive and active attacks, including replay and man-in-the-middle attacks.Box 4:Simulation results under the OFMC and CL-AtSe back-ends.
SUMMARY SAFE DETAILS BOUNDED_NUMBER_OF_SESSIONS PROTOCOL /home/jaewook/Desktop/span/testsuite/results/Security&com munications.if GOAL as specified BACKEND OFMC  STATISTICS TIME 24 ms parseTime 0 ms visitedNodes: 22 nodes depth: 3 plies  SUMMARY SAFE DETAILS BOUNDED_NUMBER_OF_SESSIONS TYPED_MODEL PROTOCOL /home/jaewook/Desktop/span/testsuite/results/Security&com munications.if GOAL As specified BACKEND CL-AtSe STATISTICS Analysed  : 2 states Reachable  : 0 state Translation: 0.02 seconds Computation: 0.00 seconds


## 7.1. Overview of AVISPA Tool

The AVISPA is a formal tool that is generally used to verify protocol security. The protocol specification is written in High Level Protocols Specification Language (HLPSL) [27] and is translated into the Intermediate Format (IF) by a Translator HLPSL2IF. The result is then treated as the input value of the different back-end procedures. In this paper, we first stipulate our authentication mechanism based on HLPSL and then derive the results of the simulation using two back-ends OFMC and CL-AtSe.


## 7.2. Stipulating the Proposed Scheme

This section supports descriptions of the specifications of our proposed scheme in HLPSL. We have assigned the fundamental roles for a userUi and a server S for each phase, and we then stipulate the other roles for the session, environment, and goal. Box 1 shows that the role specification of the user Ui for our proposed scheme.Box 1:Role specification in HLPSL for the user Ui.
role user (Ui,Sj: agent, SKuisj: symmetric_key, %H  : one-way/bio hash function H  : hash_func, Snd,Rcv: channel(dy)) played_by Ui def= local State  : nat, IDi, PWi, RPWi, BIOi, X, Ai, Bi, Ci, R1, Di, Ei, Fi, R2, Gi, Vi  : text const user_server_r1, server_user_r2, subs1, subs2  : protocol_id init State≔ 0 transition %%%%% Registration phase 1. State = 0∧ Rcv(start) =∣> State＇≔ 1 ∧ RPWi＇ ≔ H(PWi.H(BIOi)) ∧Snd(IDi.RPWi＇_SKuisj) ∧secret({X}, subs1, Sj) ∧secret({IDi,PWi,BIOi}, subs2, Ui) 2. State = 1∧ Rcv(xor(H(xor(IDi, X)), H(IDi.H(PWi.H(BIOi)))).xor(H(xor(IDi, X).H(PWi.H(BIOi))), X)​ _SKuisj) =∣> %%%%% Login phase State＇≔ 2 ∧ R1＇ ≔ new() ∧ RPWi＇ ≔ H(PWi.H(BIOi)) ∧ Ai＇ ≔ xor(xor(H(xor(IDi, X)), H(IDi.H(PWi.H(BIOi)))), H(IDi.RPWi＇)) ∧ Ci＇ ≔ xor(H(Ai＇.H(PWi.H(BIOi))), X) ∧ Di＇ ≔ xor(IDi, R1＇) ∧ Ei＇ ≔ xor(IDi, H(Ai＇.RPWi＇)) ∧ Fi＇ ≔ H(IDi.R1＇.Ai＇) ∧ Snd(Ci＇.Di＇.Ei＇.Fi＇) ∧ witness(Ui, Sj, user_server_r1, R1＇) %%%%% Verification phase 3. State = 2∧ Rcv(xor(R2＇, H(R1＇.H(IDi.R1＇.Ai＇))).H(H(R1＇.R2＇.H(xor(IDi, X)).IDi).R1＇.R2＇)) =∣> State＇≔ 3 ∧ request(Sj, Ui, server_user_r2, R2＇) end roleDuring the registration phase,Ui sends IDi,RPWi to S through a secure channel using the Snd() operation and a symmetric key SKuisj. The type declaration channel(dy) expressed that the channel is effected by the Dolev-Yao threat model [28]. Under this threat model, the attacker can, some malignancy action such as intercept, eavesdrop on any messages by agents. The declaration secret({IDi,PWi,BIOi},sub2,Ui) expressed that the personal private information (IDi,PWi,Bioi) is only known to Ui. new() operation is used to generate a random number r1 during the login and authentication phase. Ui then computes RPWi=h(PWi∥H(Bi)), αi=βi⊕h(IDi∥RPWi), χi=IDi⊕r1, ωi=IDi⊕h(αi∥RPWi), and ϑi=h(IDi∥r1∥αi) and sends the login request ωi,ϑi,χi,γi to S via a public network. The declaration witness(Ui,Sj,user_server_r1,R1′) expresses that Ui has recently generated a random number r1 for S to communicate. Ui finally receives the authentication message μi,νi from S via a public channel.The role specification of the serverS for our scheme is shown in Box 2. In the registration phase, S receives the registration request message IDi,RPWi from Ui. After receiving the message, S issues a smart card which contains parameters {βi,h(·),γi} and sends it to Ui using Snd() operation and symmetric key SKuisj. During the login and authentication phase, S receives the login request message ωi,ϑi,χi,γi from Ui. Then, similar to user Ui’s role, Server S uses new() operation to generate a random number r2. The declaration witness(Sj,Ui,server_user_r2,R2′) expresses that S has recently generated a random number r2 for Ui to communicate. The declaration request(Ui,Sj,user_server_r1,R1′) expresses that S authenticates user Ui.Box 2:Role specification in HLPSL for the server S.
role server (Ui,Sj: agent, SKuisj: symmetric_key, H  : hash_func, Snd,Rcv: channel(dy)) played_by Sj def= local State  : nat, IDi, PWi, RPWi, BIOi, X, Ai, Bi, Ci, R1, Di, Ei, Fi, R2, Gi, Vi  : text const user_server_r1, server_user_r2, subs1, subs2  : protocol_id init State≔ 0 transition %%%%% Registration phase 1. State = 0∧ Rcv(IDi.H(PWi.H(BIOi)) _SKuisj) =∣> State＇≔ 1 ∧ secret({X}, subs1, Sj) ∧ secret({IDi,PWi,BIOi}, subs2, Ui) ∧ Snd(xor(H(xor(IDi, X)), H(IDi.H(PWi.H(BIOi)))).xor(H(xor(IDi, X).H(PWi.H(BIOi))), X) _SKuisj) %%%%% Login phase 2. State = 1∧ Rcv(xor(H(H(xor(IDi, X)).H(PWi.H(BIOi))), X).xor(IDi, R1＇).xor(IDi, H(H(xor(IDi, X)).RPWi＇)).H(IDi.R1＇.H(xor(IDi, X))))=∣> %%%%% Verification phase State＇≔ 2 ∧ R2＇ ≔ new() ∧ IDi＇ ≔ xor(xor(IDi, H(H(xor(IDi, X)).RPWi＇)), Ci＇, X) ∧ R1＇ ≔ xor(xor(IDi, R1＇), IDi) ∧ Fi＇ ≔ H(IDi.R1＇.H(xor(IDi, X))) ∧ Gi＇ ≔ xor(R2＇, H(R1＇.H(IDi.R1＇.Ai＇))) ∧ Vi＇ ≔ H(H(R1＇.R2＇.H(xor(IDi, X)).IDi).R1＇.R2＇) ∧ Snd(Gi＇.Vi＇) ∧ witness(Sj, Ui, server_user_r2, R2＇) ∧ request(Ui, Sj, user_server_r1, R1＇) end roleThe rest segment in HLPSL, session, environment, and goal is described in Box3. Each segment’s specifics are as follows:(i)
Session segment: the participants in the communication, including the user and server, and other basic roles being instanced as concrete arguments(ii)
Environment segment: cover the global constant, session composition, and intruder knowledge(iii)
Goal segment: secrecy goals and authentication goals.Box 3:Role specification in HLPSL for the session, environment, and goal.
role session(Ui, Sj: agent, SKuisj  : symmetric_key, H  : hash_func) def= local SI, SJ, RI, RJ: channel (dy) composition user(Ui, Sj, SKuisj, H, SI, RI) ∧ server(Ui, Sj, SKuisj, H, SJ, RJ) end role  goal secrecy_of subs1 secrecy_of subs2 authentication_on user_server_r1 authentication_on server_user_r2 end goal  environment() role environment() def= const ui, sj: agent, skuisj  : symmetric_key, h  : hash_func, %H  : one-way/bio hash function idi, pwi, bioi, x, r1, r2: text, user_server_r1, server_user_r2, subs1, subs2  : protocol_id intruder_knowledge = {ui,sj,h} composition session(ui, sj, skuisj, h) ∧ session(ui, sj, skuisj, h) end role


## 7.3. Simulation Results

This section describes the output results of the simulation conducted for our proposed scheme. The results of the simulation under the OFMC and CL-AtSe back-ends are shown in Box4, which clearly shows that our scheme is SAFE under each back-end. Therefore, it is obvious that our proposed scheme can prevent passive and active attacks, including replay and man-in-the-middle attacks.Box 4:Simulation results under the OFMC and CL-AtSe back-ends.
SUMMARY SAFE DETAILS BOUNDED_NUMBER_OF_SESSIONS PROTOCOL /home/jaewook/Desktop/span/testsuite/results/Security&com munications.if GOAL as specified BACKEND OFMC  STATISTICS TIME 24 ms parseTime 0 ms visitedNodes: 22 nodes depth: 3 plies  SUMMARY SAFE DETAILS BOUNDED_NUMBER_OF_SESSIONS TYPED_MODEL PROTOCOL /home/jaewook/Desktop/span/testsuite/results/Security&com munications.if GOAL As specified BACKEND CL-AtSe STATISTICS Analysed  : 2 states Reachable  : 0 state Translation: 0.02 seconds Computation: 0.00 seconds


## 8. Performance Analysis of the Proposed Scheme

In this section, we compare the execution time and cost of computation for our proposed technique with the technique [9, 10, 12–14]. In general, cost of computation in authentication protocol is analyzed by operations performed in each work within the protocols. Accordingly, the cost of computational analysis focuses on the activities performed by members, like users and servers. The following is a definition of the parameters for evaluation of the calculation cost:(i)
TH is the time of executing a one-way hashing function.(ii)
T⊕ is the time of executing a XOR operation.(iii)
TM is the time of executing a modular exponentiation.Table3 contains a summary of the calculation overhead comparison. The results show that An [9], Chou et al. [10], Chang et al. [12], Kumari et al. [13], Kaul and Awasthi [14], and our technique require the total computation cost overheads 12TH + 14T⊕ + 4TM, 36TH + 31T⊕, 24TH + 14T⊕, 21TH + 24T⊕, 28TH + 36T⊕, and 27TH + 15T⊕, respectively. On the basis of [29], we adopt that the actual execution time for the complexity notations is as follows: TH=0.0005s and TM=0.522s. Since the XOR operation time is short, T⊕ does not need to be considered. As shown in Table 3, we observed that the execution time of our proposed scheme requires only 0.0135s (≈ 27 × 0.0005s), so it can be regarded as a negligible significance, whereas the execution time of An’s scheme [9] using modular exponentiation operation required 2.094s (≈ 12 × 0.0005s + 4 × 0.522s), so this scheme turned out to be ineffective. Thus, we conclude that our proposed technology considers efficiency.Table 3
Performance comparison.
Phases/Schemes An Chou et al. Chang et al. Kumari et al. Kaul & Awasthi Proposed [9] [10] [12] [13] [14] scheme Registration phase 3TH+2T⊕ 7TH+5T⊕ 2TH+1T⊕ 4TH+5T⊕ 6TH+3T⊕ 6TH+3T⊕ Login phase 2TH+4T⊕ 5TH+3T⊕ 4TH+3T⊕ 5TH+10T⊕ 8TH+12T⊕ 6TH+3T⊕ Authentication phase 7TH+8T⊕+4TM 17TH+16T⊕ 6TH+2T⊕ 7TH+3T⊕ 6TH+9T⊕ 8TH+6T⊕ PW change phase – 7TH+6T⊕ 12TH+8T⊕ 5TH+6T⊕ 8TH+12T⊕ 7TH+3T⊕ Total cost 12TH+14T⊕+4TM 36TH+31T⊕ 24TH+14T⊕ 21TH+24T⊕ 28TH+36T⊕ 27TH+15T⊕ Execution time 2.094 s 0.018 s 0.012 s 0.0105 s 0.014 s 0.0135 s Memory capacity 640 bits 896 bits 384 bits 768 bits 640 bits 512 bits Exchange cost 896 bits 1080 bits 768 bits 896 bits 768 bits 768 bitsWe also analyze the memory capacity of smart card and estimate the message exchange cost. Based on [13], we assume that output length of all values, such as IDi, PWi, T,Ts, h(·),H(·), and random numbers, is 128 bits long. As shown in Table 3, in Kaul ans Awasthi’s scheme [14], the memory capacity of smart card {βi,h(·),γi,χi,ηi} requires (5 × 128) = 640 bits. The communication message consists of two packets: login request ωi,ϑi,IDi,T and authentication request μi,Ts. Thus, message exchange cost of Kaul and Awasthi’s scheme is (6 × 128) = 768 bits. In our proposed scheme, the smart card {βi,h(·),H(·),γi,ηi} requires (5 × 128) = 640 bits, and the messages composed of ωi,ϑi,χi,γi and μi,νi require (6 × 128) = 768 bits. In conclusion, the results show that the memory capacity and communication overhead of our proposed scheme are relatively better as those of the other schemes [9, 10, 13]. In addition, the proposed technology can defend against a variety of existing attacks. This is shown in Table 2.


## 9. Conclusions

In this paper, we demonstrate that Kaul and Awasthi’s scheme includes some critical vulnerabilities, and we propose an extended version to overcome these defects. Our proposed scheme has been thoroughly estimated in terms of a variety of security features. In addition, the performance comparison for the proposed scheme in relation to the other studies has been analyzed, and we conclude that the proposed scheme properly considers the efficiency and robustness.



---

*Source: 9046064-2018-06-20.xml*