An Improved Biometric-Based User Authentication Scheme for C/S System

Abstract

The authors first review the recently proposed Das's biometric-based remote user authentication scheme, and then show that Das's scheme is still insecure against some attacks and has some problems in password change phase. In order to overcome the design flaws in Das's scheme, an improvement of the scheme is further proposed. Cryptanalysis shows that our scheme is more efficient and secure against most of attacks; moreover, our scheme can provide strong mutual authentication by using verifying biometric, password as well as random nonces generated by the user and server.

1. Introduction

In a client/server system, the validity of remote user is necessary to assure the security of the system. Traditional remote identity-based authentication schemes [1–9] are based on passwords only. However, simple passwords are always easy to break by using simple dictionary attacks since they have low entropy. To overcome this problem, cryptographic secret keys and passwords are used in the remote user authentication schemes. But the long and random cryptographic keys are difficult to memorize and hence they must be stored somewhere [10]; it is expensive to maintain the long cryptographic keys. Furthermore, both passwords and cryptographic keys are unable to provide nonrepudiation because they can be forgotten or lost or when they are shared with other people, there is no-way to know who the actual user is [11]. A biometric system operates by acquiring biometric data from an individual, extracting a feature set from the acquired data and comparing this feature set against the template set in the database [12–14]. In [3], the authors propose an online $(t,n)$ threshold secret sharing scheme based on biometric verification and threshold password authentication. In [15], a continuous user authentication scheme based on biometric verification by fusing hard and soft traits is proposed irrespective of user posture in front of the system. In [16], a BIO3G protocol based on biometric authentication for 3G mobile environments is proposed to provide real end to end strong user authentication. In [17], the author analyzes the security of Das's biometric-based authentication scheme and shows that the scheme is still insecure against some attacks and does not provide mutual authentication between the user and server. In [18], the author proposes an enhanced scheme based on biometric verification and smart card to remove the security weakness of Das's scheme analyzed in [17]. However, the proposed scheme in [18] cannot withstand the replay attack between the user and the remote server. In the abovementioned schemes, biometric verification allows one to confirm or establish an individual identity. Therefore, biometric keys are proposed which are based on physiological and behavioral characteristics of persons such as fingerprints, faces, irises, hand geometry, and palm prints. Some advantages of biometric keys are described as follows [19, 20].

• (i)

Biometric keys cannot be lost or forgotten.

(ii)

Biometric keys are very difficult to copy or share.

(iii)

Biometric keys are extremely hard to forge or distribute.

(iv)

Biometric keys cannot be guessed easily.

(v)

Someone's biometrics is not easier to break than others.

As a result, biometric-based remote user authentications are inherently more reliable and secure than usual traditional password-based remote user authentication schemes.

In this paper, we propose an improvement of Das's biometric-based remote user authentication scheme using smart cards in order to withstand his design flaws. The remainder of this paper is organized as follows. In Section 2, we briefly review the Das's biometric-based remote user authentication scheme using smart cards [21]. In Section 3, we analyze the design flaws in Das's scheme. In Section 4, we propose an improvement of the scheme in order to eliminate the design flaws discussed in Section 3. Security analysis of our scheme and performance comparison with other related schemes are implemented in Section 5. Finally, we conclude the paper in Section 6.

2. Review of DAS's Biometric-Based Remote User Authentication Scheme

In this section, we review in brief Das's biometric-based remote user authentication scheme [21]. For describing the Das's scheme [21], we use the notations shown in Table 1. Das's scheme consists of the following four phases, namely, registration phase, login phase, authentication phase, and change password phase. Details of each phase are given in the following subsections.

Table 1

Notations used in the proposed scheme.

Notation	Description
$C_i$	Client
$R_i$	Trusted registration center
$S_i$	Server
${\text{PW}}_i$	Password shared between $C_i$ and $S_i$
${\text{ID}}_i$	Identity of the user $C_i$
$B_i$	Biometric template of the user $C_i$
$d(·)$	Symmetric parametric function
τ	Predetermined threshold for biometric verification
$h(·)$	A secure one-way hash function
$X_s$	A secret information maintained by the server
$R_c$	A random number chosen by $C_i$
$R_s$	A random number chosen by $S_i$
$A\parallel B$	Data A concatenates with data B
$A\oplus B$	XOR operation of A and B

2.1. Registration Phase

In order to login to the system, the remote user $C_i$ needs to perform the following stages, as shown in Algorithm 1.

Algorithm 1: Registration phase of Das's scheme.

  $C_i$               $S_i$

 (1)  $\stackrel{{\text{ID}}_i\hspace{0.17em}{B}_i\hspace{0.17em}{\text{PW}}_i}{\to }$

      (2) Computes $r_i$ and $e_i$

        $f_i=h(B_i)$

        $r_i=h({\text{PW}}_i)\oplus f_i$

        $e_i=h({\text{ID}}_i\parallel X_s)\oplus r_i$

 (3)  $\stackrel{\text{Smart card}\left({\text{ID}}_i,\hspace{0.17em}h\left(·\right),\hspace{0.17em}{f}_i,\hspace{0.17em}{r}_i,\hspace{0.17em}{e}_i\right)}{\leftarrow }$

Step 1. The user inputs his/her personal biometric $B_i$ on a specific device and offers his/her password ${\text{PW}}_i$ and the identity ${\text{ID}}_i$ of the user to the registration center $R_i$ in person.

Step 2. The registration center $R_i$ then computes $f_i=h(B_i)$ , $r_i=h({\text{PW}}_i)\oplus f_i$ , and $e_i=h({\text{ID}}_i\parallel X_s)\oplus r_i$ . Here $X_s$ is secret information generated by the server.

Step 3. Finally, the registration center $R_i$ loads $({\text{ID}}_i,h(·),f_i,e_i,r_i)$ on the user's smart card and sends the information to the user $C_i$ via a secure channel.

2.2. Login Phase

In this phase, if a user $C_i$ wants to login to the server $S_i$ , he/she needs to perform the following steps, as shown in Algorithm 2.

Algorithm 2: Login phase of Das's scheme.

$C_i$                        $S_i$

(1) Inserts the smart card and $B_i$

(2) Verifies whether $B_i$ matches with template stored in system?

(3) If it holds, then $C_i$ inputs his/her password ${\text{PW}}_i$

(4) Computes $r_i^{\prime }=h({\text{PW}}_i)\oplus f_i$

(5) Checks if $r_i^{\prime }=r_i$ ?

(6) If it holds, the smart card computes the following:

  $M_1=e_i\oplus r_i^{\prime }$

  $M_2=M_1\oplus R_c$

  $M_3=h$ ( $R_c$ )

(7)  $\stackrel{〈{\text{ID}}_i,\hspace{0.17em}{M}_2,\hspace{0.17em}{M}_3〉}{\to }$

Step 1. $C_i$ first inserts his/her smart card into the smart card reader of a terminal and offers his/her personal biometric template, $B_i$ , on the specific device to verify his/her biometric.

Step 2. Next, the user's personal biometric template $B_i$ is matched against the template stored in the system.

Step 3. If the above verification does not hold, then $C_i$ does not pass the biometric verification and, as a result, the remote user authentication is terminated. Otherwise, on the other hand, if the abovementioned verification holds, $C_i$ passes the biometric verification and $C_i$ then inputs his/her password ${\text{PW}}_i$ to perform Step 4.

Step 4. The smart card computes $r_i^{\prime }=h({\text{PW}}_i)\oplus f_i$ . If $r_i^{\prime }\ne r_i$ , then password verification fails, and the client terminates the session.

Step 5. If $r_i^{\prime }=r_i$ , the smart card computes $M_{\mathrm{1}}=e_i\oplus r_i^{\prime }$ , which is equal to $h({\text{ID}}_i\parallel X_s)$ , $M_{\mathrm{2}}=M_{\mathrm{1}}\oplus R_c$ , which is equal to $h(\text{I}{\text{D}}_i\parallel X_s)\oplus R_c$ , and $M_3=h(R_c)$ , where $R_c$ is a random number generated by the user.

Step 6. Finally, $C_i$ sends the message $〈{\text{ID}}_i,M_{\mathrm{2}},M_{\mathrm{3}}〉$ to the remote server $S_i$ .

2.3. Authentication Phase

After receiving the login request message $〈{\text{ID}}_i,M_{\mathrm{2}},M_{\mathrm{3}}〉$ , $S_i$ performs the following steps, as shown in Algorithm 3, in order to authenticate whether the user $C_i$ is legal or not.

Algorithm 3: Authentication phase of Das's scheme.

$C_i$                              $S_i$

       (1) Checks whether the format of $C_i^{\prime }\text{s}$    ${\text{ID}}_i$ is valid or not.

       If above holds, $S_i$ computes the following:

        $M_4=h({\text{ID}}_i\parallel X_S)$

        $M_5=M_2\oplus M_4$

       (2)  Verifies whether $h(M_5)=M_3$ ?

       If it holds, then computes

        $M_6=M_4\oplus R_s$

        $M_7=h(M_2\parallel M_5)$

        $M_8=h(R_s)$

       (3)  $\stackrel{〈{\mathrm{M}}_{\mathrm{7}},\hspace{0.17em}{\mathrm{M}}_{\mathrm{6}},\hspace{0.17em}{\mathrm{M}}_{\mathrm{8}}〉}{\leftarrow }$

(4)Verifies whether $M_7=h(M_2\parallel R_c)$ ?

(5) If above holds, $C_i$ computes

$M_9=M_6\oplus M_1$

Verifies whether $h(M_9)=M_8?$

If it does not hold, $S_i$ is rejected by $C_i$

Otherwise, if it holds, then computes

$M_{\mathrm{10}}=h(M_6\parallel M_9)$

(6)   $\stackrel{〈{\mathrm{M}}_{\mathrm{10}}〉}{\to }$

       (7) Verifies whether $M_{\mathrm{10}}=h(M_6\parallel R_s)$ ?

       (8) If it holds, $S_i$ accepts $C_i^{\prime }\text{s}$ login request

       (9) Otherwise, $S_i$ rejects $C_i^{\prime }\text{s}$ login request

Step 1. $S_i$ first checks the format of $C_i$ 's    ${\text{ID}}_i$ .

Step 2. If the above format is valid, $S_i$ then computes $M_{\mathrm{4}}=h({\text{ID}}_i\parallel X_s)$ , $M_{\mathrm{5}}=M_{\mathrm{2}}\oplus M_{\mathrm{4}}$ and then verifies whether $h(M_{\mathrm{5}})=M_{\mathrm{3}}.$ If it does not hold, then $S_i$ rejects $C_i$ 's login request. In case the verification is successful, then $S_i$ computes $M_{\mathrm{6}}=M_{\mathrm{4}}\oplus R_s$ , $M_{\mathrm{7}}=h(M_{\mathrm{2}}\parallel M_{\mathrm{5}})$ , and $M_{\mathrm{8}}=h(R_s)$ .

Step 3. $S_i$ then sends the message $〈M_7,M_6,M_8〉$ to $C_i$ .

Step 4. After receiving the message in Step 3, $C_i$ verifies whether $M_{\mathrm{7}}=h(M_{\mathrm{2}}\parallel R_c).$ Thus, if the verification does not pass, $C_i$ terminates the session. Otherwise, $C_i$ proceeds as follows by computing $M_{\mathrm{9}}=M_{\mathrm{6}}\oplus M_{\mathrm{1}}(=R_s)$ and verifying further whether $h(M_{\mathrm{9}})=M_{\mathrm{8}}.$ If $h(M_{\mathrm{9}})\ne M_{\mathrm{8}}$ , $C_i$ terminates the session. On the other hand, $C_i$ computes $M_{\mathrm{10}}=h(M_{\mathrm{6}}\parallel M_{\mathrm{9}})$ and sends the message $〈M_{\mathrm{10}}〉$ to the server $S_i$ .

Step 5. After receiving $C_i$ 's message, $S_i$ verifies whether $M_{\mathrm{10}}=h(M_{\mathrm{6}}\parallel R_s).$

Step 6. If the abovementioned does not hold, $S_i$ rejects $C_i$ 's login request.

Step 7. In case the verification is successful, then only $S_i$ accepts $C_i$ 's login request.

2.4. Password Change

The password change phase of Das's scheme [21] has the following steps.

Step 1. It inserts the smart card into the card reader and offers $B_i$ .

Step 2. It verifies whether the user's personal biometric template $B_i$ matches against the template stored in the system.

Step 3. If $C_i$ passes the biometric verification, then only $C_i$ enters his/her old password ${\text{PW}}_i^{\text{old}}$ and new changed password ${\text{PW}}_i^{\text{new}}$ .

Step 4. The smart card then computes $r_i^{\prime }=h({\text{PW}}_i^{\text{old}})\oplus f_i$ ; if $r_i^{\prime }\ne r_i$ , the password change phase is terminated. If $r_i^{\prime }=r_i$ , then only smart card computes $r_i^{\prime \prime }=h({\text{PW}}_i^{\text{new}})\oplus f_i$ , $e_i^{\prime }=e_i\oplus r_i(=h(\text{I}{\text{D}}_i\parallel X_s))$ , and $e_i^{\prime \prime }=e_i^{\prime }\oplus r_i$ .

Step 5. Finally, replace $e_i$ with $e_i^{\prime \prime }$ and $r_i$ with $r_i^{\prime \prime }$ on the smart card.

3. Cryptanalysis of Das's Scheme

This section demonstrates that Das's scheme [21] has some drawbacks: denial-of-service attack, user impersonation attack, replay attack, and password change problem.

3.1. Denial-of-Service Attack

One of fundamental properties of a secure one-way hash function is that its outputs are very sensitive to small perturbations in their inputs. The cryptographic hash function cannot be applied straightforwardly when the input data are with noise such as biometrics [22]. Then the predetermined threshold for biometric verification cannot be used to measure outputs of hash functions. In the registration phase of Das's scheme, the register center $R_i$ computes $f_i=h(B_i)$ and $r_i=h({\text{PW}}_i)\oplus f_i$ and then stores $f_i$ and $r_i$ in the smart card. In the login phase, $C_i$ inserts his/her smart card into the card reader and provides his/her personal biometrics $B_i$ on a specific device to verify the users biometrics by verifying whether $h(B_i)=f_i$ or not. In Step 4 of login phase, password verification is performed by verifying whether $r_i^{\prime }=r_i$ . However, both the biometric verification and password verification procedures may result in serious flaws because $h(B_i)=f_i$ may never succeed, since the inputted biometrics belonging to the same person may differ slightly from time to time [22], so the next login and authentication procedure will be terminated. As a result, this may cause the legal user to be unable to pass biometric verification at the login phase of Das's scheme. Therefore, Das's scheme is vulnerable to the denial-of-service attack.

3.2. User Impersonation Attack

We see from the login and authentication phase of Das's scheme that an attacker can impersonate a legal user to access to the server. In the login phase of Das's scheme, since the user $C_i$ sends the message $〈{\text{ID}}_i,M_{\mathrm{2}},M_{\mathrm{3}}〉$ to the remote server $S_i$ where $C_i$ identity is not masked, this will result in user impersonation attack as follows.

When an attack denoted as $A_i$ wants to access the remote server, he/she can eavesdrop the message $〈{\text{ID}}_i,M_{\mathrm{2}},M_{\mathrm{3}}〉$ by tapping communication lines or wireless link between the legal user $C_i$ and the remote server $S_i$ . Once $A_i$ derives the message $〈{\text{ID}}_i,M_{\mathrm{2}},M_{\mathrm{3}}〉$ he can send the eavesdropped message to the remote server $S_i$ . Since the legal user's ID is not masked, so the check of user's validity can easily pass. We can clearly see that when $S_i$ computes $M_{\mathrm{4}}^{\prime }=h({\text{ID}}_i\parallel X_s)$ and $M_{\mathrm{5}}^{\prime }=M_{\mathrm{2}}\oplus M_{\mathrm{4}}^{\prime }$ , the verification of $h(M_{\mathrm{5}}^{\prime })=M_{\mathrm{3}}$ is successful. Then $S_i$ computes $M_{\mathrm{6}}^{\prime }=M_{\mathrm{4}}\oplus R_s$ , $M_{\mathrm{7}}^{\prime }=h(M_{\mathrm{2}}\parallel M_{\mathrm{5}}^{\prime })$ , and $M_{\mathrm{8}}^{\prime }=h(R_s)$ and then sends message $〈M_{\mathrm{7}}^{\prime },M_{\mathrm{6}}^{\prime },M_{\mathrm{8}}^{\prime }〉$ to $C_i$ . The attack $A_i$ may eavesdrops the message $〈M_{\mathrm{7}}^{\prime },M_{\mathrm{6}}^{\prime },M_{\mathrm{8}}^{\prime }〉$ and modifies the $M_{\mathrm{7}}^{\prime }$ , replaces it with $M_{\mathrm{7}}^{\mathrm{\prime \prime }}$ , and then sends a forged message $〈M_{\mathrm{7}}^{\mathrm{\prime \prime }},M_{\mathrm{6}}^{\prime },M_{\mathrm{8}}^{\prime }〉$ to $C_i$ . Obviously $M_{\mathrm{7}}^{\mathrm{\prime \prime }}\ne h(M_{\mathrm{2}}\parallel R_c)$ , so $C_i$ terminates the session. However, the attacker $A_i$ will pass the verification $〈M_{\mathrm{7}}^{\prime },M_{\mathrm{6}}^{\prime },M_{\mathrm{8}}^{\prime }〉$ , and $A_i$ computes $M_{\mathrm{9}}^{\prime }=M_{\mathrm{6}}^{\prime }\oplus M_{\mathrm{1}}=M_{\mathrm{6}}^{\prime }\oplus M_{\mathrm{4}}$ . Since the attack $A_i$ can verify $M_{\mathrm{9}}^{\prime }=M_{\mathrm{8}}^{\prime }$ , he proceeds as follows by computing $M_{\mathrm{10}}^{\prime }=h(M_{\mathrm{6}}^{\prime }\parallel M_{\mathrm{9}}^{\prime })$ and sends message $〈M_{\mathrm{10}}^{\prime }〉$ to the remote server $S_i$ . On receiving the message, the remote server $S_i$ will verify whether $M_{\mathrm{10}}^{\prime }=h(M_{\mathrm{6}}\parallel R_s)$ or not. We can see obviously that the above equation holds, so the remote $S_i$ accepts the attacker's login request and the user impersonation attack will occur sequentially.

3.3. Replay Attack

In Das's scheme, the replay and man-in-the-middle attack is withstood by checking whether $M_{\mathrm{5}}^{\prime }(=M_{\mathrm{2}}\oplus M_{\mathrm{4}})=M_{\mathrm{5}}$ , where $M_{\mathrm{5}}$ is equal to $R_c$ and is stored in the database of remote server $S_i$ . It is noted that $M_{\mathrm{5}}=M_{\mathrm{2}}\oplus M_{\mathrm{4}}\mathrm{\hspace{0.17em}\hspace{0.17em}}=M_{\mathrm{1}}\oplus R_c\oplus M_{\mathrm{4}}=R_c(M_{\mathrm{1}}=M_{\mathrm{4}})$ is disclosed to any user when one breaks the remote server $S_i$ . When the remote server $S_i$ is compromised by an attacker, he/she can change $〈{\text{ID}}_i,M_{\mathrm{5}}〉$ in the database of the remote server $S_i$ . Obviously, once $M_{\mathrm{5}}$ is changed, the replayed message $〈{\text{ID}}_i,M_{\mathrm{2}}^{\prime },M_{\mathrm{3}}^{\prime }〉$ will not be discarded and $M_{\mathrm{5}}$ will be replaced by $M_{\mathrm{5}}^{\prime }$ .

3.4. Password Change

In password change procedure of Das's scheme, if remote user $C_i$ wants to change his/her password, he/she must pass biometric verification by verifying $h(B_i)=f_i$ . However, the inputted biometrics belonging to the same person may differ slightly from time to time [22], so the password change procedure will be terminated. In addition, for more time, since $h(B_i)\ne f_i$ , then $r_i^{\prime }=h({\text{PW}}_i^{\text{old}})\oplus f_i$ computed by smart card is not equal to $r_i$ stored in the smart card, so the password change procedure will also be terminated. According to the above analysis, Das's scheme cannot realize the password change freely.

4. Proposed Scheme

In this section, we propose an improvement of the Das's biometric-based remote user authentication scheme [21] using smart cards in order to withstand the flaws discussed in Section 3. For convenience, we use the same notations used as in Das's scheme shown in Table 1.

4.1. Registration Phase

In order to login to the system, the remote user $C_i$ needs to perform the following steps, as shown in Algorithm 4.

Algorithm 4: Registration phase of our scheme.

$C_i$                 $S_i$

 (1)  $\stackrel{{\text{ID}}_i\hspace{0.17em}{B}_i\hspace{0.17em}{\text{PW}}_i}{\to }$

      (2) computes $f_i,g_i,r_i$ and $e_i$

        $f_i=h(B_i)$

        $g_i=h({\text{ID}}_i)$

        $r_i=h({\text{PW}}_i)\oplus f_i$

        $e_i=h(g_i\parallel X_s)\oplus r_i$

     (3)  $\stackrel{\text{Smart card}\left(h\left(·\right),\hspace{0.17em}{f}_i,\hspace{0.17em}{g}_i,\hspace{0.17em}{e}_i,\hspace{0.17em}{r}_i,\hspace{0.17em}\tau ,\hspace{0.17em}d\left(·\right)\right)}{\leftarrow }$

Step 1. The user $C_i$ inputs his/her personal biometric $B_i$ on a specific device and offers his/her password ${\text{PW}}_i$ and the identity ${\text{ID}}_i$ to the registration center $R_i$ in person.

Step 2. The registration center $R_i$ then computes $f_i=h(B_i)$ , $g_i=h({\text{ID}}_i)$ , $r_i=h({\text{PW}}_i)\oplus f_i$ , and $e_i=h(g_i\parallel X_s)\oplus r_i$ . Here $X_s$ is secret information generated by the server. We note that $X_s$ and passwords of the corresponding users are not disclosed to any others for all secure future communications.

Step 3. Finally, the registration center $R_i$ loads $(h(·),\hspace{0.17em}{f}_i,\hspace{0.17em}{g}_i,\hspace{0.17em}{e}_i,\hspace{0.17em}{r}_i,\hspace{0.17em}\tau ,\hspace{0.17em}d(·))$ on the user's smart card and sends this information to the user $C_i$ via a secure channel.

4.2. Login Phase

In order to login to the system, the remote user $C_i$ needs to perform the following stages, as shown in Algorithm 5.

Algorithm 5: Login phase of our scheme.

$C_i$                       $S_i$

(1) Inserts the smart card and inputs $B_i^{\prime }$

(2) Verifies whether $d(B_i,B_i^{\prime })<\tau$ ?

(3) If it holds, then $C_i$ inputs his/her password ${\text{PW}}_i$

(4) Computes $r_i^{\prime }=h({\text{PW}}_i)\oplus f_i$ and verifies whether $d(r_i,r_i^{\prime })<\tau$ ?

(5) If it holds, the smart card computes

   $M_1=e_i\oplus r_i^{\prime }$

   $M_2=h(R_c\parallel T)$

   $M_3=M_1\oplus M_2$

(6)  $\stackrel{〈g_i,\hspace{0.17em}{M}_2,\hspace{0.17em}{M}_3,\hspace{0.17em}T〉}{\to }$

Step 1. $C_i$ first inserts his/her smart card into the card reader of a terminal and offers his/her personal biometric template, $B_i^{\prime }$ , on the specific device. If $d(B_i,B_i^{\prime })>\tau$ , the remote user authentication is terminated. Otherwise, $C_i$ passes the biometric verification and then inputs his/her password ${\text{PW}}_i$ to perform Step 2.

Step 2. The smart card computes $r_i^{\prime }=h({\text{PW}}_i)\oplus f_i$ . If $d(r_i^{\prime },r_i)>\tau$ , then password verification fails, and the system terminates the session; otherwise, the smart card computes $M_{\mathrm{1}}=e_i\oplus r_i^{\prime }$ , which is equal to $h(g_i\parallel X_s)$ , $M_{\mathrm{2}}=h(R_c\parallel T)$ , where $R_c$ is a random number generated by the user $C_i$ and T is the current timestamp of $C_i$ 's system, and $M_{\mathrm{3}}=M_{\mathrm{1}}\oplus M_{\mathrm{2}}$ .

Step 3. Finally, the user $C_i$ sends the message $〈g_i,M_{\mathrm{2}},M_{\mathrm{3}},T〉$ to the remote server $S_i$ .

4.3. Authentication Phase

When the remote server $S_i$ receives the login request $〈g_i,M_{\mathrm{2}},M_{\mathrm{3}},T〉$ at time   $T^{*}$ , it will perform the following steps as shown in Algorithm 6 to authenticate whether the user $C_i$ is legal or not.

Algorithm 6: Authentication phase of our scheme.

    $C_i$               $S_i$

        (1) When receiving $〈g_i,M_2,M_3,T〉$ ,

           $S_i$ checks $(T^{*}-T)>\mathrm{\Delta }T$ ?

        (2) $S_i$ computes $M_4=h\left(g_i\parallel X_s\right)$ ,

           ${\mathrm{M}}_{\mathrm{5}}={\mathrm{M}}_{\mathrm{4}}\oplus {\mathrm{M}}_{\mathrm{3}}$ , and verifies whether $M_{\mathrm{5}}=M_{\mathrm{2}}$ ?

        (3) $S_i$ computes $M_6=h(R_s\parallel T_s)$ ,

           $M_7=M_4\oplus M_6$ ,

          $\stackrel{〈M_4,\hspace{0.17em}{M}_6,\hspace{0.17em}{M}_7,\hspace{0.17em}{T}_s\mathrm{\hspace{0.17em}\hspace{0.17em}}〉.}{\leftarrow }$

(4) When receiving $〈M_4,\hspace{0.17em}{M}_6,\hspace{0.17em}{M}_7,\hspace{0.17em}{T}_s\mathrm{\hspace{0.17em}\hspace{0.17em}}〉$

  at $T^{**}$ , $C_i$ checks $(T^{**}-T)>\mathrm{\Delta }T$ ?

  computes $M_8=M_4\oplus M_7$ , then verifies $M_8=M_6$ ?

(5) $C_i$ computes $M_9=M_4\oplus M_6$ , then verifies $M_9=M_7$ ? computes $M_{\mathrm{10}}=h(R_c\parallel T^{\prime })$ , and

  then $M_{\mathrm{11}}=M_7\oplus M_{\mathrm{10}}$ ,

   $\stackrel{〈M_{\mathrm{11}},\hspace{0.17em}{R}_c,\hspace{0.17em}{T}^{\prime }〉.}{\to }$

        (6) When receiving $〈M_{\mathrm{11}},\hspace{0.17em}{R}_c,\hspace{0.17em}{T}^{\prime }〉$ at $T^{***}$ , $S_i$ verifies $(T^{***}-T)>\mathrm{\Delta }T$ ?

           then computes  ${\mathrm{M}}_{\mathrm{12}}=h(R_c\parallel T^{\prime })$ ,

            $M_{\mathrm{13}}=M_4\oplus M_6\oplus M_{\mathrm{12}}$ , then verifies $M_{\mathrm{13}}=M_{\mathrm{11}}$ ?

           If it holds, $S_i$ accepts $C_i^{\prime }s$ login request.

Step 1. Verify T. If $(T^{*}-T)>\Delta T$ , the authentication phase aborts, where $\Delta T$ is the expected time interval for the transmission delay of the system. On the contrary, if $(T^{*}-T)\le \Delta T$ , the next step will be performed.

Step 2. $S_i$ checks the format of $C_i$ 's    ${\text{ID}}_i$ . It computes $M_{\mathrm{4}}=h(g_i\parallel X_s)$ using the secret value $X_s$ maintained by the server $S_i$ and then computes $M_{\mathrm{5}}=M_{\mathrm{4}}\oplus M_{\mathrm{3}}$ and verifies whether $M_{\mathrm{5}}=M_{\mathrm{2}}$ . If it does not hold, then $S_i$ rejects $C_i$ 's login request. In case the verification is successful, the next step will be performed.

Step 3. $S_i$ computes $M_6=h(R_s\parallel T_s)$ and $M_7=M_4\oplus M_6$ , where $T_s$ is the current timestamp of the server $S_i$ , and then $S_i$ sends message $〈M_4,M_6,M_7,T_s〉$ to the user $C_i$ .

Step 4. After receiving the message $〈M_4,M_{\mathrm{6}},M_7,T_s〉$ at time $T^{**}$ , $C_i$ first checks the freshness of $T_s$ by verifying $(T^{**}-T_s)>\Delta T.$ If it holds, the following session is terminated; otherwise $C_i$ computes $M_{\mathrm{8}}=M_{\mathrm{4}}\oplus M_{\mathrm{7}}$ and then verifies whether $M_{\mathrm{8}}=M_{\mathrm{6}}.$ If it does not hold, $C_i$ terminates the session. Otherwise, it goes to the next step.

Step 5. $C_i$ computes $M_{\mathrm{9}}=M_{\mathrm{4}}\oplus M_{\mathrm{6}}$ and then verifies whether $M_{\mathrm{9}}=M_{\mathrm{7}}.$ If it does not hold, $S_i$ is rejected by $C_i$ ; otherwise, if it holds, $C_i$ computes $M_{\mathrm{10}}=h(R_c\parallel T^{\prime })$ , where $T^{\prime }$ is the current timestamp of the user $C_i$ , and then computes $M_{\mathrm{11}}=M_{\mathrm{7}}\oplus M_{\mathrm{10}}$ and sends the message $〈M_{\mathrm{11}},R_c,T^{\prime }〉$ to the remote server $S_i$ .

Step 6. When $S_i$ receives the message $〈M_{\mathrm{11}},R_c,T^{\prime }〉$ at time $T^{***}$ , it verifies $(T^{***}-T^{\prime })>\Delta T$ . If it holds, the authentication phase is terminated. Otherwise, if it does not hold, $S_i$ computes $M_{\mathrm{12}}=h(R_c\parallel T^{\prime })$ and then computes $M_{\mathrm{13}}=M_{\mathrm{4}}\oplus M_{\mathrm{6}}\oplus M_{\mathrm{12}}$ . After computing $M_{\mathrm{13}}$ , then $S_i$ verifies whether $M_{\mathrm{13}}=M_{\mathrm{11}}.$ If it holds, $S_i$ accepts $C_i$ 's login request; otherwise, $S_i$ rejects the login request.

4.4. Password Change

In our scheme, user $C_i$ can freely change the password ${\text{PW}}_i^{\text{old}}$ to a new one ${\text{PW}}_i^{\text{new}}$ . The password change procedure is performed as follows.

Step 1. $C_i$ inserts the smart card into the card reader and offers his/her personal biometrics $B_i^{\prime }$ ; then the smart card computes $f_i^{\prime }=h(B_i^{\prime })$ and verifies it by checking $d(f_i^{\prime },f_i)\le \tau .$ where $f_i=h(B_i)$ is the information stored in the smart card.

Step 2. If it holds, $C_i$ inserts old password ${\text{PW}}_i^{\text{old}}$ and new password ${\text{PW}}_i^{\text{new}}$ ; otherwise the password change procedure is terminated.

Step 3. Smart card performs $r_i^{\prime }=h({\text{PW}}_i^{\text{old}})\oplus f_i^{\prime }$ and checks $d(r_i^{\prime },r_i)\le \tau .$ where $r_i$ is the information stored in the smart card.

Step 4. If it holds, the smart card computes $r_i^{\mathrm{\prime \prime }}=h({\text{PW}}_i^{\text{new}})\oplus f_i$ , $e_i^{\prime }=e_i\oplus r_i(=h({\text{ID}}_i\parallel X_s))$ , and $e_i^{\prime \prime }=e_i^{\prime }\oplus r_i$ .

Step 5. Finally, replace $e_i$ with $e_i^{\prime \prime }$ and $r_i$ with $r_i^{\mathrm{\prime \prime }}$ on the smart card.

5. Security Analysis and Performance of the Proposed Scheme

5.1. Security Analysis

If a legal user lost his/her smart card, it is extremely hard for an adversary to derive the user's sensitive information such as user's identity, password, and biometrics because the extraction of parameters from the smart card is quite difficult. Furthermore, the adversary cannot change the password because he/she cannot pass the biometric verification.

5.1.1. Denial-of-Service Attack

In our proposed protocol, we take into account hash function's sensitivity to small perturbations in its inputs. In the login phase, user's biometric verification is performed by checking $d(B_i,B_i^{\prime })>\tau$ instead of checking $h(B_i^{\prime })=f_i$ . Moreover, the password verification is performed by checking $d(r_i^{\prime },r_i)>\tau$ instead of $r_i^{\prime }=r_i$ . So denial-of-service attack caused by hash function's fundamental properties can be withstood.

5.1.2. Stolen-Verifier Attack

Our scheme can resist stolen-verifier attack because the scheme is free from the verifier/password table. In our protocol, the remote server $S_i$ does not keep password tables. Therefore, an attacker cannot steal user's password from $S_i$ . Moreover, the password is masked by hash function in the procedure of message transfer between the user $C_i$ and remote server $S_i$ .

5.1.3. Many Logged-In Users Attack

Most systems, which maintain the password table to verify user login, are vulnerable to this kind of threat. Our scheme can resist the threat since our scheme requires on-card computation for login to the remote server $S_i$ , and once the smart card is removed, the login process will be aborted.

5.1.4. Guessing Attack

Our protocol can resist guessing attack, which is a critical concern in password-based systems, since the password in our protocol is transmitted as a digest of some other secret information. The attacker cannot guess the user's password from the digest because of the one-way characteristic of the hash function, even if the attacker may get the digest which contains the password.

5.1.5. Replay Attack

Replaying an intercepted message can be prevented in our proposed protocol. If an attacker intercepts $〈{\text{ID}}_i,M_{\mathrm{2}},M_{\mathrm{3}},T〉$ and tries to login to the remote server $S_i$ via replaying the same message, he/she cannot pass the verification of the login request due to $(T^{*}-T)>\Delta T$ , where $T^{*}$ is the system time when the remote server $S_i$ receives the replayed message. Moreover, if an attacker intercepts $〈M_{\mathrm{4}},M_{\mathrm{6}},M_{\mathrm{7}},T_s〉$ and tries to replay the message to the user $C_i$ , this kind of attack also can be prevented due to $(T^{**}-T_s)>\Delta T$ .

5.1.6. User Impersonation Attack

In the login phase of our scheme, the message sent to remote server $S_i$ is $〈g_i,M_{\mathrm{2}},M_{\mathrm{3}},T〉$ instead of $〈{\text{ID}}_i,M_{\mathrm{2}},M_{\mathrm{3}},T〉$ , where the user's identity ${\text{ID}}_i$ is masked by hash function. Even though an attacker eavesdrops the message $〈g_i,M_{\mathrm{2}},M_{\mathrm{3}},T〉$ , he cannot derive the user's identity, ${\text{ID}}_i$ , due to the one-way characteristic of hash function. In the authentication phase, when the remote server $S_i$ receives the login request message $〈g_i,M_{\mathrm{2}},M_{\mathrm{3}},T〉$ , it will check the validity of user's identity. Since the attacker cannot derive legal user's identity, the check of user's identity cannot pass which will result in the termination of authentication phase. Through the above analysis, we can see that user impersonation attack can be avoided in our scheme.

5.1.7. Server Masquerading Attack

If an attack $A_i$ attempts to masquerade as the legitimate server $S_i$ , he/she must make the forged replay message to the user when receiving the user's login request message $〈g_i,M_{\mathrm{2}},M_{\mathrm{3}},T〉$ . However, the forged replay message is more difficult to fake since the time-stamped message $〈M_{\mathrm{4}},M_{\mathrm{6}},M_{\mathrm{7}},T_s〉$ is sent to the user $C_i$ when the remote server $S_i$ is receiving $C_i$ 's login request message $〈g_i,M_{\mathrm{2}},M_{\mathrm{3}},T〉$ . Moreover, the attacker $A_i$ cannot masquerade as the server by forging the replay message $〈M_{\mathrm{4}},M_{\mathrm{6}},M_{\mathrm{7}},T_s〉$ , because $A_i$ cannot compute $(M_{\mathrm{4}},M_{\mathrm{7}})$ sending to the user $C_i$ without knowing the secret value $X_s$ kept by the server $S_i$ . Hence, the attacker $A_i$ cannot masquerade as the legal server to the user by launching the server masquerading attack.

5.1.8. Insider Attack

In the registration phase, if the user's password ${\text{PW}}_i$ and the biometrics information $B_i$ are revealed to the server $S_i$ , the insider of the server may directly obtain ${\text{PW}}_i$ and $B_i$ , and the insider impersonates as the user $C_i$ to access the user's other accounts in the server. But in the login phase of our scheme, if the insider wants to access $C_i$ 's other accounts, he/she must input his/her smart card to the card reader and provide his biometric information $B_i^{\prime }$ in order to pass the verification $d(B_i,B_i^{\prime }\mathrm{\hspace{0.17em}\hspace{0.17em}})<\tau$ . Since the insider cannot provide the user $C_i$ 's smart card, the biometric verification will be aborted. So the insider attack can be prevented.

5.1.9. Mutual Authentication

As described above, our scheme can withstand the user impersonation attack and server masquerading attack; consequently our scheme can provide mutual authentication between the user $C_i$ and remote server $S_i$ .

5.1.10. Man-in-the-Middle Attack

Man-in-the-middle attack means that an active attacker intercepts the communication line between a legal user and the server and uses some means to successfully masquerade as both the server to the user and the user to the server. Then, the user will believe that he is talking to the intended server and vice versa. In our scheme, when a user $C_i$ wants to login to the remote server $S_i$ , mutual authentication between the user $C_i$ and remote server $S_i$ is performed, so man-in-the-middle attack can be prevented.

5.2. Performance of the Proposed Scheme

In this subsection, we compare the performances of our improved scheme with those for Li-Hwang's scheme [11] and Das's scheme [21]. It is worth recalling that the protocol of Li-Hwang's scheme [11] has security weaknesses against denial-of-service attack, replay attack, user impersonation attack, and man-in-the-middle attack. It is noted that Das's scheme [21] has security weaknesses against denial-of-service attack, user impersonation attack, replay attack, server masquerading attack, and insider attack. The security comparisons between our scheme and the schemes proposed by Li and Hwang [11] and Das [21] are summarized in Table 2. For the convenience of evaluating the efficiency of related scheme, we define the notation $T_h$ , the time of executing a one-way hash function. The efficiency comparison with related schemes is shown in Table 3. From the table, we can see that our scheme is more efficient than Das's scheme [21]. Though our scheme is less efficient than Li-Hwang's scheme [11], it can provide better security against most attacks.

Table 2

Security comparisons among related protocols.

Item	Our scheme	Li-Hwang's scheme [11]	Das's scheme [21]
Avoiding denial-of-service attack	Yes	No	No
Avoiding stolen-verifier attack	Yes	Yes	Yes
Avoiding many logged-in users attack	Yes	Yes	Yes
Avoiding guessing attack	Yes	Yes	No
Avoiding replay attack	Yes	No	No
Avoiding user impersonation attack	Yes	No	No
Avoiding server masquerading attack	Yes	No	No
Avoiding man-in-the-middle attack	Yes	No	Yes
Avoiding insider attack	Yes	No	No
Mutual authentication	Yes	No	No
Having flaws in password change	No	Yes	Yes

Table 3

Efficiency comparison with related schemes.

Different phase	Li-Hwang's Scheme [11]	Das's scheme [21]	Our scheme
Registration
User computation cost	2 $T_h$	—	4 $T_h$
Server computation cost	—	3 $T_h$	—
Login
User computation cost	3 $T_h$	3 $T_h$	3 $T_h$
Server computation cost	—	—	—
Authentication
User computation cost	2 $T_h$	3 $T_h$	$T_h$
Server computation cost	3 $T_h$	5 $T_h$	3 $T_h$

6. Conclusion

This paper presents a biometric-based user authentication scheme for client/server system. The method employs biometric keys and resists the threats of stolen-verifier, of which many are logged-in users with the same login identity, denial-of-service attack, guessing attack, insider attack, replay attack, user impersonation attack, server masquerading attack, and man-in-the-middle attack. Moreover, the improved scheme can realize mutual authentication between the user and remote server. The proposed scheme uses only hash function and XOR operation, which is efficient compared with that of related protocols. In addition, the user's password can be changed freely using the proposed scheme. Our proposed scheme provides strong authentication with the help of verifying biometrics, passwords, and random nonces generated by the user and server as compared to that of related schemes.