Multi-server Authentication Protocol Research Articles

A Secure and Efficient Multiserver Authentication and Key Agreement Protocol for Internet of Vehicles

Internet of Vehicles (IoV) being a subdivided application of the Internet of Things, is considered as one of the most prominent and emerging technologies for model transportation systems. However, security and privacy remain two key requirements for IoV networks, as communications between vehicles and other Internet-connected things are generally carried out over public channels. Some of the most typical attack issues for the IoV networks include hardware tampering, unauthorized data access, message modification, tracking vehicle locations, etc. Although there have been a number of solutions (e.g., mutual authentication and key agreement protocols) proposed to ensure the secure communication for IoV, most of them still suffer from some vulnerabilities, such as linkability, server spoofing, and replay attacks, in violation of the security requirements of IoV. Hence, it remains challenging to design secure and efficient solutions. In this article, we first take a recently proposed authentication protocol as an example and analyze the weaknesses of it with simple mathematical analysis. We then propose an improved multiserver-based authentication and key agreement protocol for IoV (called SeMAV), which applies the password and smart card to hide the private keys. We also present both formal and informal security proofs to confirm the robustness against those commonly known attacks. The theoretical comparative summary and simulation results also show that SeMAV can achieve a good performance when compared with some other related protocols in the literature.

PUF enable lightweight key-exchange and mutual authentication protocol for multi-server based D2D communication

The momentous development in the technology of wireless communication has escalated the wide acceptance of Device to Device (D2D) communication among mobile devices. However, enormous requests of devices may curtail the effectiveness of conventional single-server based authentication frameworks. To overcome such limitation, multi-server authentication framework is introduced. This framework facilitates the devices to use multiple services granted from several servers through single registration via the registration center. In recent ages, numerous multi-server authentication protocols have been developed to securely facilitate the huge amount of devices via variety of servers. Nonetheless, most of these protocols are susceptible to various security threats and proved to be inefficient in terms of computation and communication overheads. In this article, we have proposed an Elliptic Curve Cryptography (ECC) based multi-server authentication framework using Physically Unclonable Function (PUF) for D2D communication. We have shown that our proposed protocol is more secure and robust using Random Oracle Model (ROM). The informal security analysis reveals that proposed protocol accomplishes all security needs of multi-server infrastructure. Further, we have separately computed all cryptographic operations for client, server and Registration Center (RC) to get desired experimental results. The performance analysis illustrates that introduced protocol attains compelling security improvements with least possible computation complexity compared to related protocols. Hence, the strong security features of our proposed protocol demonstrate its strength and make it viable for practical implementation.

A Privacy-Aware PUFs-Based Multiserver Authentication Protocol in Cloud-Edge IoT Systems Using Blockchain

The combination of the Internet of Things (IoT) and cloud-edge (CE) paradigm promises to be an efficient system to aggregate and further process huge volumes of data from IoT nodes. Physical unclonable functions (PUFs) emerge as a prospective primitive to provide IoT nodes with lightweight physical identities for authentication. However, when integrating PUFs into multiserver authentication protocols to improve security, the following problems occur: 1) the challenge–response pairs (CRPs) of PUFs generated by devices need to be explicitly stored by each edge server. This will cause the privacy leakage of CRPs; 2) the reliability is reduced resulting from the single point failure; and 3) existing PUFs-based authentication protocols would need to put great efforts into synchronizing CRPs, to ensure consistency in multiserver systems. To overcome these problems, in this article, we propose a privacy-aware authentication protocol for the multiserver CE-IoT systems by combining PUFs and the blockchain technique. The real correlations of CRPs are double encoded into mapping correlations (MCs) by a one-time physical identity and the keyed-hash function. The blockchain is leveraged to store MCs, synchronize them efficiently, and incorporate the multireceiver encryption to share the physical identity securely. The security of our protocol is formally proved by a random oracle model, and security features are discussed to show that our protocol resists various attacks. Moreover, a prototype was implemented to prove the efficiency of the protocol, and the comparison results present that our protocol accommodates CE-IoT systems. Finally, the simulation of the smart contract evaluates the scalability of our protocol.

An enhanced and provably secure authentication protocol using Chebyshev chaotic maps for multi-server environment

Multiserver authentication requires users to have only one-time registration for accessing different permissible services securely from various servers over an insecure network. To date, many multiserver authentication protocols have been presented in the literature. Most of them require the registration server’s participation at the time of authentication, leading to increased communication overhead and bandwidth overload of the registration server. Recently, Lee et al. introduced a multiserver authentication protocol using extended chaotic maps that permits registered users and servers to authenticate with each other directly. In this paper, we revisit Lee et al.’s protocol and find that it is insecure against user impersonation and session-specific temporary information attacks. Additionally, the protocol uses timestamps, which may cause serious time synchronization problems. The weaknesses of Lee et al.’s protocol prompted us to propose another protocol based on extended chaotic maps, which is free from serious time synchronization problems, more efficient in terms of computation and communication overheads, and more robust against all known attacks. Furthermore, our protocol adds extra functionality features such as considering the users’ registration expiration, server scalability, and inclusion of two new phases: a deregistration phase and a registration renewal phase for a registered user. Our protocol’s security has been validated using the automated tool ProVerif and proven through formal and informal analyses. With better security protection, fewer complexities, and additional features, the proposed protocol is more suitable for practical use than other related protocols.

A survey of authenticated key agreement protocols for multi-server architecture

This paper presents a comprehensive survey of authenticated key agreement protocols, which have been proposed for multi-server architectures. The growing use of cloud-based services has made multi-server authentication protocols a necessity. For a brief insight into the topic, the break-fix history of these protocols, vital functional and security requirements have been summarized. Protocols are categorized based upon the cryptographic mechanism used. To evaluate the trade-off between security and performance, comprehensive analysis concerning performance and security of multiple protocols, from each category, has been carried out. Some profound results of this survey include: 1) the majority of existing protocols engage the registration server (RS) in the mutual authentication, which results in extra communication overhead and creates a computational bottleneck on RS end. Secondly, majority of the hash-based protocols with offline RS are vulnerable to key compromise impersonation attacks. Thirdly very few schemes consider the efficient and demanded revocation of compromised participants. Finally, among all these protocols, pairing-based designs are the most computationally expensive.

A secure and improved multi server authentication protocol using fuzzy commitment

The advancement in communication and computation technologies has paved a way for connecting large number of heterogeneous devices to offer specified services. Still, the advantages of this advancement are not realized completely due to inherent security issues. Most of the existing authentication mechanisms ensure the legitimacy of requesting user thorough single server leading towards multiple registrations and corresponding credentials storage on user side. Intelligent multimedia networks (IMN) may encompass wide range of networks and applications. However, the privacy and security of IMN cannot be apprehended through traditional multi sign on/single server authentication systems. The multi-server authentication systems can enable a user to acquire services from multiple servers using single registration and with single set of credentials (i.e.Password/smart card etc.) and can be accomplish IMN security and privacy needs. In 2018, Barman et al. proposed a multi-server authentication protocol using fuzzy commitment. The authors claimed that their protocol provides anonymity while resisting all known attacks. In this paper, we analyze that Barman et al.’s protocol is still vulnerable to anonymity violation attack and impersonation based on stolen smart card attack; moreover, it has incomplete login request and is prone to scalability issues. We then propose an enhanced protocol to overcome the security weaknesses of Barman et al.’s scheme. The security of the proposed protocol is verified using BAN logic and widely accepted automated AVISPA tool. The BAN logic and automated AVISPA along with the informal analysis ensure the robustness of the scheme against all known attacks.

A Novel Pairing-Free Lightweight Authentication Protocol for Mobile Cloud Computing Framework

The mobile cloud computing (MCC) refers to an infrastructure that integrates cloud computing and mobile computing, and it has changed a great deal, the service provisioning of applications, which requires to get the data processed after collection from vast sensor and Internet-of-Things-based network. The ever increasing number of handheld mobile gadgets has exacerbated the need for robust and efficient authenticated key agreements. We could witness a number of MCC-based multiserver authentication schemes lately to foster the secure adaptation of the technology; however, the demonstrated solutions are either insecure or employing too costly bilinear pairing operations for implementation. In view of limitations, as illustrated in previous studies, we propose a novel pairing-free multiserver authentication protocol for MCC environment based on an elliptic curve cryptosystem that is not only efficient, but also free from security loopholes as demonstrated. The performance evaluation section discusses and distinguishes the findings among latest studies. The strength of the contributed scheme is proved theoretically under formal security model.

An anonymous authenticated key-agreement scheme for multi-server infrastructure

Due to single-time registration, the multi-server authentication provides benefit for getting services from different servers through trusted agent. Generally, users feel hesitation for registering themselves individually with all service providers due to the problem of memorizing the multiple passwords. The multi-server authentication allows a quick access to services by real-time customer validation on public channel. Thereafter, hundreds of multi-server authentication protocols have been introduced. However, the more efficient and robust authentication schemes are being explored by the research academia. We introduce an anonymous scheme that resists the major security threats like impersonation attack, insider attack and password modification attacks in viable computing cost. We use random oracle model for formal security analysis of the proposed scheme. The performance analysis shows that the proposed scheme incurs less computation, energy, communication and storage cost as compared to related protocols. This analysis and comparison show that our proposed scheme is quite effective for the purpose of anonymous authentication and key agreement.

A Novel Multiserver Authentication Scheme Using Proxy Resignature With Scalability and Strong User Anonymity

As the indispensable part of the security demand in a distributed system, a variety of online services need to be protected from unauthorized access. Multiserver authentication (MA) is one of the most effective and promising approaches to guarantee one party the authenticity of its partner in the distributed system. In this article, we first elaborate the problem of scalability for MA protocol. After that, a two-level framework for multiserver environment is proposed to convert single-server authentication to MA with provable security and perfect scalability. Also, we give an instance of our novel infrastructure by adopting the idea of proxy resignature to achieve strong anonymity. Furthermore, the security analysis and performance evaluation show that our protocol is secure and practical.

Secure two-factor lightweight authentication protocol using self-certified public key cryptography for multi-server 5G networks

Recently Ying and Nayak proposed a multi-server supported lightweight authentication protocol for 5G networks and confirmed the security of their protocol against all prominent attacks. Nevertheless, this paper will show certain shortcomings in their protocol, like vulnerability against identity guessing, password guessing, and user impersonation attacks. Additionally, it lacks in rendering strong user anonymity and truly two-factor security. Following the crypt-analysis, we propose an improved multi-server authentication protocol, that resists all recognized attacks, including these traps. The formal analysis using broadly accepted BAN-logic assures that the proposed protocol provides mutual authentication among the user and service-providing server. Additionally, the automated verification using the “Automated Validation of Internet Security Protocols and Applications” (AVISPA) tool asserts that improved protocol is safe toward active attacks. The performance comparison with the Ying-Nayak's protocol is evident that the proposed protocol is efficient concerning computational complexity and communication costs.

Efficient Hierarchical Authentication Protocol for Multiserver Architecture

The multiserver architecture authentication (MSAA) protocol plays a significant role in achieving secure communications between devices. In recent years, researchers proposed many new MSAA protocols to gain more functionality and security. However, in the existing studies, registered users can access to all registered service providers in the system without any limitation. To ensure that the system can restrict users that are at different levels and can access to different levels of service providers, we propose a new lightweight hierarchical authentication protocol for multiserver architecture using a Merkle tree to verify user’s authentication right. The proposed protocol has hierarchical authentication functionality, high security, and reasonable computation and communication costs. Moreover, the security analysis demonstrates that the proposed protocol satisfies the security requirements in practical applications, and the proposed protocol is provably secure in the general security model.

A secure three factor-based fully anonymous user authentication protocol for multi-server environment

A single sign-on authentication scheme is required protocol in multi-server environment. Recently, an authentication protocol based on Lagrange interpolation polynomial to satisfy multi-server environment with low computational and communication cost is proposed. In this paper, we have analysed the above scheme and show that their scheme is vulnerable to various attacks like insider attack, server impersonation attack, user impersonation attack and stolen smart card attack. We also show that their scheme fails to provide server anonymity, user revocation in case smart card is lost/stolen or users authentication parameters are revealed. We have also proposed enhanced multi-server authentication protocol using biometric-based smart card and Lagrange interpolation which is more secure. The proposed protocol is analysed using BAN logic to show that the proposed protocol provides secure authentication. In addition, we have simulated our scheme using widely accepted and used AVISPA tool to prove that our scheme is secure against passive and active attacks. The proposed protocol provides high security and anonymity along with low communication and computational cost and various security functions.

A secure three factor-based fully anonymous user authentication protocol for multi-server environment

A single sign-on authentication scheme is required protocol in multi-server environment. Recently, an authentication protocol based on Lagrange interpolation polynomial to satisfy multi-server environment with low computational and communication cost is proposed. In this paper, we have analysed the above scheme and show that their scheme is vulnerable to various attacks like insider attack, server impersonation attack, user impersonation attack and stolen smart card attack. We also show that their scheme fails to provide server anonymity, user revocation in case smart card is lost/stolen or users authentication parameters are revealed. We have also proposed enhanced multi-server authentication protocol using biometric-based smart card and Lagrange interpolation which is more secure. The proposed protocol is analysed using BAN logic to show that the proposed protocol provides secure authentication. In addition, we have simulated our scheme using widely accepted and used AVISPA tool to prove that our scheme is secure against passive and active attacks. The proposed protocol provides high security and anonymity along with low communication and computational cost and various security functions.

A Provably Secure Biometrics-Based Authentication Scheme for Multiserver Environment

With the rapid development of mobile services, multiserver authentication protocol with its high efficiency has emerged as an indispensable security mechanism for mobile services. Recently, Ali et al. introduced a biometric-based multiserver authentication scheme and claimed the scheme is resistant to various attacks. However, after a careful examination, we find that Ali et al.’s scheme is vulnerable to various security attacks, such as user impersonation attack, server impersonation attack, privileged insider attack, denial of service attack, fails to provide forward secrecy and three-factor secrecy. To overcome these weaknesses, we propose an improved biometric-based multiserver authentication scheme using elliptic curve cryptosystem. Formal security analysis under the random oracle model proves that our scheme is provably secure. Furthermore, BAN (Burrows-Abadi-Needham) logic analysis demonstrates our scheme achieves mutual authentication and session key agreement. In addition, the informal analysis proves that our scheme is secure against all current known attacks and achieves desirable features. Besides, the performance and security comparison shows that our scheme is superior to related schemes.

An Anonymous and Efficient Multiserver Authenticated Key Agreement With Offline Registration Centre

Multiserver authentication (MSA) architecture permits its registered users to get the services of various service providers without performing separate registrations with each server. Since, a single registration from registration authority, a trusted third party, is sufficient to get mutually authenticated with service providers, onwards. In this paper, we have emphasized only on the MSA-based schemes that do not require online registration authority for mutual authentication. While, considering those MSA schemes, to date, there is no secure and efficient MSA protocol in our observation that is free of all four limitations at the same time, such as 1) free of the hassle of storage of server-based parameters in users’ smart card by registration authority, 2) free of the transmission of user-based identities to all servers in a network, 3) free of a single secret key distribution to all servers as assumed in a trusted system, and 4) free from employing costly bilinear pairing operations. In view of those shortcomings, we present an anonymous MSA protocol that nearly counters all those problems using elliptic curve cryptography and escaping costly pairing operations. Our scheme also demonstrates the scheme's robustness using formal security analysis employing random oracle model and automated tool analysis.

A new three-factor authentication and key agreement protocol for multi-server environment

Several password and smart-card based two-factor security remote user authentication protocols for multi-server environment have been proposed for the last two decades. Due to tamper-resistant nature of smart cards, the security parameters are stored in it and it is also a secure place to perform authentication process. However, if the smart card is lost or stolen, it is possible to extract the information stored in smart card using power analysis attack. Hence, the two factor security protocols are at risk to various attacks such as password guessing attack, impersonation attack, replay attack and so on. Therefore, to enhance the level of security, researchers have focused on three-factor (Password, Smart Card, and Biometric) security authentication scheme for multi-server environment. In existing biometric based authentication protocols, keys are generated using fuzzy extractor in which keys cannot be renewed. This property of fuzzy extractor is undesirable for revocation of smart card and re-registration process when the smart card is lost or stolen. In addition, existing biometric based schemes involve public key cryptosystem for authentication process which leads to increased computation cost and communication cost. In this paper, we propose a new multi-server authentication protocol using smart card, hash function and fuzzy embedder based biometric. We use Burrows–Abadi–Needham logic to prove the correctness of the new scheme. The security features and efficiency of the proposed scheme is compared with recent schemes and comparison results show that this scheme provides strong security with a significant efficiency.

A Novel Multiserver Authentication Protocol with Multifactors for Cloud Service

Secure and efficient authentication protocols are necessary for cloud service. Multifactor authentication protocols taking advantage of smart card, user’s password, and biometric, are more secure than password-based single-factor authentication protocols which are widely used in practice. However, most of the multiserver authentication protocols may have weak points, such as smart card loss attack, man-in-the-middle attack, anonymity, and high computation cost of authentication center. In order to overcome the above weaknesses, we propose a novel multiserver multifactor authentication protocol based on the Kerberos protocol using the extended Chebyshev chaotic mapping as a cryptographic algorithm. The proposed protocol achieves anonymity without sharing secret keys in advance and needs the user to register with the authentication center only once. Finally, we prove the security of the new protocol with BAN logic and compare it with other multifactor authentication protocols for multiserver environment. The results show that our proposed protocol is more secure and efficient and better for practical application.

A General Architecture for Multiserver Authentication Key Agreement with Provable Security

In a typical single-server architecture, when a user wishes to access multiple servers to obtain different services, the user needs to register with every single server. This results in multiple identities and password pairs. To eliminate the limitation of the user having to possess and remember multiple identities and password pairs, a number of multiserver authentication protocols have been proposed where a user only needs to register once. However, most existing protocols are subsequently found to be insecure and this topic remains one of the ongoing research interests. Thus, in this paper, we present a multiserver authentication key agreement protocol. We then demonstrate the security of the protocol under the random oracle model, as well as the practicality of the protocol in terms of low computation and communication costs, minimal storage requirements, and operation costs.

An efficient and secure design of multi-server authenticated key agreement protocol

Multi-server authentication, being a crucial component of remote communication, provides the ease of one-time registration to users from a centralized registration authority. Therefore, the users could avail the offered services after getting authenticated of any service provider using the same registration credentials. In recent years, many multi-server authentication protocols have been demonstrated. Nonetheless, the existing schemes do not meet the security and efficiency requirements of the time. Recently, Chuang et al. presented a multi-server biometric authentication protocol which was later crypt-analysed and improved by Lin et al. with the identification of few attacks. Later, we discover that Lin et al.’s protocol is still prone to replay attack, privileged insider attack, trace attack, de-synchronization attack and key-compromise impersonation attacks. In this study, we present a multi-server authentication protocol which is not only comparable with Lin et al.’s scheme but also efficient than other state-of-the-art multi-server protocols. The security properties of our scheme are proved using formal analysis and evaluated with automated verification tool based on ProVerif.

ELAKA: Energy-Efficient and Lightweight Multi-Server Authentication and Key Agreement Protocol Based on Dynamic Biometrics

Authentication and key agreement (AKA) provides flexible and convenient sercices. Most traditional AKA protocols are designed to apply in single-server environment, where a user has to register at different servers to access different types of network services and the user have to remember or manage a large number of usernames and passwords. Later, multi-server AKA protocols resolve the repeated registration problem of single-server AKA protocols, where a user can access different servers to get different services using a single registration and the same username and password. Recently, in 2015, Lu et al proposed a light-weight ID based authentication and key agreement protocol for multi-server architecture, referred to as LAKA protocol. They claimed their protocol can overcome all shortcomings which existed in Xue et al’s protocol. Unfortunately, our further research shows that LAKA protocol still suffers from server spoofing attack, stolen smart card attack etc. To overcome the weakness of LAKA protocol, an energy-efficient and lightweight authentication and key agreement protocol for multi-server architecture is proposed (abbreviated to ELAKA). The ELAKA protocol not only provides the security features declared by LAKA protocol, but also has some other advantages. First, the ELAKA protocol can realize authentication and key agreement just by three handshakes with extremely low communication cost and computation cost between users and servers, which can achieve a delicate balance of security and performance. Second, ELAKA protocol can enable the user enjoy the remote services with privacy protection. Finally the ELAKA protocol is proved secure against known possible attacks by using BAN logic. As a result, these features make ELAKA protocol is very suitable for computation-limited mobile devices (such as smartphone, PAD, tablets) in comparison to other related existing protocols.