  The rapid development of information and network technologies motivates the
emergence of various new computing paradigms, such as distributed computing,
and edge computing. This also enables more and more network enterprises to
provide multiple different services simultaneously. To ensure these services
can conveniently be accessed only by authorized users, many password and smart
card-based authentication schemes for multi-server architecture have been
proposed. In this paper, we review several dynamic ID-based password
authentication schemes for multi-server environments. New attacks against four
of these schemes are presented, demonstrating that an adversary can impersonate
either legitimate or fictitious users. The impact of these attacks is the
failure to achieve the main security requirement: authentication. Thus, the
security of the analyzed schemes is proven to be compromised. We analyze these
four dynamic ID-based schemes and discuss the reasons for the success of the
new attacks. Additionally, we propose a new set of design guidelines to prevent
such exploitable weaknesses on dynamic ID-based authentication protocols.
Finally, we apply the proposed guidelines to the analyzed protocols and
demonstrate that violation of these guidelines leads to insecure protocols.
