A security enhanced user authentication scheme for multi-server environment without using smart cards

Abstract

With the popularity of internet and wireless networks, more and more network architectures are used in multi-server environment, in which users remotely access servers through open networks. For the reliability of accessing these remote services, user must pass a verification procedure to obtain the authorisation for legal resource acquisition and data exchange. Lee et al. proposed an authentication scheme for multi-server architecture. Recently, Yeh and Nai demonstrated that Lee et al.'s scheme is insecure against server spoofing attack, user impersonation attack and undetectable online password guessing attacks. Yeh and Nai also proposed an improved authentication scheme and claimed their scheme could withstand various attacks. Unfortunately, we find that Yeh and Nai's scheme is still vulnerable to offline password guessing attack and stolen-verifier attack. Furthermore, a security enhanced authentication scheme is developed to eliminate the identified weaknesses.