Multi-server Authentication Scheme Research Articles

Lightweight and privacy-preserving multi-server authentication scheme based on PUF and biometrics

With the development of wireless communication technology and the rapid increase of user data, multi-server key agreement authentication scheme has been widely used. In order to protect users’ privacy and legitimate rights, a two-factor multi-server authentication scheme based on device PUF and users’ biometrics is proposed. The users’ biometrics are combined with the physical characteristics of the Physically Unclonable Functions (PUF) as authentication factors, which not only ensures the security of the scheme, but it also is user-friendly without a password. The proposed scheme can be applied to telemedicine, smart home, Internet of Vehicles and other fields to achieve mutual authentication and key agreement between users and servers. In order to prove the security of the proposed scheme, the widely accepted ROR model and BAN logic are used for formal security analysis. The scheme can effectively resist various security attacks, and the comparison with existing schemes shows that it has better performance in terms of communication cost and computational complexity.

Provably secure and biometric-based secure access of e-Governance services using mobile devices

All the citizens of a country avail e-Governance services through the Internet, where it inherently does not offer security services. Accessing these services securely and transparently is a significant concern for both the citizen and the government. The multi-server authentication scheme with user biometric and personal mobile devices is an efficient way to reduce security issues related to unauthorized access. It is difficult for a user to remember multiple credentials. If a user performs a login attempt with an incorrect credential, then she is denied access to the service. Therefore, one credential to access every server is a convenient option. Nowadays, most mobile devices are compatible with the biometric scanner; accordingly, it can quickly record the biometric features during the authentication process. This paper devises an elliptic curve-based secure multi-server authentication scheme with the user biometric, password, and mobile device. A user can access various e-Governance services from any location through a dedicated mobile app in our scheme. We perform some formal security analysis of our scheme in the random oracle model, BAN logic, and AVISPA tool. The performance evaluation shows that our scheme accomplishes the known security and functionality features concerning other comparable schemes. Thus, our scheme will be suitable for providing secure access to e-Governance services to every citizen through their mobile devices.

Improved ECC-Based Three-Factor Multiserver Authentication Scheme

A multiserver environment can improve the efficiency of mobile network services more effectively than a single server in managing the increase in users. Because of the large number of users, the security of users’ personal information and communication information is more important in a multiserver environment. Recently, Wang et al. proposed a multiserver authentication scheme based on biometrics and proved the security of their scheme. However, we first demonstrate that their scheme is insecure against a known session-specific temporary information attacks, user impersonation attacks, and server impersonation attacks. To solve the security weakness, we propose an improved scheme based on Wang et al.’s scheme. The security of our improved scheme is also validated based on the formal security analysis, Burrows–Abadi–Needham (BAN) logic, ProVerif, and informal security analysis. Security and performance comparisons prove the security and efficiency of our scheme.

The application of multi-server authentication scheme in internet banking transaction environments

Information and communication technology has altered businesses’ operations, with a host of established and new banks launching online banking products and services. Banks encourage their customers to use online banking facilities because these facilities reduce transaction costs, improve customer retention, increase the customer share of wallet, and enhance customer services. Many customers also prefer Internet banking channels because of their convenience and the freedom they offer. Although Internet banking offers substantial benefits and opportunities, it does involve security risks associated with sensitive transactions and accessing critical information over public networks. To secure Internet banking activities and maintain the trust and confidence of customers, numerous banks have adopted technical countermeasures, such as two-factor or multi-factor authentication, to prevent cyberattacks, online fraud, and unauthorized access to bank accounts. However, the use of two-factor authentication is inadequate for protecting customers’ accounts against takeover by cyber criminals. Multi-factor authentication services along with related security techniques lead to two considerable barriers: (1) the high cost of deployment and maintenance and (2) the complex integration between authentication processes and online banking systems. This paper presents an alternative model for the authentication of online banking customers and transactions through use of a hash-based multi-server authentication scheme in conjunction with a smart card. The proposed system provides strong security features and low maintenance costs for financial institutions’ Internet banking platforms. The proposed mechanism can be associated with a customized interface and thus easily integrated into existing banking systems for use in Internet banking applications.

An efficient hash-based authenticated key agreement scheme for multi-server architecture resilient to key compromise impersonation

During the past decade, rapid advances in wireless communication technologies have made it possible for users to access desired services using hand-held devices. Service providers have hosted multiple servers to ensure seamless online services to end-users. To ensure the security of this online communication, researchers have proposed several multi-server authentication schemes incorporating various cryptographic primitives. Due to the low power and computational capacities of mobile devices, the hash-based multi-server authenticated key agreement schemes with offline Registration Server (RS) are the most efficient choice. Recently, Kumar-Om presented such a scheme and proved its security against all renowned attacks. However, we find that their scheme bears an incorrect login phase, and is unsafe to the trace attack, the Session-Specific Temporary Information Attack (SSTIA), and the Key Compromise Impersonation Attack (KCIA). In fact, all of the existing multi-server authentication schemes (hash-based with offline RS) do not withstand KCIA. To deal with this situation, we propose an improved hash-based multi-server authentication scheme (with offline RS). We analyze the security of the proposed scheme under the random oracle model and use the ‘‘Automated Validation of Internet Security Protocols and Applications’’ (AVISPA) tool. The comparative analysis of communication overhead and computational complexity metrics shows the efficiency of the proposed scheme.

A Novel Multiserver Authentication Scheme Using Proxy Resignature With Scalability and Strong User Anonymity

As the indispensable part of the security demand in a distributed system, a variety of online services need to be protected from unauthorized access. Multiserver authentication (MA) is one of the most effective and promising approaches to guarantee one party the authenticity of its partner in the distributed system. In this article, we first elaborate the problem of scalability for MA protocol. After that, a two-level framework for multiserver environment is proposed to convert single-server authentication to MA with provable security and perfect scalability. Also, we give an instance of our novel infrastructure by adopting the idea of proxy resignature to achieve strong anonymity. Furthermore, the security analysis and performance evaluation show that our protocol is secure and practical.

A Provably Secure Biometrics-Based Authentication Scheme for Multiserver Environment

With the rapid development of mobile services, multiserver authentication protocol with its high efficiency has emerged as an indispensable security mechanism for mobile services. Recently, Ali et al. introduced a biometric-based multiserver authentication scheme and claimed the scheme is resistant to various attacks. However, after a careful examination, we find that Ali et al.’s scheme is vulnerable to various security attacks, such as user impersonation attack, server impersonation attack, privileged insider attack, denial of service attack, fails to provide forward secrecy and three-factor secrecy. To overcome these weaknesses, we propose an improved biometric-based multiserver authentication scheme using elliptic curve cryptosystem. Formal security analysis under the random oracle model proves that our scheme is provably secure. Furthermore, BAN (Burrows-Abadi-Needham) logic analysis demonstrates our scheme achieves mutual authentication and session key agreement. In addition, the informal analysis proves that our scheme is secure against all current known attacks and achieves desirable features. Besides, the performance and security comparison shows that our scheme is superior to related schemes.

An efficient dynamic ID-based remote user authentication scheme using self-certified public keys for multi-server environments.

Recently, Li et al. proposed a novel smart card and dynamic ID-based remote user authentication scheme for multi-server environments. They claimed that their scheme can resist several types of attacks. However, through careful analysis, we find that Li et al.’s scheme is vulnerable to stolen smart card and off-line dictionary attacks, replay attacks, impersonation attacks and server spoofing attacks. By analyzing other similar schemes, we find that a certain type of dynamic ID-based multi-server authentication scheme in which only hash functions are used and whereby no registration center participates in the authentication and session key agreement phase faces difficulties in providing perfectly efficient and secure authentication. To compensate for these shortcomings, we propose a novel dynamic ID-based remote user authentication scheme for multi-server environments based on pairing and self-certified public keys. Security and performance analyses show that the proposed scheme is secure against various attacks and has many excellent features.

A Multi-Server Two-Factor Authentication Scheme with Un-Traceability Using Elliptic Curve Cryptography.

To provide secure communication, the authentication-and-key-agreement scheme plays a vital role in multi-server environments, Internet of Things (IoT), wireless sensor networks (WSNs), etc. This scheme enables users and servers to negotiate for a common session initiation key. Our proposal first analyzes Amin et al.’s authentication scheme based on RSA and proves that it cannot provide perfect forward secrecy and user un-traceability, and is susceptible to offline password guessing attack and key-compromise user impersonation attack. Secondly, we provide that Srinivas et al.’s multi-server authentication scheme is not secured against offline password guessing attack and key-compromise user impersonation attack, and is unable to ensure user un-traceability. To remedy such limitations and improve computational efficiency, we present a multi-server two-factor authentication scheme using elliptic curve cryptography (ECC). Subsequently, employing heuristic analysis and Burrows–Abadi–Needham logic (BAN-Logic) proof, it is proven that the presented scheme provides security against all known attacks, and in particular provides user un-traceability and perfect forward security. Finally, appropriate comparisons with prevalent works demonstrate the robustness and feasibility of the presented solution in multi-server environments.

A robust anonymous biometric-based authenticated key agreement scheme for multi-server environments

In order to improve the security in remote authentication systems, numerous biometric-based authentication schemes using smart cards have been proposed. Recently, Moon et al. presented an authentication scheme to remedy the flaws of Lu et al.’s scheme, and claimed that their improved protocol supports the required security properties. Unfortunately, we found that Moon et al.’s scheme still has weaknesses. In this paper, we show that Moon et al.’s scheme is vulnerable to insider attack, server spoofing attack, user impersonation attack and guessing attack. Furthermore, we propose a robust anonymous multi-server authentication scheme using public key encryption to remove the aforementioned problems. From the subsequent formal and informal security analysis, we demonstrate that our proposed scheme provides strong mutual authentication and satisfies the desirable security requirements. The functional and performance analysis shows that the improved scheme has the best secure functionality and is computational efficient.

Privacy Preserving Password-Based Multi-server Authenticated Key Agreement Protocol Using Smart Card

Clint–server based communication mechanism provides climbable environment for online services, where a user can obtain several services at any time and from anywhere via Internet. As Internet is an insecure communication medium, to achieve security and accountability in data transmission, authentication and key agreement protocols are being adopted. Majority of the existing protocols for mutual authentication are designed for single-server environment, which do not present scalable solution for multi-server environment as multiple registrations are required to perform by the user. Additionally, user must maintain multiple secret keys to access multiple application servers. On the contrary, multi-server authentication (MSA) mechanism presents a user-friendly solution to multiple-registration problem. Unfortunately, many MAS schemes consider trusted server environment, whereas some server may be semi-trusted. To address this issue, Kalra and Sood recently proposed MAS scheme, where all servers need not be entrusted. Kalra and Sood’s scheme is feasible for semi-trusted environment. By seeing its importance, we have thoroughly analyzed its security. Unfortunately, we have identified some security flaws in their scheme. Our aim is to overcome the flaws of Kalra and Sood’s scheme, and present privacy protected mutual authentication mechanism for multi-server communication. In this paper, we first pointed out the security failures of Kalra and Sood’s scheme and then proposed an improved MSA scheme to fix those vulnerabilities of existing MSA schemes. Our design is suitable for semi-trusted environment and protects anonymity. Moreover, the performance of the proposed protocol is comparable with the existing protocols.

An improved and secure multiserver authentication scheme based on biometrics and smartcard

With the advancement in internet technologies, the number of servers has increased remarkably to provide more services to the end users. These services are provided over the public channels, which are insecure and susceptible to interception, modification, and deletion. To provide security, registered entities are authenticated and then a session key is established between them to communicate securely. The conventional schemes allow a user to access services only after their independent registration with each desired server in a multiserver system. Therefore, a user must possess multiple smartcards and memorize various identities and passwords for obtaining services from multiple servers. This has led to the adoption of multiserver authentication in which a user accesses services of multiple servers after registering himself at only one central authority. Recently, Kumar and Om discussed a scheme for multiserver environment by using smartcard. Since the user-memorized passwords are of low entropy, it is possible for an attacker to guess them. This paper uses biometric information of user to enhance the security of the scheme by Kumar and Om. Moreover, we conducted rigorous security analyses (informal and formal) in this study to prove the security of the proposed scheme against all known attacks. We also simulated our scheme by using the automated tool, ProVerif, to prove its secrecy and authentication properties. A comparative study of the proposed scheme with the existing related schemes shows its effectiveness.

A secure mutual authenticated key agreement of user with multiple servers for critical systems

Recent technological advances in almost all critical systems’ domains have led to an explosive growth of multimedia big data. Those advances encompass the ever increasing innovative digital and remote mobile devices being operated on the users’ end. Due to the openness of critical system, the service providers in such networks are facing security challenges to authenticate those mobile devices on the field, and delivering services. In this scenario, the Multi-server authentication (MSA) framework seems to be a promising solution that enables its subscribers to avail services from different servers without getting registered to each server individually. In last few years many MSA protocols depending on RC-Offline authentication during mutual authentication, have been presented. However, to date, there is no efficient MSA scheme to our knowledge that is free of all three weaknesses, simultaneously. That is, 1) free from storage of server-based parameters (public keys or other values) in smart card by registration authority, 2) free from the assumption of publishing of server-based public keys publicly and 3) free from a single secret sharing with all servers so that it could avoid server masquerading (insider) attack. Considering these limitations, we present a multi-server authentication protocol that withstands above drawbacks using lightweight cryptographic operations. The rationale of the proposed work was to present an efficient RC-Offline MSA scheme. Our scheme is also backed by formal security analysis based on GNY logic and automated security verification using ProVerif tool.

An Enhanced and Provably Secure Chaotic Map-Based Authenticated Key Agreement in Multi-Server Architecture

In the multi-server authentication (MSA) paradigm, a subscriber might avail multiple services of different service providers, after registering from registration authority. In this approach, the user has to remember only a single password for all service providers, and servers are relieved of individualized registrations. Many MSA-related schemes have been presented so far, however with several drawbacks. In this connection, recently Li et al. in Wirel. Pers. Commun., (2016). doi: 10.1007/s11277-016-3293-x presented a chaotic map-based multi-server authentication scheme. However, we observed that Li et al. suffer from malicious server insider attack, stolen smart card attack, and session-specific temporary information attack. This research work is based on improving security of Li et al.’s protocol in minimum possible computation cost. We also evaluate the security for the contributed work which is provable under formal security analysis employing random oracle model and BAN Logic.

An improved lightweight multiserver authentication scheme

SummaryMultiserver authentication complies with the up‐to‐date requirements of Internet services and latest applications. The multiserver architecture enables the expedient authentication of subscribers on an insecure channel for the delivery of services. The users rely on a single registration of a trusted third party for the procurement of services from various servers. Recently, Chen and Lee, Moon et al, and Wang et al presented multiserver key agreement schemes that are found to be vulnerable to many attacks according to our analysis. The Chen and Lee scheme was found susceptible to impersonation attack, trace attack, stolen smart card attack exposing session key, key‐compromise impersonation attack, and inefficient password modification. The Moon et al is susceptible to stolen card attack leading to further attacks, ie, identity guessing, key‐compromise impersonation attack, user impersonation attack, and session keys disclosure, while Wang et al is also found to be prone to trace attack, session‐specific temporary information attack, key‐compromise information attack, and privileged insider attack leading to session key disclosure and user impersonation attacks. We propose an improved protocol countering the indicated weaknesses of these schemes in an equivalent cost. Our scheme demonstrates automated and security analysis on the basis of Burrows‐Abadi‐Needham logic and also presents the performance evaluation for related schemes.

Cryptanalysis and Improvement of an Anonymous Multi-server Authenticated Key Agreement Scheme

A multi-server authentication scheme offers a single registration procedure, but allows to access services from multiple servers. For efficiently communicating with the servers, a number of password based remote user authentication schemes have been explored. Recently, Chuang and Chen (Expert Syst Appl 41(4):1411–1418, 2014) have discussed an anonymous multi-server a uthenticated key agreement scheme using smart card together with password and biometrics. This scheme achieves various security requirements while supporting multiple servers as claimed by the authors. In this paper, we show that this scheme is susceptible to different attacks, such as DOS attack, user/server impersonation attack, a smart card attack, session specific temporary key attack, and it does not achieve perfect forward secrecy. In this paper, we propose a new scheme by overcoming the drawbacks of the Chuang and Chen’s scheme. Our scheme can provide non-repudiation as the authentication message sent by a user is digitally signed by the server using the RSA digital signature. Due to efficiency and security, our scheme is suitable for the services like tele medicine information system, which can provide healthcare delivery services between the patients and doctors to employ telecare medicine facilities and access electronic medical records.

A provably secure biometrics-based authenticated key agreement scheme for multi-server environments

An authentication scheme handling multiple servers offers a feasible environment to users to conveniently access the rightful services from various servers using one-time registration. The practical realization of distribution of online services efficiently and transparently in multiple-server systems has come true by virtue of multi-server user authentication schemes. Due to distinguished properties like, difficulty to forge or copy, in-feasibility to lose or guess or forget, etc., biometrics have been widely preferred as a third authenticating factor in password and smart card based user authentication protocols. In this paper, we design a new biometrics-based multi-server authentication scheme based on trusted multiple-servers. We harness the concept of fuzzy extractor to provide the proper matching of biometric patterns. We evaluate our scheme through informal discussions on performance and also using Burrows-Abadi-Needham logic (BAN-logic) & random oracle model for formal security analysis. We also compose a comparative assessment of our scheme and the related ones. Outcome of the analysis and assessment shows our scheme an edge above many related and contemporary schemes.

An improved and secure chaotic map based authenticated key agreement in multi-server architecture

Multi-Server Authentication (MSA) provides the user an efficient way to avail multiple services of various multimedia service providers, once after getting registered from a registration centre. Previously, a user had to register all servers individually to use their respective service; which proves to be a redundant and inefficient procedure in comparison with MSA. Many MSA-based techniques have been put forward by researchers, so far, however with proven pitfalls. In the last few years, the focus has been shifted towards a more flexible and efficient Chebyshev cryptographic technique. In this regard, recently Tan’s scheme presented a chaotic map based multi-server authentication scheme with a focus on login scalability. Nonetheless, Tan’s scheme has been found vulnerable to insider (impersonation attack) and stolen smart card attacks. Besides, the Tan’s scheme fails to differentiate the login requests between the two presented cases. The current study work is based on improving the Tan’s technique in terms of security in almost an equivalent cost. The security for proposed work is evaluated in the performance evaluation section, while it shows that the security is provable under formal security model, as well as using BAN Logic.

An improved Multi-server Authentication Scheme for Distributed Mobile Cloud Computing Services

An improved Multi-server Authentication Scheme for Distributed Mobile Cloud Computing Services

An Advanced Anonymous and Biometrics-based Multi-server Authentication Scheme Using Smart Cards.

We find that Chuang and Chen's biometries-based multi-server authentication scheme is unable to resist against stolen smart card and forgery attacks; in addition, their scheme has weak biometrics detection and privacy preservation problems. Thus, in this paper, we propose an advanced biometries-based authentication scheme for a multi-server environment with higher security and efficiency. Our scheme not only resists potential attacks but satisfies various additional requirements as well. Compared with related biometries-based schemes, our scheme not only ensures security but also has lower computation cost. In particular, our scheme overcomes the false negative problem in biometries detection.