An enhanced approach for three factor remote user authentication in multi - server environment

2.1 Symbols and notations

Table 1 provides symbols and notations which are used in the articulation of proposed work.

The cryptographic hash function H is defined as a H : {0, 1} ^* → {0, 1}  ⁿ , where * is a random size input and n is the fix size output. A function H is a subordinate function that uses various cryptographic purposes such as designing of digital signature, authenticated key exchange, random number generation, and so on. Every cryptographic hash function must satisfy certain properties such as second pre-image resistant or week collision property, pre-image resistant or one-way property, variable size input, fixed-size output, collision-resistant, or strong collision property, efficiency, and randomness.

3.1 Registration phase

In this phase, user picks {r, ID _i , PW _i }. User sends selected identity ID _i , and hash of the generated random number r with selected password PW _i over a protected channel for registration. The RC performs necessary verification and calculations. Here x and y are secret keys generated by the RC. After performing the required operations, the RC creates a SC and passes it to the user over a protected channel.

User computes h(r ⊕ PW _i ) and sends ID _i with h(r ⊕ PW _i ) over a secure channel to the server.

3.2 Login phase and authentication phase

In the login phase, user inputs ID _i and PW _i . Then, at the user side certain operations (discussed below) are followed, and then the user sends a parameter set m1 to the remote server for the login purpose. In the login phase, server performs operation for the user validation and sends a parameter m2 to the user. Now, the user verifies the server message and sends a parameter set m3 to the server for authentication and key generation. Thus, both the parties mutually authenticate each other and draw a session key.

User computes L _i = W _i  ⊕ h (ID _i ||h (r ⊕ PW _i )), F _i * = h(L _i ) then check F _i * ?= F _i , if this is verified.

3.3 Password change phase

In this phase, user can change password using his/her credentials.

User provides ID _i and PW _i , now user system computes L _i = W _i  ⊕ h (ID _i ||h (r ⊕ PW _i )), F _i * = h(L _i ).

4.1 Password guessing attack

During the authentication phase, user and server exchanges parameter V ij ′ = h (E _i  ∥ N _i  ∥ M _i  ∥ SID _j ). In this parameter the value of N _j (server nonce) can be intercepted because it is in the plain text format in the second parameter set m2. The value of SID _j (Server’s identity) is publicly available to everyone, the value of E _i can also be intercepted if an attacker successfully gets SC (because SC contains the parameter E _i ) of the user. Therefore, we have only one parameter E _i left which is unknown for an attacker. Now, we know that M _i = h (r ⊕ PW _i ) ⊕ E _i . So, as per the rules of XOR, if we have any two operands out of three, we can easily get the third one. The attacker tries to perform dictionary attacks in the bruit-force approach and tries all the passwords PW i ′ one by one. And, for the correct password, by the computation of M i ′ = h ( r ⊕ PW i ′ ) ⊕ E i , we can obtain the right value of the E _i . Thus, we have all the four correct values which is used in V ij ′ . So, we can easily get it, impersonate as a genuine user.

4.2 Replay attack

Whenever, an attacker tries to send the same message, which is intercepted by him/her before some time, he/she tries to perform the replay attack. In Chen’s scheme, during an authentication phase, if an attacker intercepts the first parameter set m1= {G _ij , CID _i , N _i , Z _i , H _ij } and sends the m1 to the server after a while. Server computes {R _i , M _i , L _i , E _i } and compares Z _i ?= h (E _i ||M _i ||N _i ) and then generates server nonce N _j . If the user is not a genuine user, then also the server continues the computation of many other operations means eight-time hash function and six time XOR function. After these many operations only, server can validate weather user is a genuine one or not. Over here, server wastes CPU and takes unnecessary time for user verification.

4.3 RC spoofing attack

If the RC acts as an attacker, then the attacker has all the resulting values for which it will perform computation. Thus, in the registration phase RC has these resulting parameters: {R _i , M _i , E _i , L _i , W _i , F _i }. In this scheme, session key can be computed in the authentication phase: SK = h (E _i ||N _i ||N _j ||M _i ||SID _j ), where N _i (user nonce) and N _j (server nonce) can be intercepted from the public channel, SID _j is known to everyone and rest of the parameters E _i and M _i can be received easily as it is available at RC and in RC spoofing attack, RC itself behaves as an attacker. As a result, the attacker has all five parameters necessary for the session key and thus it can easily impersonate as a legal user.

4.4 Perfect forward secrecy

In the authentication phase, the value of V ij ′ = h (E _i ||N _j ||M _i ||SID _j ), thus among these parameters, only Nj (server nonce) is a random number generated by the server and is dynamic for each calculation. The values of parameters must not remain same, if a user wants to get certain services from a specific server. Thus, If the same random number is generated by the server for N _j , the value of V ij ′ will be the same as the previous occurrence of N _j . For example, N j = 1 → V ij ′ = 23 , if N j = 5 → V ij ′ = 42 but if now N _j  = 1 then it is surely V ij ′ will be 23 again.

4.5 Session key verification attack

In the authentication phase, both communicating parties generate a session key, SK = h (E _i ||N _i ||N _j ||M _i ||SID _j ), but session key is not verified, This is not the right way to provide a mutual authentication before the actual conversation. Before further communication, session key must be established and verified by both the parties.

4.6 Performance issue

Chen’s scheme has a number of hash functions. It can take a significant amount of time to perform authentication. In the registration phase, there are eight hash functions while in the login phase, there are nine hash functions. In the authentication phase, there are nine hash functions, while in the password change phase, there are four hash functions. Thus, a total of 30 times hash operation is performed, and therefore, it consumes a significant amount of time and compromises the system’s performance.

5.1 Registration phase

New user can register himself/herself with the RC and access any of the servers associated with RC. Following steps describe registration procedure followed by the user:

User selects ID _i , PW _i , BM _i and random number r.

At the completion of the registration phase, user has parameters that he/she will use for the login and authentication phase. So, the next phase is the user login, mutual authentication and key generation phase.

5.2 Login and authentication phase

In this phase, user and server performs mutual authentication and generates secret session key. During this phases, user and remote server performs the following steps:.

User enters ID _i , PW _i and BM _i .

5.3 Password change phase

In the proposed RUA scheme, user does not contact with the RC or the server for the password updation. The user follows following steps for the password updation:

User selects ID _i , PW _i , BM _i ,

6.1 Password guessing attack

In the password guessing attack, an attacker performs guesswork and tries different passwords. If an attacker succeeds than he/she can prove himself/herself as a valid user. In the proposed scheme, the intruder performs RPW _i = h (PW _i ||h (B _i )) or h (PW _i ||ID _i ||r). As a result, an attacker may guess the password, but he/she can never guess the values of RPW _i as RPW _i which are inked with the parameters such as user biometrics, user identity and random numbers generated by the user. Thus, the attacker can not prove him/herself as a genuine user for the proposed system.

6.2 Replay attack

If An attacker stores the past login messages and utilizes those messages to login into the server after some time into the system. In our Proposed scheme, we utilize a timestamp for each communicated message over an open channel. Both the communicating parties first verify the timestamp upon receiving the message. Therefore, in our proposed method, we perform verification twice for security enhancement.

6.3 Spoofing attack

In the RC spoofing attack, RC, as an insider, performs an attack on the system. Attacker misuses parameters stored by RC to derive a session key. In our proposed work, we generate a session Key SK = h (RFA||ID _i ||RPW _i ||T₇). If the RC attacks the system, then RC can use the available parameters Ai and Bi. But, the proposed system does not use Ai and Bi for the session key computations, Thus, there is no possibility that RC ever succeeds in spoofing of the original session key.

6.4 Perfect forward secrecy attack

If the attacker compromises the user’s credentials or any other sensitive information and the attacker derives the original session key using those parameters, it is called a perfect forward secrecy attack. In the proposed scheme, we take care that let random number does not appear as an open parameter to any party during the verification procedure. We follow the multiple multiplications of random numbers for security enhancement in the proposed scheme. The final result of random number multiplications is inked as one of the security parameter for the final session key. For example, generated random numbers are rMU, P and rFA, We calculate RMU = rMU . P followed by RFA = rFA . RMU ., and SK = h (RFA||ID _i ||RPW _i ||T₇). Thus, the proposed scheme is strong enough against the perfect forward secrecy attack.

6.5 Session key verification property

For any mutually authenticated secure system, Both the communicating parties must compute session key as well as ensure that counter party also computed the same session key. If the session key is verified, then the system achieves session key verification property or mutually authentication property. In the proposed scheme, server generates SK = h (RFA||ID _i ||RPW _i ||T₇) and sends h (SK) over public channel. At the user side, user verifies this session key by h ( h ( RFA | | ID i | | RPW i | | T 7 ) ) = ? h ( SK ) . Thus, we can say that the proposed RUA scheme achieves session key verification successfully.

6.6 User anonymity property

When the server is not aware of user identity, it is called user anonymity. In the remote server, the authenticated user must be unidentifiable and untraceable. In our Proposed Scheme, SC does not store the user’s identity SC = {r, A _i , B _i , Ek (.) , Dk (.) , h (.)}. If the SC is compromised, then also the identity of the user is not revealed. During the login and authentication phase also, the user never sends his/her identity as a plain text over a public channel. User sends (D _i , T₁) where D _i is encrypted and secure. Thus, we can say that the proposed method achieves user anonymity property.

6.7 User impersonation attack

In the user impersonation attack, the attacker claims that he/she is the genuine user for the system. Thus, the attacker sends the login request to the server, and if the server authenticates him/her, he/she can prove himself/herself as a legitimate user. In the proposed scheme, an attacker can not generate a correct login request. A public key of the server encrypts parameter D _i in the login message, and D _i is generated using parameters like A _i and B _i which are protected by a random number, and validated pair of id and password. Thus, it is next to impossible that an attacker can impersonate the legal user as the value of D _i depends on the identity, password, random number, and MSK. Thus, the proposed RUA scheme provides immunity against user impersonate attack.

6.8 Secure and user-friendly password change phase

In the proposed scheme, a valid user can easily change the password. In the password Change Phase, user provides registered credentials like identity, password and random number / biometrics followed by the SCR verification. After successful verification, only the valid user becomes eligible to provide a new password PWi^*. The SCR computes parameters ( RPW i * = h ( PW i * | | h ( B i ) ) or h ( PW i * | | ID i | | r ) , B i * = A i ⊕ RPW i * ) and updates the SC by using newly computed parameters. In the proposed scheme, user does not communicate with the RC or any other server during password updation phase.

6.9 Denial of service attack

In DoS attack, an attacker tries to reduce the server’s performance by either syn flooding or any other means. In the proposed scheme, we use Biohash function for the improvement of security and reduction in time. This is because in the normal hashing function, if the input is biometric, then the avalanche effect of hash function takes more time and resources than the Biohash function. In Chen’s scheme, the system uses additional CPU resources to prove user legitimacy. Still, in the proposed scheme, we perform lighter computations for the same purpose. Thus, the proposed system also achieves efficient resource utilization.

6.10 Smart card stolen attack

If an attacker steals the SC of a genuine user, he/she tries to read all the parameters from SC. If an attacker succeeds, he /she gets access to the user’s account. In the proposed scheme, if the SC is stolen then also an attacker will not get value of D _i  = EPUB _S  {RMU, A _i , B _i , T₁, ID _i } which is principal parameter for the session key generation. Thus, our proposed scheme is secured against the SC stolen attack.

6.11 Message modification attack

An attacker can modify any of the messages communicated through the public channels. In the proposed scheme, all the messages pass through the open channel, but these messages are in either encrypted or digested format. and therefore, only legitimate user or server can access those data or interpret them. Thus, the proposed scheme is secured against the message modification attack.

6.12 Session key computation attack

An attacker can intercept and compute the session key passing through the public channel. In the proposed scheme, session key is computed as a SK = h (RFA||ID _i ||RPW _i ||T₇). The session key computation requires original timestamp and precise random numbers, which are unique and dynamic values for each session key. Therefore, we claim that the proposed scheme provides security against the session key computation attack. In mutual authentication, both the parties authenticate each other. In the proposed scheme, the RC authenticates both, remote server and remote user by providing three keys (MSK, FSK, KFH). The user encrypts the data with the server’s public key. If the server can decrypt it using its secret key, mutual authentication between the user and the server can be performed efficiently. The server encrypts the data using the pre-shared key and sends those data to RC. If the RC can decrypt the encrypted data, mutual authentication between the server and the RC is performed efficiently. The RC also authenticates a remote user, so a user and the RC mutually authenticate each other. Thus, our proposed scheme possesses mutual authentication properties.

6.13 Mutual authentication property

In mutual authentication, both the parties authenticate each other. In the proposed scheme, the RC authenticates both, remote server and remote user by providing three keys (MSK, FSK, KFH). The user encrypts the data with the server’s public key. If the server can decrypt it using its secret key, mutual authentication between the user and the server can be performed efficiently. The server encrypts the data using the pre-shared key and sends those data to RC. If the RC can decrypt the encrypted data, mutual authentication between the server and the RC is performed efficiently. The RC also authenticates a remote user, so a user and the RC mutually authenticate each other. Thus, our proposed scheme possesses mutual authentication properties.

We provide the formal security proof for the propose protocol as follows:

Theorem 1. We can define the security for the proposed protocol from the challenger C as, it AdP ( A ) ≤ q h 2 2 l h + 1 + ( q s + q e ) 2 2 l r + 1 + 1 2 l r + 1(2) where l _h , l _r represents the hash size and random number size in bits respectively; q _s , q _e and q _h represents number of times send query, execute query, and hash query are implemented by the challenger C .

Proof. We define four security games G₀, G₁, G₂ and G₃ to prove the security of the proposed protocol P. Over here, the Pr[ SUC ] defines the winning probability for a challenger such that he/she can differentiate computed or retrieved value and real session key SK successfully.

Game G₀: The game G₀ is a starting game to realize protocol P. Therefore, the game G₀ can be defined as per equation. 3, it AdP ( A ) = 2 * Pr [ SUC 0 ] - 1(3)

Game G₁: In the game G₁, the challenger uses execute E query to perform the passive attack. Let us assume that the challenger C experiments E (Ω ^x , Ω ^y ) query to monitor the transmitted messages between both the entities. The winning probability Pr[ SUC ] in this game for C hang on the calculation of the session key SK from the tracked messages. There are two messages communicated between the user and the server. Let us guess that using the E query, the challenger receives itmessage 1 = (D _i , T₁) and itmessage 2 = (h (SK) , T₇, F _i ). Meanwhile, the computation of itSK = h(RFA||ID _i ||RPW _i ||T₇) is protected by the unique id of both participants. It also involves parameters such as RFA that is protected by the master secret of the RC and randomization approach. The C does not get any single parameters that is necessary for the session key computation. Therefore, the game G₁ concludes as, Pr [ SUC 1 ] = Pr [ SUC 0 ](4) The equation 4 proves that the Pr[ SUC ] is negligible under the game G₁.

Game G₂: In this game, the challenger C performs an active attack by the experiments of send query and hash query. The fundamental goal of the challenger C is to update the messages and persuade the communicated parties to accept the modified messages. Now let us assume that C receives itmessage 1 = (D _i , T₁), from U _i and tries to modify itmessage 1 in such a way that the server accepts the modified message. However, the computation of DSEC _S  {D _i } requires the secret key of the server, which is not possible to receive by the challenger. D _i is an encrypted object which has variables that are hashed output of other variables. D _i also has a random number of RMU. The hitting probability for the random numbers is ( q s + q e ) 2 2 l r + 1 [42], and the hitting probability of hash query is at most q h 2 2 l h + 1 [42]. Therefore, through the birthday paradox, we can say that: Pr [ SUC 2 ] - Pr [ SUC 1 ] ≤ q h 2 2 l h + 1 + ( q s + q e ) 2 2 l r + 1(5)

Game G₃: The game G₃ considers the other attacks implemented by the challenger C using oracle queries. C makes use of itCorruptUserDevice and retrieves (B _i , A _i , Ek(.)/ Dk(.), h(.), (BM _i ⊕ r)). The challenger attempts to calculate itSK = h(RFA||ID _i ||RPW _i ||T₇) from the captured values. Using these queries, C gets ID _i but can not compute the value RPW _i and RFA because both the values depend on random number r. The guessing probability for the random number by the challenge C is 1 2 l r + 1 . Therefore, we can say that, Pr [ SUC 3 ] - Pr [ SUC 2 ] ≤ 1 2 l r + 1(6) After finishing all this games, the only option left with the challenger C is to toss the unbiased. By this way, the challenges attempts to predict the correct value of bit b. The winning chance in this experiment is almost 1 2 . Therefore, from the equations 3, 4, 5, we can say that, 1 2 it AdP ( A ) = Pr [ SUC 1 ] - Pr [ SUC 3 ](7) With the help of equations 5,6,7, we can obtain, it AdP ( A ) ≤ q h 2 2 l h + 1 + ( q s + q e ) 2 2 l r + 1 + 1 2 l r + 1(8)

8.1 Analysis based on security

In Table 2, we compare Chen’s scheme and the proposed scheme in terms of attacks. We consider a list of attacks and compare both the schemes against those attacks as depicted in the table. We demonstrate that our proposed scheme is more secure as compared to Chen’s scheme.

In Table 3, we compare Chen’s scheme and the proposed scheme in terms of time complexity. We consider the time taken by the hash function (T _h ), XOR function (T _x ), concatenation function (T _c ), symmetric (E and D) and asymmetric encryption/decryption function (AE and AD). As shown in the table, we demonstrate that our proposed work diminishes the overhead to validate the user as compared to Chen’s scheme. Therefore, Table 4 shows time computation required by both the schemes. It shows that the proposed remote user authentication scheme is better than the Chen’s scheme. The implementation of the proposed scheme is performed in system with Core-i7 processor with 8 GB RAM on the Linux environment. The individual time consumption for the various cryptographic functions are as follows. The hash function T _h takes 0.023 s, XOR function (T _x ) takes 0.013 s, concatenation function (T _c ) takes 0.0122 s, symmetric functions (E and D) takes 0.0466 s and asymmetric encryption/decryption functions (AE and AD) take 0.112 s.