Advertisement
Browse Subject Areas
?

Click through the PLOS taxonomy to find articles in your field.

For more information about PLOS Subject Areas, click here.

  • Loading metrics

Open Access

Peer-reviewed

Research Article

A robust anonymous biometric-based authenticated key agreement scheme for multi-server environments

  • Hua Guo ,

    Contributed equally to this work with: Hua Guo, Pei Wang, Xiyong Zhang

    Roles Conceptualization, Formal analysis, Funding acquisition, Writing – review & editing

    Affiliation Beijing Key Laboratory of Network Technology, Beihang University, Beijing 100191, China

    ⨯
  • Pei Wang ,

    Contributed equally to this work with: Hua Guo, Pei Wang, Xiyong Zhang

    Roles Investigation, Methodology, Writing – original draft

    Affiliations Beijing Key Laboratory of Network Technology, Beihang University, Beijing 100191, China, National computer network and information security laboratory, National Computer network Emergency Response technical Team/Coordination Center, Beijing 100029, China

    ⨯
  • Xiyong Zhang ,

    Contributed equally to this work with: Hua Guo, Pei Wang, Xiyong Zhang

    Roles Conceptualization, Investigation, Supervision

    09384@buaa.edu.cn

    Affiliation State Key Laboratory of Space-Ground Integrated Information Technology, Beijing 100020, China

    ⨯
  • Yuanfei Huang,

    Roles Investigation, Resources

    Affiliation National computer network and information security laboratory, National Computer network Emergency Response technical Team/Coordination Center, Beijing 100029, China

    ⨯
  • Fangchao Ma

    Roles Investigation, Resources

    Affiliation Beijing information technology institute, Beijing 100094, China

    ⨯

Abstract

In order to improve the security in remote authentication systems, numerous biometric-based authentication schemes using smart cards have been proposed. Recently, Moon et al. presented an authentication scheme to remedy the flaws of Lu et al.’s scheme, and claimed that their improved protocol supports the required security properties. Unfortunately, we found that Moon et al.’s scheme still has weaknesses. In this paper, we show that Moon et al.’s scheme is vulnerable to insider attack, server spoofing attack, user impersonation attack and guessing attack. Furthermore, we propose a robust anonymous multi-server authentication scheme using public key encryption to remove the aforementioned problems. From the subsequent formal and informal security analysis, we demonstrate that our proposed scheme provides strong mutual authentication and satisfies the desirable security requirements. The functional and performance analysis shows that the improved scheme has the best secure functionality and is computational efficient.

Citation: Guo H, Wang P, Zhang X, Huang Y, Ma F (2017) A robust anonymous biometric-based authenticated key agreement scheme for multi-server environments. PLoS ONE 12(11): e0187403. https://doi.org/10.1371/journal.pone.0187403

Editor: Muhammad Khurram Khan, King Saud University, SAUDI ARABIA

Received: April 12, 2017; Accepted: September 25, 2017; Published: November 9, 2017

Copyright: © 2017 Guo et al. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.

Data Availability: All relevant data are within the paper.

Funding: This research was supported by the National Natural Science Foundation of China (No. 61300172, 61572027, 61402037), http://www.nsfc.gov.cn/. The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript.

Competing interests: The authors have declared that no competing interests exist.

1 Introduction

Nowadays security has becoming an urgent issue for the distributed networks. The remote user authentication scheme allows the transmission of secret data via public channels, thus is an important cryptographic tool for distributed networks. In 1981, Lamport [1] proposed the first password-based authentication scheme. After that, considerable amount of work on password-based authentication schemes have been put forward for different applications [2, 3]. However, passwords are vulnerable to be broken in a short time by using dictionary guessing attack. To solve this problem, smart cards with password-based authentication schemes [4–12] are introduced to enhance the security of user authentication. Unfortunately, there are still some problems when the smart card is stolen and the stored data is leaked [13–15].

The biometric keys, such as fingerprint and iris, are considered to be a unique identifier of a user, thus have many advantages. For example, the biometric keys cannot be forgotten or lost, are difficult to copy or share, and are not easy to forge or guess. Additionally, one can carry biometric keys at anytime and from anywhere. With the security requirements of the distributed networks and the good security performance and advantages of the biological characteristic, biometrics authentication protocols come to be more crucial and widely deployed [16–36]. In 2002, Lee et al. [16] designed the first biometrics-based remote user authentication scheme. In 2004, Lin-Lai [17] demonstrated that Lee et al.’s scheme cannot resist impersonation attack and designed a protocol without verification table to fix the flaws of Lee et al.’s scheme. In 2007, Khang-Zhang [18] pointed out that Lin-Lai’s scheme is insecure against server spoofing attack and illustrated an improved scheme. Rhee [19] demonstrated that Khang-Zhang’s scheme is vulnerable to impersonation attack and offline password guessing attack. Later, Li-Wang [20] designed an efficient three-factor remote user authentication scheme which only uses symmetric cryptographic primitive and the hash operation. However, in 2011, Das [21] exhibited that Li-Wang’s scheme is insecure against man-in-the-middle attack and does not provide proper certification. Furthermore, he designed a new certification scheme based on biometric characteristics. In 2014, Li et al. [25] pointed out that Das et al.’s scheme is vulnerable to forgery attack and stolen smart card attack, and put forward a three-factor remote user authentication scheme. After that, Chaturvedi et al. [26] demonstrated that Li et al.’s scheme doesn’t resist known session specific temporary information attack and doesn’t protect user’s privacy. They also proposed a novel authentication and key agreement protocol to overcome the weaknesses of Li et al.’s scheme.

In 2014, Chuang-Chen [27] proposed an efficient lightweight three-factor authentication protocol for multi-server environment which requires only the hash operation. After that, Mishra et al. [28] showed that Chuang-Chen’s scheme is insecure against the denial-of-service attack, smart card stolen attack, server spoofing attack and impersonation attack. In addition, they proposed a new biometric-based multi-server authentication protocol so as to overcome the weaknesses of Chuang-Chen’s scheme. In 2015, Lu et al. [29] illustrated that Mishra et al.’s scheme is insecure against server spoofing attack and impersonation attack, and can not provide forward secrecy. They introduced two independent three-factor authentication schemes [29, 31] for multi-server architecture, and claimed that the improved scheme has strong security. Unfortunately, Moon et al. [30] showed that Lu et al.’s scheme [29] is vulnerable to outsider attack and user impersonation attack, and put forward an enhanced protocol which fixes the flaws of Lu et al.’s scheme.

Unfortunately, we found that Moon et al.’s biometric-based remote user authentication scheme still has some flaws. In this paper, we firstly showed that Moon et al.’s scheme is vulnerable to insider attack, server spoofing attack, user impersonation attack and guessing attack. Moreover, we exhibited that their scheme is not anonymous for the user. Then we proposed an improved authentication scheme for multi-server environment to fix their design flaws. After that, we show that our scheme is robust against all known attacks through the formal and informal security analysis. Finally we demonstrate that the improved scheme has the best secure functionality and is computational efficient.

The rest of the paper is organized as follows. In section 2, we introduce some preliminary knowledge. Section 3 briefly reviews Moon et al.’s biometric-based remote user authentication scheme. Section 4 shows the design flaws in Moon et al.’s scheme. In order to eliminate the shortcomings discussed in section 4, we propose an enhancement authentication protocol in section 5. Section 6 analyzes the security of the proposed scheme, and Section 7 compares the performance of the enhanced scheme with other related schemes. Finally, we conclude in section 8.

2 Preliminaries

This section elaborates the definitions of one-way hash function and BioHashing, and the security model.

2.1 Definition

One-way hash function. A one-way hash function h: {0, 1}* → {0, 1}n takes an arbitrary-length input x ∈ {0, 1}*, and produces a fixed-length output h(x) ∈ {0, 1}n, called the message digest. The hash function has the following attributes:

  • Computationally, it is easy to compute y = h(x) if x and h(⋅) are specified.
  • It is almost impossible through polynomial time t to know two inputs x1 and x2, such that h(x1) = h(x2).

BioHashing. BioHashing technique [37] is designed to reduce the probability of denial of access while keeping the false acceptation performance. Inputing the biometric feature set and a seed which represents the “Hash key”, BioHashing generates a vector of bits. More precisely, with the help of a uniform distributed pseudo-random numbers generated by giving a secret seed, the biometric vector data x ∈ Rn is reduced down to a bit vector b ∈ {0, 1}l with l the length of the bit string (l ≤ n) through BioHashing.

2.2 Security model

In this paper, we adopt the security model proposed by Abdalla et al. [38] to prove the security of our protocol.

  • Participants. An oracle denotes an instance t of a party Sj, denotes the instance u of Ui, and denotes the instance v of RS.
  • Partnering. The partner of an instance of Ui is the instance of Sj and conversely. The partial transcript of all exchanged messages between Ui and Sj is unique, and is said as a session ID for the present session in which participates.
  • Freshness. or is fresh, only if the session key SK is not leaked to .
  • Adversary. In the ROR model, models the real attack via the following oracle queries. To breach the security of the authentication protocol, is able to access the queries given below:
    • Execute(πt, πu): The Execute query helps obtain the messages transmitted between two honest participants; this query models an eavesdropping attack.
    • Send(πt; x): The Send query corresponds to an active attack. πt executes the protocol and responds with an outgoing message after receiving a message x from .
    • Reveal(πt): The executes Reveal query to reveal of session keys. If the session has been accepted, πt returns the session key SK as its response that is computed between πt and its partner, otherwise returns a null value.
    • CorruptSC(πt): It is about modeling smart card loss attack and outputs the information stored in SCi.
    • Test(πt): At some point, the adversary can make a Test query to an oracle Πt. Πt flips an unbiased coin b and responds with the real agreed session key SK if SK is established and fresh, if b = 1; otherwise it returns a random sample generated according to the distribution of the session key. Otherwise, it returns ⊥.

Semantic security of the session key. In an experiment, the adversary is challenged to differentiate between an instance’s real session key SK and a random key. can continue querying Test queries to either the server instance or the user instance. The outcome of Test query must be consistent with the random bit b. Eventually, terminates the game simulation and outputs a bit b′ for b. we say wins if the adversary guesses the correct b.

Let E denotes the event that wins the game. Then, the advantage of breaches the semantic security of our proposed authenticated key-agreement (AKE) protocol, say , is computed as . We say that the protocol is a secure multi-server authentication and key agreement protocol in the ROR sense if is negligible.

Random oracle. To prove the security of the proposed protocol, the one-way hash function h(⋅) is treated as a random oracle(say Hash oracle), and is provided to the adversary and every participant. The Hash oracle is simulated by a two-tuple (u, v) table of binary strings. When a hash query h(u) is made, the Hash oracle returns v if u is found in the table; otherwise, it returns a uniformly random string v and stores the pair (u, v) in the table.

3 Review of Moon et al.’s scheme

In this section, we briefly review Moon et al.’s scheme, which consists of four phases: registration phase, login phase, authentication phase and password change phase. Table 1 summarizes the notations used in this paper.

thumbnail
Download:
Table 1. Notations.

https://doi.org/10.1371/journal.pone.0187403.t001

3.1 Registration phase

The registration and authentication phases are shown in Fig 1. In order to get the access to different services provided by the servers, a user must register himself through the registration server. Ui firstly selects an identity IDi and password PWi and inputs biometrics BIOi.

thumbnail
Download:
Fig 1. Registration and authentication phases of Moon et al.’s scheme.

Registration and authentication phases of Moon et al.’s scheme.

https://doi.org/10.1371/journal.pone.0187403.g001

  1. Using the password and the biometrics, the smart card computes PWDi = h(PWi||H(BIOi)) and sends < IDi, PWDi > to the registration server through a secure channel.
  2. Upon receiving the message < IDi, PWDi >, the registration server computes Vi = h(IDi||PWDi), Wi = h(yi||PSK) ⊕ IDi, Xi = h(IDi||x), Yi = yi⊕ h(PSK). Then RS stores < Vi, Wi, Xi, Yi, h(⋅), H(⋅) > onto a smart card and sends the smart card to Ui.

3.2 Login phase

During the login phase, the user Ui inserts his smart card into the smart card reader, inputs his identity IDi and password PWi, and imprints biometric information BIOi. Upon receiving an input, the smart card uses the following steps to perform a login session:

  1. The smart card computes PWDi = h(PWi||H(BIOi)) and verifies Vi? = h(IDi|| PWDi). If succeeds, it executes the next step. Otherwise the session aborts.
  2. The smart card generates a random number n1 and computes K = h((Wi ⊕ IDi)|| SIDj), M1 = IDi ⊕ K, M2 = n1 ⊕ K, M3 = PWDi ⊕ K, Zi = h(Xi||n1|| PWDi||Ti).
  3. The smart card transmits the login request message < Yi, Zi, M1, M2, M3, T1 > to the server Sj through a public channel, where T1 is the current timestamp.

3.3 Authentication phase

After receiving the authentication request < Yi, Zi, M1, M2, M3, T1 > from the user Ui, the server Sj executes the following steps to authenticate each other.

  1. The server Sj firstly checks whether |Tc − T1| < ΔT, then uses its pre-shared key PSK and achieves yi = Yi ⊕ h(PSK). The server also retrieves K = h(h(yi||PSK)||SIDj), n1 = M2 ⊕ K, IDi = M1 ⊕ K, PWDi = M3 ⊕ K, Xi = h(IDi||x) and verifies Zi? = h(Xi||n1||PWDi||T1). If they are not equal, Sj rejects the login request and terminates the session. Otherwise, the server generates a random number n2 and computes M4 = n2 ⊕ h(n1||PWDi||Xi), M5 = h(IDi||n1||n2||K||T2), SKij = h(n1||n2||K||T2) and then responds with the message < M4, M5, T2 > to the smart card (user Ui) over a public channel.
  2. Upon receiving the message < M4, M5, T2 > and checking the freshness of T2, the smart card retrieves the value n2 = M4 ⊕ h(n1||PWDi||Xi). Then it verifies M5? = h(IDi||n1||n2||K||T2). If the verification holds, it computes the session key SKij = h(n1||n2||K||Xi), which would be shared between Ui and Sj. Finally, the smart card computes M6 = h(SKij||IDi||n2||T3) and sends the message < M6, T3 > to Sj via a public channel.
  3. Upon receiving the message < M6, T3 >, Sj checks the freshness of T3 and verifies h(SKij||IDi||n2||T3)? = M6. If the equation holds, the server ensures the identity of Ui. Otherwise, the server aborts the session.

3.4 Password updating

In this phase, Ui can change his password any time when he wants. In order to change password, the user performs the following steps:

  1. Ui inserts his smart card into the smart card reader and then inputs IDi and PWi and biometrics BIOi.
  2. The smart card SCi computes PWDi = h(PWi||H(BIOi)), then checks if Vi′ = h(IDi||PWDi) is the same as the stored Vi. If they are the same, SCi accepts Ui to enter a new password .
  3. SCi computes and , and replaces Vi with .

4 Security analysis of Moon et al.’s scheme

Although Moon et al. claimed that their scheme satisfies the required security requirements, we found that their scheme still has some weakness, i.e., fail to resist the insider attack, server spoofing attack, guessing attack and impersonation attack. Moreover, their scheme is not anonymous for users.

4.1 Lack of user anonymity

User anonymity means that the adversary cannot obtain or track the identity of the user according to the message transmitted via the public channel, which is an important property to protect the privacy of users. In Moon et al.’s scheme, during authentication phase, Ui sends < Yi, Zi, M1, M2, M3, T1 > as authentication request message to Sj. Note that all the information transmitted in public channel can be intercepted by the adversary. The parameter M1 = K ⊕ IDi where K = h((Wi ⊕ IDi)||SIDj)) in the message < Yi, Zi, M1, M2, M3, T1 >, is unique and static for each user during all logins to the same server. Thus anyone has ability to track the activities of a legal user, if he captures the value of M1.

4.2 Insider attack

Insider attack means that an insider can get the sensitive credentials from the information stored in RS. In Moon et al.’s scheme, during user registration phase, Ui submits his identity IDi and PWDi to RS. In order to prevent duplicate user registration, RS has to store the user’s ID. If an adversary obtains the list of ID, it would cause great devastation. The adversary can impersonate himself as Ui as described in the following user impersonation attack.

4.3 Server spoofing attack

In Moon et al.’s protocol, RS shares the same secret information (x, PSK) with all the application severs. The compromised sever can impersonate as another legitimate server to deceive any legal user. Now we show the reason why Moon et al.’s scheme cannot withstand this kind of server spoofing attack.

  1. When Ui submits his login request message < Yi, Zi, M1, M2, M3, T1 > to Sj, the legal but malicious server Sk can intercept this message and compute yi = Yi ⊕ h(PSK), K = h(h(yi||PSK)||SIDj), n1 = M2 ⊕ K, IDi = M1 ⊕ K, PWDi = M3 ⊕ K, Xi = h(IDi||x) and to check Z? = h(Xi||n1||PWDi||T1).
  2. Sk generates a random number n2 and computes M4 = n2 ⊕ h(n1||PWDi||Xi), M5 = h(IDi||n1||n2||K||T2), SKij = h(n1||n2||K||T2), then sends < M4, M5, T2 > to Ui.
  3. Ui computes n2 = M4 ⊕ h(n1||PWDi||Xi), M5 = h(IDi||n1||n2||K||T2) and compares it with M5. It is obvious that the values are the same, thus Ui responds with the message M6 = h(SKij||IDi||n2||T3).
  4. Ui computes the session key SKij = h(n1||n2||K||T2) and believes that he is communicating with Sj.

Therefore, a legal but malicious server Sk can masquerade as another server Sj to fool any legal user and Moon et al.’s scheme is vulnerable to server spoofing attack.

4.4 Guessing attack

Moon et al.’s scheme is vulnerable to identity guessing attack, which is a critical concern in their scheme. If the adversary can extract the secret value Wi from the legal user’s smart card by some means and get the value of M1 from public channel, the adversary can easily find out by performing the guessing attack, in which each guess IDi can be verified as the following steps.

  1. The adversary chooses and computes .
  2. The adversary verifies the correctness of by checking .
  3. The adversary repeats the above steps until a correct is found.

4.5 User impersonation attack

In a remote user communication scheme, anyone should be considered as a legal user if a user has valid authentication credentials or could be capable of constructing an effective authentication request message. In Moon et al.’s protocol, an adversary can impersonate a valid user as described below.

  1. As enlightened in insider attack and guessing attack mentioned above, an adversary obtains Ui’s personal identifiable information IDi. He also extracts the secret values Wi and Xi from the legal user’s smart card by some means.
  2. The adversary intercepts a valid login request message < Yi, Zi, M1, M2, M3, T1 > which is sent from IDi via the public channel, then the adversary computes K = IDi ⊕ M1, PWDi = K ⊕ M3, chooses random number n1, and calculates M1m = IDi ⊕ K, M2m = n1 ⊕ K, M3m = PWDi ⊕ K, Zim = h(Xi||n1||PWDi|| . Now, the malicious adversary sends the forged login request message < Yi, to Sj by masquerading as legal user Ui.
  3. After the authentication of the login request message, the server Sj generates a random number n2, computes M4m = n2 ⊕ h(n1||PWDi||Xi), M5m = h(IDi||n1 ||n2||K||T2) and responds with the message < M4m, M6m, T2 > to the adversary who is masquerading as Ui.
  4. The masquerading adversary verifies the correctness of M4m with the values of n1 and K. Then the masquerading user Ui computes n2 = M4m ⊕ h(n1||PWDi||Xi), SKij = h(n1||n2||K||T2), M6m = h(SKij||IDi||n2||T3), and sends the message < M6m, T3 > back to the server Sj.
  5. The server Sj computes M6m = h(SKij||IDi||n2||T3) and verifies it with the received value of M6m. It is obvious that they are equal, so the sever authenticates successfully the legitimacy of the user Ui and the login request message information is accepted.
  6. After mutual authentication, the server Sj and the malicious adversary who masquerades as the user Ui agree on the common session key as SKij = h(n1|| n2||K||Xi).

5 Our proposed scheme

In this section, we propose an improved remote user authentication scheme to fix the drawbacks in Moon et al.’s scheme. Our proposed protocol consists of four phases: registration, login, mutual authentication with key-agreement and password change. Fig 2 describes our proposed scheme.

thumbnail
Download:
Fig 2. Registration and authentication phases of our scheme.

Registration and authentication phases of our scheme.

https://doi.org/10.1371/journal.pone.0187403.g002

5.1 Registration phase

When the remote user authentication scheme starts, the user Ui and the server Sj need to perform the following steps to register with the registration server(RS).

5.1.1 Server registration.

To register with the system, a server Sj submits his identity SIDj and his public key Pubj which can be obtained by all the users. Then Sj sends his identity SIDj and his public key Pubj to RS. Upon reception, RS shares the secret key PSK with Sj and publishes Sj’s public key Pubj.

5.1.2 User registration.

  1. Ui freely selects his identity IDi which uniquely identifies the user’s identity, password PWi and scans his biometrics BIOi. Then Ui computes IDBi = h(IDi ||H(BIOi)), PWDi = h(PWi||H(BIOi)) and sends < h(IDi), IDBi, PWDi > to RS on a secure channel.
  2. Upon reception, RS computes Vi = h(h(IDi)||PWDi), Wi = h(h(IDi)||PSK) ⊕ IDBi and stores < Vi, Wi, h(⋅), H(⋅) > in the smart card SC.
  3. RS sends SC to Ui over a secure channel.

5.2 Login phase

  1. Ui sends the login request by inserting smart card (SC), and inputting IDi, PWi and BIOi.
  2. SC computes PWDi = h(PWi||H(BIOi)) and then checks whether the condition Vi? = h(h(IDi)||PWDi). If the result is negative, the login session can be aborted. Otherwise, SC generates a random number n1 and computes K = h((Wi ⊕ IDBi) ⊕ h(IDi||n1)), , Zi = h(n1||IDi||K||T1) and sends < M1, Zi, T1 > to the server Sj as the login request message.

5.3 Authentication phase

  1. On getting login message, Sj checks freshness of T1. Sj computes (IDi||n1) = , K = h(h(h(IDi)||PSK) ⊕ h(IDi||n1)) and verifies if Zi? = h(n1|| IDi||K||T1). If they are same, Sj authenticates Ui. Otherwise the session is terminated.
  2. Sj further generates a random number n2, and computes M2 = n2 ⊕ K, M3 = h(IDi||n1||n2||K||T2), SKij = h(n1||n2||K||IDi). Sj sends < M2, M3, T2 > to SC.
  3. On checking the freshness of T2, SC computes n2 = M2 ⊕ K and verifies the condition M3? = h(IDi||n1||n2||K||T2). If the condition holds, Ui authenticates Sj. Otherwise the process is terminated. Then, SC computes SKij = h(n1||n2 ||K||IDi) and M4 = h(SKij||IDi||n2||T3), then sends < M4, T3 > to Sj.
  4. Sj checks the freshness of T3. Sj verifies M4? = h(SKij||IDi||n2||T3) and reconfirms the authenticity of Ui. Now, Ui and Sj share with the computed session key SKij = h(n1||n2||K||IDi) for further communication.

5.4 Password changing phase

This procedure is invoked whenever a user (Ui) wants to update his password with a new password , without through a private channel or communicating with RS.

  1. Ui inserts smart card SC and inputs IDi, PWi and BIOi.
  2. SC computes PWDi = h(PWi||H(BIOi)) and then verifies the condition Vi? = h(IDi||PWDi). If the condition doesn’t hold, the request can be dropped.
  3. Ui chooses a new password and then computes , . Thus the smart card finally contains the parameters .

6 Security analysis of the proposed scheme

In this section, we use Burrows-Abadi-Needham logic (BAN-logic) [39] to verify the completeness of our scheme, then we prove the security of the scheme through formal and informal analysis.

6.1 Verifying the proposed scheme with BAN logic

The BAN logic introduced by Burrows et al. is a formal method of analyzing the security features of the information exchange protocol. It helps determine whether the exchanged information is credible, whether it can prevent eavesdropping or both. In this paper, we use BAN logic to prove that a user and a server share a session key after successfully running the protocol. We first introduce the BAN logic notations used in this paper in Table 2.

thumbnail
Download:
Table 2. BAN logic notations.

https://doi.org/10.1371/journal.pone.0187403.t002

  1. BAN logical postulates
    1. Message-meaning rule: : If P believes that K is the shared key of P and Q, and P receives the message X encrypted with K, then P believe that Q has sent message X.
    2. Jurisdiction rule: : If P believes that Q has the right to control X and P believes that Q also trusts X, then P trusts X.
    3. Nonce-verification rule: : If P believes that X is fresh and P believes that Q has sent X, then P believes that Q believes X.
    4. Freshness-conjuncatenation rule: : If P believes that X is new, then the information of (X, Y) is also fresh.
    5. Belief rule: : If P believes X and Y, then P believes (X, Y).
  2. Establishment of security goals
    1. g1:
    2. g2:
    3. g3:
    4. g4:
  3. Initiative premises
    1. p1. Ui| ≡ #n1. p2. Ui| ≡ Sj ⇒ #n2.
    2. p3. Sj| ≡ #n1. p4. Sj| ≡ #n2.
    3. p5. . p6. .
    4. p7. Ui| ≡ IDi. p8. Sj| ≡ Ui ⇒ IDi.
    5. p9. . p10. .
  4. Scheme analysis
    1. a0.
      Since , only Sj can get the value of IDi and n1. One can get the value of K unless he has the true Prij and PSK at the same time.
    2. a1. Sj ⊲ (n1, IDi, T1)K, T1
      We employ Message-meaning rule according to p5 and a1 to drive:
    3. a2. Sj| ≡ Ui| ∼ (n1, IDi, T1)
      According to a2 and p3, we apply the Freshness-conjuncatenation rule and Nonce-verification rule to get the following information:
    4. a3. Sj| ≡ Ui| ≡ (n1, IDi, T1)
      According to a3 and p8, we employ Jurisdiction rule and belief rule to obtain:
    5. a4. Sj| ≡ IDi
      According to a4 and , we employ Message-meaning rule to obtain:
    6. a5.
      According to a5 and p4, we apply Nonce-verification rule and Freshness- conjuncatenation rule to obtain:
    7. a6.
      Finally, we employ The belief rule to obtain:
    8. g1. .
      According to g1 and p9, we utilize Jurisdiction rule to obtain:
    9. g2. .
      According to p6 and Ui ⊲ (IDi, n1, n2, T2)K, we employ Message-meaning rule to obtain:
    10. a7. Ui| ≡ Sj| ∼ (IDi, n1, n2, T2)
      According to a7 and p1 we apply Nonce-verification rule and Freshness- conjuncatenation rule to derive:
    11. a8. Ui| ≡ Sj| ≡ (IDi, n1, n2, T2)
      According to a8 and p1, p3, p4, p6 and SKij = h(n1||n2||K||IDi), we apply Freshness-conjuncatenation rule and Nonce-verification rule to derive:
    12. g3. .
      According to g3 and p10 we utilize Jurisdiction rule to obtain:
    13. g4. .

6.2 Formal analysis

We use provable security to prove the security of our scheme. The security proof is based on the model of RSA-based password authentication.

Theorem 1. Let be an adversary that run in polynomial time t against our protocal in the random oracle, D be a uniformly distributed password dictionary and l denotes the number of bits in the biometric key BIOi, |Hash| and|D| denotes the range space of hash function and the size of D, respectively. If an attacker makes qh Hash queries, qsend Send queries, then, the advantage of of breaking the SK-security of is , where AdvRSA(t) is the advantage that an adversary solves the problem about the factor decomposed of great number.

Proof. The proof is finished by executing a sequence of hybrid games Gi. For each game Gi, let Ei denote the event that the adversary succeeds in guessing the bit b in game Gi.

Game G0: This game corresponds to the real attack in the random oracle model. Thus, we can write (1)

Game G1: By querying Execute oracle, this game simulates ’s eavesdropping attack. After that, the adversary queries Test oracle, and decides whether the outcome of the Test oracle is the real session key SK or a random number, where SKij is computed from SKij = h(n1||n2||K||IDi). Note that PSK and IDBi are secret to Sj and Ui. The adversary has no knowledge about PSK, IDBi and IDi, thus eavesdropping of message can not increase the chance of winning for the adversary in G1. So we have (2)

Game G2: The difference between G2 and G1 is that we add the simulations of the Send and the Hash oracles. G2 models an active attack where tries to decide a participant into accepting a forged message. can make several Hash queries to find the collisions. Note that the messages {M1, Zi, T1} and {M2, M3, T2} are associated with timestamp T1, T2, random numbers n1 and n2, and IDi of Ui, hence there is no collision when querying the Send oracle. According to the birthday paradox, we have (3)

Game G3: In this game, G3 simulates the CorruptSC oracle which models the smart card lost attack. Since the chosen password has low entropy, may try online dictionary attack with the information obtained from the smart card. In addition, may try to obtain biometrics key Bi from information collected from the smart card SCi. Our protocol uses BioHash, which extracts at most l nearly random bits, therefore the probability of guessing biometric key Bi ∈ {0, 1}l by is approximated as . If the number of wrong password inputs is limited by the system, probabilities can be estimated as follows: (4)

Game G4: This game models an attack wherein has to compute the real session key SKij = h(n1||n2||K||IDi) using K, IDi from the eavesdropping messages {M1, Zi, T1} and {M2, M3, T2}. can not compute K = h((Wi ⊕ IDBi) ⊕ h(IDi||n1)) and as IDi, Prij and IDBi are unknown. also needs to derive n1 and n2 from M1 and M2, respectively. We then have (5)

Additionally, since all session keys are random and independent and no information about the value of c is revealed to , Then, (6)

From Eqs (1)–(6), the following result is obtained: (7)

6.3 Informal security analysis

This subsection describes the security analysis of our scheme. To evaluate the security of the improved scheme, we assume that the adversary might access the smart card of legal user and extract the information stored in the smart card and intercept information transmitted over the public channel.

6.3.1 Mutual authentication.

After receiving the login request information from Ui, Sj checks if Zi? = h(n1||IDi ||K||T1) holds or not. The adversary who masquerades as the legal user cannot forge Zi without knowing IDi and the biometrics BIOi of Ui. Likewise, upon receiving the message M3, Ui checks M3? = h(IDi||n1||n2||K||T2), where K = h(h(h(IDi)|| PSK) ⊕ h(IDi||n1)), which requires the computation of Ui’s identity IDi, the random number n1 and PSK. Only the server who has the private key Prij can compute IDi and n1 so as to get the value of K. Hence only legal user can share the session key with corresponding server. Therefore, our proposed scheme can provide proper mutual authentication.

6.3.2 Anonymity.

In the proposed scheme, the login request message < M1, Zi, T1 > is dynamic for every login and does not disclose any information about Ui, since it is associated with random number n1. The identity is protected by the encrypted message using Pubj. The adversary cannot obtain IDi without having the knowledge of Prij. In addition, the unauthorized server cannot decrypt the user’s authentication message successfully since it does not own the private key Prij. As a result, the user’s real identity cannot be retrieved. Thus our protocol can achieve the anonymity property of users as well as protect the privacy of users.

6.3.3 Off-line password guessing attack.

An adversary may try to guess the password PWi from the extracted smart card stored parameters < Vi, Wi, h(⋅), H(⋅) >. The stored parameter contains the password PWi in the form Vi = h(h(IDi)||PWDi) where PWDi = h(PWi||H(BIOi)). An adversary attempts to verify the condition Vi? = h(h(IDi)||h(PWi||H(BIOi)) while constantly guessing PWi. Adversary needs the value of IDi and BIOi of Ui in order to achieve the password guessing attack. However, the value of BIOi is nowhere stored and an adversary cannot get the value of IDi without knowing the private key Prij. As a result, the adversary cannot guess the correct password PWi. Therefore, our proposed improved protocol can withstand this kind of attack.

6.3.4 Insider attack.

In our proposed protocol, Ui does not send his IDi, password PWi or his biometrics BIOi in plain text during user registration phase. Ui submits only h(IDi), IDBi and PWDi to RS instead of original credentials, where PWDi = h(PWi||H(BIOi)), IDBi = h(IDi||H(BIOi)). Hence, an insider cannot obtain the original sensitive information of any user. On the other hand, the authentication of entities is being done by verifying message like Zi? = h(n1||IDi||K||T1) in which IDi is necessary. Moreover, RS doesn’t participate in the authentication process. Therefore, the proposed protocol attains resistance to insider attack.

6.3.5 Stolen smart card attack.

The adversary can extract the information < Vi, Wi, h(⋅), H(⋅) > stored in the smart card by means of power analysis. Assume a legal user’s smart card is stolen by an adversary and the stored information < Vi, Wi, h(⋅), H(⋅) > on it are extracted. Then, the adversary may try to get IDi, PWi, BIOi from the extracted information. However, adversary cannot obtain any valuable information from these values, where Vi = h(h(IDi)||PWDi) and Wi = h(h(IDi)||PSK) ⊕ IDBi, since all the important parameters such as IDi and PWi are protected by a one-way hash function. The adversary cannot obtain any login information using the smart card stored parameters Vi and Wi. At the same time guessing the real identity IDi and password PWi is impractical. Therefore, the proposed protocol is secure against smart card stolen attack.

6.3.6 Replay attack.

If an adversary has intercepted all the communication message < M1, Zi, T1 > and < M2, M3, T2 >, he tries to replay them to Ui or Sj to masquerade as a legal user. However, once the message is replayed, the server can immediately detect the attack and reject the request due to the apply of timestamp. Hence, our scheme is secure against replay attack.

6.4 No verification table

In the proposed scheme, the registration server and application servers do not store the password and the biometrics database of the user. Therefore, even if an adversary steals the information stored in RS, he still cannot get IDi, PWi, BIOi or other valid information of users. Sj does not store the password or the biometrics table of users as well. Therefore, even if an adversary steals the database from RS, he still cannot obtain user’s sensitive information of users.

6.4.1 User masquerade attack.

Assume an adversary steals a smart card from a legal user and wants to get service by perpetrating user impersonation attack. If an adversary forges messages so as to impersonate as Ui, he needs to build a login request message < M1, Zi, T1 > firstly, where , Zi = h(n1||IDi||K||T1). Conversely, the adversary cannot compute the messages M1 and Zi without user’s private information IDi and H(BIOi). At the same time, the adversary has to go through login phase before sending login request information. During login phase, SC computes PWDi = h(PWi||H(BIOi)) and then verifies if Vi? = h(IDi||PWDi) is correct. Unless the adversary enters the correct credentials, the process will be terminated. Therefore, the adversary certainly requires IDi, PWi and BIOi for any furthermore computations. However, the probability of obtaining correct IDi, PWi and BIOi is negligible.

6.4.2 Server impersonation attack.

Unlike Moon et al.’s protocol, the server Sj not only keeps unique long-term key PSK, but also contains the key pair < Pubj, Prij >. Note that the key pair of each server is distinctive, and Prij is known to only server Sj. Consider a scenario where an adversary captures < M1, Zi, T1 > and tries to impersonate valid server by responding with message < M2, M3, T2 >. The values of IDi, K and n1 are prerequisite. However, adversary cannot yield either of the values without having the knowledge of Prij. Though, the adversary cannot get the right values of IDi, K and n1, if the adversary forges the massage < M2, M3, T2 >. Upon receiving the response message < M2, M3, T2 >, Ui can identify it as a malicious attempt due to the non-equivalence of message . Thus, our proposed protocol is secure against server impersonation attack.

6.4.3 Forward secrecy.

In our improved protocol, the session key is SKij = h(n1||n2||K||IDi), and the values of the long term private key of the servers vary from server to server and are not shared with any registered Ui. Assume that the adversary has obtained the long term key PSK, he still cannot compute a valid session key without the secret parameters IDi and n1, which are protected by Pubj and are decryptable only with Prij. Moreover, the parameters n1 and n2 are random for each session. Therefore, the session key is considered to be safe even though the long term private key of the server is compromised.

7 Functional and performance analysis

In this section, we compare our proposed scheme with the other related schemes in term of the functionality, including Chuang et al.’s scheme, Mishra et al.’s scheme and Lu et al.’s scheme.

7.1 Functional analysis

We perform a comparative analysis of previous schemes, which is illustrated in Table 3. From the table, we can find that the proposed scheme is more secure and provides more functionality requirements than the other related schemes. Moreover, the proposed scheme achieves all resistance requirements.

thumbnail
Download:
Table 3. Functionality comparison.

https://doi.org/10.1371/journal.pone.0187403.t003

7.2 Performance analysis

Now we compare the computational costs and execution time between the proposed scheme and the other related schemes. For the evaluation of the computational costs, let Th, TRe, TRd, Tsym and Tepm refer to the execution time of one-way hash, RSA encryption, RSA decryption, symmetric key encryption/decryption operation and complexity of executing an elliptic curve point multiplication operation. According to Kilinc et al.’s [40] estimation, the average running time of Th is about 0.0023ms, TRe is 3.8500ms, TRd is 0.1925ms, Tsym is 0.1303 ms and Tepm is 2.229ms. Table 4 illustrates the comparative performance of our improved scheme and previously proposed schemes.

thumbnail
Download:
Table 4. Computation costs comparison.

https://doi.org/10.1371/journal.pone.0187403.t004

The time consumption of our proposed scheme and of the other related schemes is listed in Table 4. The results shows that the proposed scheme is the most computationally inexpensive one among those schemes based on public key cryptography [31–34]. Note that although our proposed scheme costs more time than rest of the schemes [27–30], it is more secure than these schemes. To sum up, only the proposed scheme provides both the computation efficiency to accomplish mutual authentication and key agreement, and the basic security properties against the known threats. The rest of schemes either are vulnerable to various attacks [27–31], or need more time than our scheme [31–34].

8 Conclusion

In this paper, we firstly analyzed the security of Moon et al’s scheme, and demonstrated that their scheme is vulnerable to the known internal attack, guess attack and impersonation attack. Moreover, their scheme is found not anonymous for the user. To withstand these drawbacks, we proposed an improved biometric-based authentication scheme for multi-server environment and proved that the improved scheme provides secure authentication through the formal security analysis using Burrows-Abadi-Needham logic (BAN-logic) and random oracle model. Moreover, we have shown that our scheme is robust against all known attacks through the informal security analysis. The functional and performance analysis shows that the improved scheme has the best secure functionality and is computational efficient.

References

  1. 1. Lamport L. Password authentication with insecure communication[J]. Communications of the Acm, 1981, 24(24):770–772.
  2. 2. Harn L, Huang D, Laih C S. Password authentication using public-key cryptography[J]. Computers & Mathematics with Applications, 1989, 18(12):1001–1017.
  3. 3. Shieh S P, Yang W H, Sun H M. An authentication protocol without trusted third party[J]. IEEE Communications Letters, 1997, 1(3):87–89.
  4. 4. Sun H M. An efficient remote use authentication scheme using smart cards[J]. IEEE Transactions on Consumer Electronics, 2000, 46(4):958–961.
  5. 5. Chien H Y, Jan J K, Tseng Y M. An Efficient and Practical Solution to Remote Authentication: Smart Card[J]. Computers & Security, 2002, 21(4):372–375.
  6. 6. Das M L, Saxena A, Gulati V P. A dynamic ID-based remote user authentication scheme[J]. IEEE Transactions on Consumer Electronics, 2004, 50(2):629–631.
  7. 7. Islam S H. Design and analysis of an improved smartcard-based remote user password authentication scheme[J]. International Journal of Communication Systems, 2014, 29(11):n/a–n/a.
  8. 8. Song R. Advanced smart card based password authentication protocol[J]. 2010, 32(5-6):321–325.
  9. 9. Mishra D, Chaturvedi A, Mukhopadhyay S. Design of a lightweight two-factor authentication scheme with smart card revocation[J]. Journal of Information Security & Applications, 2015, 23(C):44–53.
  10. 10. Srinivas J, Mukhopadhyay S, Mishra D. A Self-Verifiable Password Based Authentication Scheme for Multi-Server Architecture Using Smart Card[J]. Wireless Personal Communications, 2017:1–25.
  11. 11. Maitra T, Islam S H, Amin R, Giri D, Khan M K, Kumar N. An enhanced multiserver authentication protocol using password and smart card: cryptanalysis and design[J]. Security & Communication Networks, 2016, 9(17):4615–4638.
  12. 12. Amin R, Islam SH, Khan MK, Karati A, Giri D, Kumari S. A Two-factor RSA-based Robust Authentication System for Multi-Server Environments[J]. Security and Communication Networks. 2017, 13(1):74–84.
  13. 13. Messerges T S, Dabbish E, Sloan R H. Examining smart-card security under the threat of power analysis attacks[J]. IEEE Transactions on Computers, 2002, 51(5):541–552.
  14. 14. Kocher P C, Jaffe J, Jun B. Differential Power Analysis[C]// International Cryptology Conference on Advances in Cryptology. Springer-Verlag, 1999:388-397.
    • 15. Wang D, Wang P. Offline Dictionary Attack on Password Authentication Schemes Using Smart Cards[M]// Information Security. Springer International Publishing, 2015:1212-1217.
      • 16. Lee J K, Ryu S R, Yoo K Y. Fingerprint-based remote user authentication scheme using smart cards[J]. Electronics Letters, 2002, 38(12):554–555.
      • 17. Lin C H, Lai Y Y. A flexible biometrics remote user authentication scheme[J]. Computer Standards & Interfaces, 2004, 27(1):19–23.
      • 18. Khan M K, Zhang J. Improving the Security of ‘A Flexible Biometrics Remote User Authentication Scheme’[J]. Computer Standards & Interfaces, 2007, 29(1):82–85.
      • 19. Rhee H S, Kwon J O, Lee D H. A remote user authentication scheme without using smart cards[J]. Computer Standards & Interfaces, 2009, 31(1):6–13.
      • 20. Li C T, Hwang M S. An efficient biometrics-based remote user authentication scheme using smart cards[J]. Journal of Network & Computer Applications, 2010, 33(1):1–5.
      • 21. Das A K. Analysis and improvement on an efficient biometric-based remote user authentication scheme using smart cards[J]. Iet Information Security, 2011, 5(3):145–151.
      • 22. Li X, Niu J W, Ma J, Wang WD, Liu CL. Cryptanalysis and improvement of a biometrics-based remote user authentication scheme using smart cards. Journal of Network and Computer Applications, 34(1), 73-79[J]. Journal of Network & Computer Applications, 2011, 34(1):73–79.
      • 23. Li X, Niu J, Kumari S, Wu F, Wu F, Khan M K, et al. A Novel Chaotic Maps-Based User Authentication and Key Agreement Protocol for Multi-server Environments with Provable Security[J]. Wireless Personal Communications, 2016, 89(2):569–597.
      • 24. Kumari S, Das A K, Li X, Wu F, Khan M K, Jiang Q, et al. A provably secure biometrics-based authenticated key agreement scheme for multi-server environments[J]. Multimedia Tools & Applications, 2017:1–31.
      • 25. Li X, Niu J, Wang Z, Chen C. Applying biometrics to design three-factor remote user authentication scheme with key agreement[J]. Security & Communication Networks, 2014, 7(10):1488–1497.
      • 26. Chaturvedi A, Mishra D, Jangirala S, Mukhopadhyayet S. A privacy preserving biometric-based three-factor remote user authenticated key agreement scheme[J]. Journal of Information Security & Applications, 2016.
      • 27. Chuang M C, Chen M C. An anonymous multi-server authenticated key agreement scheme based on trust computing using smart cards and biometrics[J]. Expert Systems with Applications, 2014, 41(4):1411–1418.
      • 28. Mishra D, Das A K, Mukhopadhyay S. A secure user anonymity-preserving biometric-based multi-server authenticated key agreement scheme using smart cards[J]. Expert Systems with Applications, 2014, 41(18):8129–8143.
      • 29. Lu Y, Li L, Yang X, Yang Y. Robust Biometrics Based Authentication and Key Agreement Scheme for Multi-Server Environments Using Smart Cards[J]. Plos One, 2015, 10(5):e0126323 pmid:25978373
      • 30. Moon J, Choi Y, Jung J, Won D. An Improvement of Robust Biometrics-Based Authentication and Key Agreement Scheme for Multi-Server Environments Using Smart Cards.[J]. Plos One, 2015, 10(12):e0145263. pmid:26709702
      • 31. Lu Y, Li L, Peng H, Yang W. A biometrics and smart cards-based authentication scheme for multi-server environments[J]. Security & Communication Networks, 2015, 8(17):3219–3228.
      • 32. Mishra D. Design and Analysis of a Provably Secure Multi-server Authentication Scheme[J]. Wireless Personal Communications, 2016, 86(3):1–25.
      • 33. Chaudhry S A. A secure biometric based multi-server authentication scheme for social multimedia networks[M]. Kluwer Academic Publishers, 2016.
        • 34. Jiang Q, Khan M K, Lu X, Ma J, He D. A privacy preserving three-factor authentication protocol for e-Health clouds[J]. Journal of Supercomputing, 2016, 72(10):3826–3849.
        • 35. Li X, Niu J, Kumari S, Wu F, Choo KK R. A robust biometrics based three-factor authentication scheme for Global Mobility Networks in smart city[J]. Future Generation Computer Systems, 2017.
        • 36. Li X, Ibrahim M H, Kumari S, Sangaiah A K, Gupta V, Choo KK R. Anonymous mutual authentication and key agreement scheme for wearable sensors in wireless body area networks[J]. Computer Networks, 2017.
        • 37. Jin A T B, Ling D N C, Goh A. Biohashing: two factor authentication featuring fingerprint data and tokenised random number[J]. Pattern Recognition, 2004, 37(11):2245–2255.
        • 38. Abdalla M, Fouque P A, Pointcheval D. Password-Based authenticated key exchange in the three-party setting[C]// International Workshop on Public Key Cryptography. Springer Berlin Heidelberg, 2005:65-84.
          • 39. Burrows M, Abadi M, Needham R. A logic of authentication[J]. Proceedings of the Royal Society A Mathematical Physical & Engineering Sciences, 1990, 8(5):18–36.
          • 40. Kilinc H H, Yanik T. A Survey of SIP Authentication and Key Agreement Schemes[J]. IEEE Communications Surveys & Tutorials, 2014, 16(2):1005–1023.