A Remote User Authentication Scheme with Anonymity for Mobile Devices

1. Introduction

The main aim of the remote authentication scheme using smart cards is to identify and verify the smart card holder with valid access rights and access to the remote server. It has been widely accepted that the smart card-based remote user authentication is one of the most reliable and secure forms of electronic identification for authentication. Therefore, a variety of password-based authentication schemes have been proposed for remote authentication using smart cards. In a traditional remote authentication scheme, a user has to register her own identity and password to the server in advance, and she has to submit the identity and password information to the server during a login process. On receiving a login request, the remote server authorizes the user to access facilities provided by the remote server, if the pair of identity and password is equivalent to the one stored in the server's password table. Otherwise, the access request is rejected.

The desirable security requirements of an authentication scheme using smart cards are as follows. The scheme should resist malicious insider, replay, guess, stolen-verifier and impersonation attacks. Also, the scheme should provide both forward secrecy and known-key security, guaranteeing user anonymity.

The desirable functionality requirements of an authentication scheme are as follows. A user chooses her identity and password freely and changes her password securely, and a remote server does not maintain a verification table to authenticate the user in the server. Due to the power constraints of smart cards, the computational cost of the scheme has to be low and the scheme should provide mutual authentication, user anonymity and session key agreement between a user and a server without requesting time-synchronization between user and server.

In this paper we propose an enhanced authentication scheme using smart cards. Our scheme satisfies the security requirements and functions.

The remainder of this paper is organized as follows: section 2 reviews related works; section 3 details the proposed authentication scheme; section 4 analyses its security; section 5 analyses its performance and functionality. Finally, Section 6 draws brief conclusions.

2. Related Works

A number of remote authentication schemes have been suggested by researchers from time to time. When a server authenticates a user, the server verifies the user with the entered user's identity and password, and the corresponding values in the verification table of the server. In 1981, Lamport [1] presented a remote authentication scheme using password tables, but security holes and maintenance responsibilities for the verification table exist because it must always maintain the verification table. Also, a stolen verification table may cause many security threats, therefore, in 1990, Hwang [2] presented a remote authentication scheme without password tables. Many other studies have also proposed a scheme that does not maintain the verification table to authenticate the remote user.

Numerous studies [7–16] have proposed a scheme using the one-way hash function and exclusive-or operation due to the constrained resources and computing power of a smart card.

After the user's authentication is completed, the communication channel for a message may be insecure. If the message is not encrypted, then the message is revealed to an adversary. Therefore, previous studies [11–14, 16] have proposed session key generation schemes using key agreement between user and server, and researchers have also pointed to the weaknesses of other schemes [3, 4].

Because the user's anonymity is very important in many e-commerce applications, several schemes [5, 6, 9, 12-13, 15, 16] have been proposed to achieve user anonymity in the authentication phase.

OPEN IN VIEWER

Table 1.

The notations used in the proposed scheme.

Notations	Description
U i	User i
PW i	The password of U i
S	The remote server
K s	The secret key of server
K u	The common key of user for S
TID i	The transformed identity of U i
CTID i	The changed identity of U i
DID i	The dynamic identity of U i
DID s	The dynamic identity of S
SK i	The generated session key of U i
SK u	The generated session key of S
h(·)	A one-way hash function
h k (A)	Perform hash function of k times
⊕	Bitwise exclusive-or operation
‖	The string concatenation
A ⇒ B: M	A sends M to B through a secure channel
A → B: M	A sends M to B through a common channel
ESK i {M}	Encrypted message by the session key, SK i

Bindu et al. [6] showed the possibility of insider attack, Main-in-Middle attack, in the scheme of Chien et al. [5] and presented an improved scheme preserving user anonymity. However, the scheme does not provide a password change phase and uses time-stamp to resist replay attack. Lin et al. [8] presented a new strong-password authentication protocol that can withstand a stolen-verifier attack and other possible attacks, but the scheme cannot change passwords and does not provide mutual authentication, session key agreement and user anonymity. Juang [10] presents a simple authentication scheme, but the scheme cannot change passwords and does not provide mutual authentication. Recently, Khan et al. [13] and Tseng et al. [16] presented authentication schemes providing user anonymity and mutual authentication. With the scheme proposed by Tseng et al. [16] the user can freely choose the password and securely change the password, however, both schemes require time synchronization to protect from replay attack.

Here, we point to security issues related to Das et al.'s scheme [15] and Liao et al.'s scheme [14].

3. Proposed Authentication Scheme

In this section, we propose an enhanced security scheme for mutual authentication and user anonymity using a smart card. The proposed scheme overcomes the weaknesses of Das et al.'s scheme and Liao et al.'s scheme, while it enhances security compared to the existing schemes. The proposed scheme is composed of four phases: registration, login and authentication, key agreement and secure password update. Table 1 is the notation used in the proposed scheme.

3.1 Registration Phase

When user U _i wants to access a remote server for a service legitimately, U _i should perform the following registration steps before the access. The procedure is as follows:

Step 1. U _i ⇒ S: ID _i , h(PW _i )

U _i chooses her identity, ID _i , and password, PW _i , for registration and submits ID _i and, h(PW _i ) hashed value of PW _i , to the remote server via a secure communication channel. Both ID _i and PW _i are selected by the user freely.

Step 2. After receiving ID _i and h(PW _i ) from U _i , the remote server, S performs the following steps:

S generates transform identity TID _i = h(ID _i ‖ h(PW _i )), and checks the existence of the transformed identity in the database. If the identity already exists in the database, S requests U _i to re-initiate the registration procedure with a different ID _i or PW _i . Otherwise, S stores TID _i in the database. This process ensures the uniqueness of the user's transformed identity.

Compute A _i = (h(K _u )⊕K _s ), where K _s is a secret key of S and K _u is a common key of user for S. K _u is used to generate a dynamic identity, DID _i in the login and authentication phase.

Compute B_i = (g^A_i mod p)⊕h(PW_i), where g is a primitive element in Galoisfield GF(p) and p is a large prime positive integer.

Store the values DID _i , B _i , h(·) and K _u in a smart card and issue the smart card to U _i .

OPEN IN VIEWER

Figure 1.

Registration phase.

3.2 Login and Authentication Phase

After U _i registers to S, when U _i wants to log into the server, U _i will send a, login message to S. The login message contains a dynamic identity, DID _i to guarantee user anonymity. After successful verification of the login message, U _i can authenticate S and S can authenticate U _i . That is, our scheme provides mutual authentication. The login and the authentication phases work as follows:

Login phase: U _i → S: DID _i , CTID _i , C _i , k _i

User, U _i , connects her smart card to a reader She inputs her identity, ID _i and password, PW _i . The smart card performs the following processes:

Generate nonces, n _i and k _i .

Compute CTID _i = TID _i ⊕n _i .

Compute C _i = h(B _i ⊕h(PW _i ))⊕n _i .

Compute M _i = K _u mod k _i .

Compute DID_i = h^M_i(TID_i⊕B_i⊕h(PW_i)).

U _i sends DID _i , CTID _i , C _i and k _i with the login request message to S.

Authentication phase:

The proposed scheme provides mutual authentication. U _i and S perform the following processes to achieve this, after U _i sends the request message to S.

Step 1. S → U _i : DID _s , CTID _s

S does the following processes to authenticate U _i :

Compute A _i = h(K)⊕K _s .

Compute g^A_i mod p and execute the hash operation for this value, h(g^A_i mod p).

Execute exclusive-or operation the received C _i and the value, h(g^A_i mod p) for the value n_i′ = C_i⊕h(g^A_i mod p).

To compute TID _i ′, S executes exclusive-or operation with the received value, CTID _i and the generated value n _i ′, TID _i ′ = CTID _i ⊕n _i ′. Then, S checks that TID _i ′ is the registered transform identity in the database. If the value is not valid, terminate the connection, otherwise, continue the process.

Compute M _i = K _u mod k _i .

S computes DID_i′ = h^M_i(TID_i⊕h(g^A_i mod p)) and compares the received value, DID _i and the generated value, DID _i ′ by the server. If DID _i ′ = DID _i , S authenticates the legitimate user, U _i . Otherwise, S fails authentication of U _i and S terminates the connection with U _i .

Generate nonce n _s .

Compute DID _s = h(DID _i ⊕n _i ⊕n _s ) and CTID _s = CTID _i ⊕n _s .

S sends DID _s and CTID _s to U _i .

Step 2. U _i → S : DID _is

User, U _i , authenticates S and mutual authentication is completed according to the following processes:

Compute n _s ′= CTID _s ⊕CTID _i .

U _i computes DID _s ′ = h(DID _s ⊕n _i ⊕n _s ′) and compares the received value, DID _s and the generated value, DID _s ′. If DID _s ′ = DID _s , the user, U _i authenticates the remote server, S. Otherwise, U _i fails server authentication and terminates connection with S.

U _i computes the value, DID _is = DID _s ⊕n _i ⊕(n _s +1) and sends DID _is to S.

S computes (n _s +1)′ = DID _is ⊕n _i ⊕DID _s , compares the value, (n _s +1) and the generated value, (n _s +1)′. If (n _s + 1′ = (n _s +1) mutual authentication is complete. Otherwise, S terminates connection with U _i .

OPEN IN VIEWER

Figure 2.

Login and authentication phase.

3.4 Secure Password Update Phase

When user U _i wants to change her password for personal reasons or for the sake of security, U _i can change her password freely. The proposed scheme provides secure password change The procedure is as follows:

U _i →S : DID _i , CTID _i , C _i , k _i , M _{request-change-PWi} U _i inserts the smart card into a reader and sends DID _i , CTID _i , C _i , and k _i with the request message, M _{request-change-PWi} to S.

Mutual authentication is performed between U _i and S, as in the login and authentication phase, mentioned earlier.

U _i generates new password, PW _i ^* and computes TID _i ^* = h(ID _i ⊕h(PW _i ^* ))

U _i → S : E _SKi {TID _i ^* } U _i encrypts new transform identity TID _i ^* using session key SK _i and sends the encrypted message to the server.

S decrypts the received message using SK _s and then replaces the value, TID _i with the received value TID _i ^* . S sends the response message to U _i .

After receiving the response message from S, U _i computes B _i ^* = B _i ⊕h(PW _i )⊕h(PW _i ^* ) and replaces stored values in the smart card TID _i and B _i with TID _i ^* and B _i with each other.

OPEN IN VIEWER

Figure 3.

Secure password update phase.

4. Security Analysis

In this section, we analyse the security of the proposed scheme. The proposed scheme can resist insider, replay, guessing, stolen-verifier and impersonation attacks, and provide user anonymity, forward secrecy, known-key security and mutual authentication for enhanced security.

5. Performance and Functionality Analysis

The proposed scheme achieves mutual authentication using only a one-way hash function and bitwise exclusive-or operation in a smart card. We prefer to adopt modular exponentiation, a relatively expensive operation, in the registration phase. However, it is performed only at the remote server. Thus, the proposed authentication in this paper is pertinent to using a practical smart card. In addition, it provides session key agreement and a secure password change. Table 2 compares performance.

OPEN IN VIEWER

Table 2.

Performance comparisons of authentication schemes.

	Registration	Login and Authentication	Key Agreement	Password Update
Our scheme	1C, 3H, 2⊕, 1M	8H+, 16⊕, 1M, 1A, 3O	Yes	Yes
Das et al.[15]	2H, 1⊕	8H, 14⊕, 1A, 2O	No	Yes
Liao et al.[14]	1C, 1H, 2⊕, 1M	4C, 3H, 13⊕, 1M, 2A, 3O	Yes	Yes
Lin et al.[8]	3C, 3H 1⊕	3C, 7H, 6⊕, 1O	No	No
Bindu et al.[6]	4H, 3⊕	2H, 8⊕, 1M, 2E, 2D, 3A, 3O	Yes	No
Juang[10]	1H, 1⊕	1C, 2H, 1⊕, 3E, 3D	Yes	No
Khan et al.[13]	2C, 2H, 1⊕	8C, 6H, 5⊕, 2A, 3O	Yes	Yes
Tseng et al.[16]	5H, 4⊕, 1A	10H, 19⊕, 2M, 2E, 2D, 3A	Yes	Yes

C : Concatenation

H : One-way hash function

⊕: Bitwise exclusive-or

M : Modular exponentiation

E : Encryption

D : Decryption

A : Arithmetic operation, such as add, subtraction and absolute value.

O : Comparison operation

+ : More

We summarize the functionalities of our proposed scheme in this section. The crucial criteria in the user authentication scheme are listed below:

F1. Freely chosen password: in the registration phase, a user can choose her identity and password freely for remote-access services.

F2. Secure password change: the user can change her password when she wants to change her password for the sake of security. In our scheme, after the user and server are authenticated, the password change is securely accomplished. Then, the generated value TID _i ^* is encrypted by the session key and transmitted to the server.

F3. No verification table: if the server maintains the verification table, when the verification table is revealed to an adversary, the overall authentication mechanism breaks down. Our scheme does not maintain the verification table with the user identity and corresponding password for user authentication. Only the server has a transformed identity table for user authentication.

F4. Low computation: computation overhead must be low in smart cards due to their constrained resources. Our scheme accomplishes mutual authentication merely by hash operation and bitwise exclusive-or operation.

F5. Mutual authentication: a malicious person can disguise herself as the server or can disguise herself as the user. However, our scheme can provide mutual authentication between user and server.

F6. Session key agreement: the user and the server communicate via a common channel after mutual authentication is accomplished. The session key agreement is provided for secure transmission of the important messages. The security of the session key is very important. Our scheme provides session key agreement and at the end of the key exchange, the session key is known to nobody but the user and the server.

F7. Avoiding time synchronization: our scheme adopts a nonce instead of using a time-stamp to prevent replay attacks and a synchronization problem. Thus, our scheme does not need time synchronization between user and server.

F8. User anonymity: our scheme uses dynamic identity for user anonymity. Whenever a user connects to the server for remote-access services, she sends a different identity. Thus, our scheme provides user anonymity.

Table 3 compares functionality. The proposed scheme satisfies the required functionalities.

OPEN IN VIEWER

Table 3.

Functionality comparisons of authentication schemes.

		F2	F3	F4	F5	F6	F7	F8
Our scheme	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Das et al[15]	Yes	No	Yes	Yes	Yes	No	No	No
Liao et al[14]	Yes	No	Yes	Yes	Yes	Yes	Yes	No
Lin et al[8]	No	No	Yes	Yes	No	No	No	No
Bindu et al[6]	Yes	No	Yes	Yes	Yes	Yes	No	Yes
Juang[10]	Yes	No	Yes	Yes	Yes	Yes	Yes	No
Khan et al[13]	Yes	No	Yes	Yes	Yes	No	No	Yes
Tseng et al[16]	Yes	Yes	Yes	Yes	Yes	Yes	No	Yes

F1. Freely chosen password

F2. Secure password change

F3. No verification table

F4. Low calculation for authentication

F5. Mutual authentication

F6. Session key agreement

F7. Avoiding time synchronization

F8. User anonymity

6. Conclusion

In this paper we proposed a security enhancement scheme of mutual authentication and user anonymity using smart cards. The proposed scheme does not send the user specific value in the login and authentication phase. Thus, it achieves user anonymity. The proposed scheme can resist insider, replay, guessing, stolen-verifier and impersonation attacks, and provides forward secrecy, known-key security and mutual authentication to enhance security. A user can freely choose her password and can change the password safely. In addition, our scheme provides the following functionalities: no verification table, avoiding time synchronization, eviction mechanism, session key agreement and low computation.