A Remote User Authentication Scheme with Anonymity for Mobile Devices

Abstract

With the rapid growth of information technologies, mobile devices have been utilized in a variety of services such as e-commerce. When a remote server provides such e-commerce services to a user, it must verify the legitimacy of the user over an insecure communication channel. Therefore, remote user authentication has been widely deployed to verify the legitimacy of remote user login requests using mobile devices like smart cards. In this paper we propose a smart card-based authentication scheme that provides both user anonymity and mutual authentication between a remote server and a user. The proposed authentication scheme is a simple and efficient system applicable to the limited resource and low computing performance of the smart card.

The proposed scheme provides not only resilience to potential attacks in the smart card-based authentication scheme, but also secure authentication functions. A smart card performs a simple one-way hash function, the operations of exclusive-or and concatenation in the authentication phase of the proposed scheme. The proposed scheme also provides user anonymity using a dynamic identity and key agreement, and secure password change.

1. Introduction

The main aim of the remote authentication scheme using smart cards is to identify and verify the smart card holder with valid access rights and access to the remote server. It has been widely accepted that the smart card-based remote user authentication is one of the most reliable and secure forms of electronic identification for authentication. Therefore, a variety of password-based authentication schemes have been proposed for remote authentication using smart cards. In a traditional remote authentication scheme, a user has to register her own identity and password to the server in advance, and she has to submit the identity and password information to the server during a login process. On receiving a login request, the remote server authorizes the user to access facilities provided by the remote server, if the pair of identity and password is equivalent to the one stored in the server's password table. Otherwise, the access request is rejected.

The desirable security requirements of an authentication scheme using smart cards are as follows. The scheme should resist malicious insider, replay, guess, stolen-verifier and impersonation attacks. Also, the scheme should provide both forward secrecy and known-key security, guaranteeing user anonymity.

The desirable functionality requirements of an authentication scheme are as follows. A user chooses her identity and password freely and changes her password securely, and a remote server does not maintain a verification table to authenticate the user in the server. Due to the power constraints of smart cards, the computational cost of the scheme has to be low and the scheme should provide mutual authentication, user anonymity and session key agreement between a user and a server without requesting time-synchronization between user and server.

In this paper we propose an enhanced authentication scheme using smart cards. Our scheme satisfies the security requirements and functions.

The remainder of this paper is organized as follows: section 2 reviews related works; section 3 details the proposed authentication scheme; section 4 analyses its security; section 5 analyses its performance and functionality. Finally, Section 6 draws brief conclusions.

2. Related Works

A number of remote authentication schemes have been suggested by researchers from time to time. When a server authenticates a user, the server verifies the user with the entered user's identity and password, and the corresponding values in the verification table of the server. In 1981, Lamport [1] presented a remote authentication scheme using password tables, but security holes and maintenance responsibilities for the verification table exist because it must always maintain the verification table. Also, a stolen verification table may cause many security threats, therefore, in 1990, Hwang [2] presented a remote authentication scheme without password tables. Many other studies have also proposed a scheme that does not maintain the verification table to authenticate the remote user.

Numerous studies [7–16] have proposed a scheme using the one-way hash function and exclusive-or operation due to the constrained resources and computing power of a smart card.

After the user's authentication is completed, the communication channel for a message may be insecure. If the message is not encrypted, then the message is revealed to an adversary. Therefore, previous studies [11–14, 16] have proposed session key generation schemes using key agreement between user and server, and researchers have also pointed to the weaknesses of other schemes [3, 4].

Because the user's anonymity is very important in many e-commerce applications, several schemes [5, 6, 9, 12-13, 15, 16] have been proposed to achieve user anonymity in the authentication phase.

Table 1.

The notations used in the proposed scheme.

Notations	Description
U i	User i
PW i	The password of U i
S	The remote server
K s	The secret key of server
K u	The common key of user for S
TID i	The transformed identity of U i
CTID i	The changed identity of U i
DID i	The dynamic identity of U i
DID s	The dynamic identity of S
SK i	The generated session key of U i
SK u	The generated session key of S
h(·)	A one-way hash function
h k (A)	Perform hash function of k times
⊕	Bitwise exclusive-or operation
‖	The string concatenation
A ⇒ B: M	A sends M to B through a secure channel
A → B: M	A sends M to B through a common channel
ESK i {M}	Encrypted message by the session key, SK i

Bindu et al. [6] showed the possibility of insider attack, Main-in-Middle attack, in the scheme of Chien et al. [5] and presented an improved scheme preserving user anonymity. However, the scheme does not provide a password change phase and uses time-stamp to resist replay attack. Lin et al. [8] presented a new strong-password authentication protocol that can withstand a stolen-verifier attack and other possible attacks, but the scheme cannot change passwords and does not provide mutual authentication, session key agreement and user anonymity. Juang [10] presents a simple authentication scheme, but the scheme cannot change passwords and does not provide mutual authentication. Recently, Khan et al. [13] and Tseng et al. [16] presented authentication schemes providing user anonymity and mutual authentication. With the scheme proposed by Tseng et al. [16] the user can freely choose the password and securely change the password, however, both schemes require time synchronization to protect from replay attack.

Here, we point to security issues related to Das et al.'s scheme [15] and Liao et al.'s scheme [14].

• 1) Both schemes submit a user password directly to the server in the registration phase. Thus, their schemes are vulnerable to insider attacks. If a malicious insider obtains a user password in the registration phase, she may be able to access the other server over a network, because generally, a user is apt to use the same password for convenience, even for most other servers.

• 2) Neither scheme provides user anonymity. Although Das et al.'s scheme uses a dynamic identity in the verification phase as the user login in the remote server, she always sends the user specific value, Ni. Therefore, the user's location is revealed to the adversary. In Liao et al.'s scheme, a user sends her identity directly via a common channel. Thus, an adversary can know the user's location.

• 3) Neither scheme provides secure password change as their password change phase is insecure. When a user inputs the wrong password by mistake, the smart card's password is changed to the wrong password.

• 4) Das et al.'s scheme does not provide mutual authentication. The server can authenticate a user, but a user cannot authenticate the remote server.

• 5) Das et al.'s scheme does not have a session key agreement. After mutual authentication between user and server, important messages have to be protected from adversaries, thus, session key agreement is needed. However, Das et al.'s scheme does not provide session key agreement.

• 6) Das et al.'s scheme requires time synchronization and uses time-stamp for replay attack. Thus, it requires time synchronization between user and server.

3. Proposed Authentication Scheme

In this section, we propose an enhanced security scheme for mutual authentication and user anonymity using a smart card. The proposed scheme overcomes the weaknesses of Das et al.'s scheme and Liao et al.'s scheme, while it enhances security compared to the existing schemes. The proposed scheme is composed of four phases: registration, login and authentication, key agreement and secure password update. Table 1 is the notation used in the proposed scheme.

3.1 Registration Phase

When user U _i wants to access a remote server for a service legitimately, U _i should perform the following registration steps before the access. The procedure is as follows:

Step 1. U _i ⇒ S: ID _i , h(PW _i )

U _i chooses her identity, ID _i , and password, PW _i , for registration and submits ID _i and, h(PW _i ) hashed value of PW _i , to the remote server via a secure communication channel. Both ID _i and PW _i are selected by the user freely.

Step 2. After receiving ID _i and h(PW _i ) from U _i , the remote server, S performs the following steps:

1. S generates transform identity TID _i = h(ID _i ‖ h(PW _i )), and checks the existence of the transformed identity in the database. If the identity already exists in the database, S requests U _i to re-initiate the registration procedure with a different ID _i or PW _i . Otherwise, S stores TID _i in the database. This process ensures the uniqueness of the user's transformed identity.

2. Compute A _i = (h(K _u )⊕K _s ), where K _s is a secret key of S and K _u is a common key of user for S. K _u is used to generate a dynamic identity, DID _i in the login and authentication phase.

3. Compute B_i = (g^A_i mod p)⊕h(PW_i), where g is a primitive element in Galoisfield GF(p) and p is a large prime positive integer.

4. Store the values DID _i , B _i , h(·) and K _u in a smart card and issue the smart card to U _i .

Figure 1.

Registration phase.

3.2 Login and Authentication Phase

After U _i registers to S, when U _i wants to log into the server, U _i will send a, login message to S. The login message contains a dynamic identity, DID _i to guarantee user anonymity. After successful verification of the login message, U _i can authenticate S and S can authenticate U _i . That is, our scheme provides mutual authentication. The login and the authentication phases work as follows:

Login phase: U _i → S: DID _i , CTID _i , C _i , k _i

User, U _i , connects her smart card to a reader She inputs her identity, ID _i and password, PW _i . The smart card performs the following processes:

1. Generate nonces, n _i and k _i .

2. Compute CTID _i = TID _i ⊕n _i .

3. Compute C _i = h(B _i ⊕h(PW _i ))⊕n _i .

4. Compute M _i = K _u mod k _i .

5. Compute DID_i = h^M_i(TID_i⊕B_i⊕h(PW_i)).

6. U _i sends DID _i , CTID _i , C _i and k _i with the login request message to S.

Authentication phase:

The proposed scheme provides mutual authentication. U _i and S perform the following processes to achieve this, after U _i sends the request message to S.

Step 1. S → U _i : DID _s , CTID _s

S does the following processes to authenticate U _i :

1. Compute A _i = h(K)⊕K _s .

2. Compute g^A_i mod p and execute the hash operation for this value, h(g^A_i mod p).

3. Execute exclusive-or operation the received C _i and the value, h(g^A_i mod p) for the value n_i′ = C_i⊕h(g^A_i mod p).

4. To compute TID _i ′, S executes exclusive-or operation with the received value, CTID _i and the generated value n _i ′, TID _i ′ = CTID _i ⊕n _i ′. Then, S checks that TID _i ′ is the registered transform identity in the database. If the value is not valid, terminate the connection, otherwise, continue the process.

5. Compute M _i = K _u mod k _i .

6. S computes DID_i′ = h^M_i(TID_i⊕h(g^A_i mod p)) and compares the received value, DID _i and the generated value, DID _i ′ by the server. If DID _i ′ = DID _i , S authenticates the legitimate user, U _i . Otherwise, S fails authentication of U _i and S terminates the connection with U _i .

7. Generate nonce n _s .

8. Compute DID _s = h(DID _i ⊕n _i ⊕n _s ) and CTID _s = CTID _i ⊕n _s .

9. S sends DID _s and CTID _s to U _i .

Step 2. U _i → S : DID _is

User, U _i , authenticates S and mutual authentication is completed according to the following processes:

1. Compute n _s ′= CTID _s ⊕CTID _i .

2. U _i computes DID _s ′ = h(DID _s ⊕n _i ⊕n _s ′) and compares the received value, DID _s and the generated value, DID _s ′. If DID _s ′ = DID _s , the user, U _i authenticates the remote server, S. Otherwise, U _i fails server authentication and terminates connection with S.

3. U _i computes the value, DID _is = DID _s ⊕n _i ⊕(n _s +1) and sends DID _is to S.

4. S computes (n _s +1)′ = DID _is ⊕n _i ⊕DID _s , compares the value, (n _s +1) and the generated value, (n _s +1)′. If (n _s + 1′ = (n _s +1) mutual authentication is complete. Otherwise, S terminates connection with U _i .

Figure 2.

Login and authentication phase.

3.3 Key Agreement Phase

After U _i and S bring mutual authentication to completion, they generate the session keys for secure transmission of messages to each other. Then the session key is generated using information (values) in the authentication phase.

Step 1. User, U _i , generates session key, SK _i .

U _i computes SK _i = h(B _i ⊕h(PW _i )⊕n _i ⊕n _s ), SK _i is the session key generated by the user. Then, values, B _i , h(PW _i ), n _i and n _s are not revealed in transmission via a common channel.

Step 2. Remote server, S, generates session key, SK _s .

S computes SK_s = h((g^A_i mod p)⊕n_i⊕n_s). SK _s is the session key generated by the remote server In addition, values g^A_i mod p, n_i and n _s are not revealed in transmission via a common channel.

SK _i and SK _s are the same values, since (g^A_i mod p) = B _i ⊕h(PW _i ), Thus, the session key is created safely between the user, U _i and the remote server, S.

3.4 Secure Password Update Phase

When user U _i wants to change her password for personal reasons or for the sake of security, U _i can change her password freely. The proposed scheme provides secure password change The procedure is as follows:

1. U _i →S : DID _i , CTID _i , C _i , k _i , M _{request-change-PWi} U _i inserts the smart card into a reader and sends DID _i , CTID _i , C _i , and k _i with the request message, M _{request-change-PWi} to S.

2. Mutual authentication is performed between U _i and S, as in the login and authentication phase, mentioned earlier.

3. U _i generates new password, PW _i ^* and computes TID _i ^* = h(ID _i ⊕h(PW _i ^* ))

4. U _i → S : E _SKi {TID _i ^* } U _i encrypts new transform identity TID _i ^* using session key SK _i and sends the encrypted message to the server.

5. S decrypts the received message using SK _s and then replaces the value, TID _i with the received value TID _i ^* . S sends the response message to U _i .

6. After receiving the response message from S, U _i computes B _i ^* = B _i ⊕h(PW _i )⊕h(PW _i ^* ) and replaces stored values in the smart card TID _i and B _i with TID _i ^* and B _i with each other.

Figure 3.

Secure password update phase.

4. Security Analysis

In this section, we analyse the security of the proposed scheme. The proposed scheme can resist insider, replay, guessing, stolen-verifier and impersonation attacks, and provide user anonymity, forward secrecy, known-key security and mutual authentication for enhanced security.

4.1 The proposed scheme can resist an insider attack

In the registration phase, U _i submits her identity, ID _i and the hashed value of password, h(PW _i ) instead of PW _i for remote-access services. Due to the employment of the one-way hash function h(·), it is impossible for an insider to derive the user's password PW _i from the hashed value, h(PW _i ). That is, even the server does not know PW _i . Therefore, the proposed scheme can prevent insider attack.

4.2 The proposed scheme can resist a replay attack

Assume that an adversary eavesdrops on the login message sent by U _i when logging into the server in a later session. However, the replay of U _i 's previous login message will be detected by the server. In Step 2 of login and authentication, the adversary computes the value (DID _is = DID _s ⊕n _i ⊕(n _s +1)) for mutual authentication and the value is sent to the server. The adversary generates n _a and computes DID _as = DID _s ⊕n _a ⊕(n _s +1), because she does not know the value, n _i and sends DID _as to the server. The server will derive the value (n _s +1)′ from the value DID _as sent by the adversary. However, it is (n _s +1)′ ≠ (n _s +1), since DID _as ⊕DID _s ≠ DID _is ⊕DID _s . Therefore, the adversary cannot launch a replay attack.

4.3 The proposed scheme can resist a guessing attack

Suppose an adversary finds out the identity and the password of a legitimate user by guessing. She can compute valid values, TID _i = h(ID _i ‖PW _i ) and CTID _i = TID _i ⊕n _i *. However, she does not know B _i and K _u . Thus, she cannot compute valid values, C _i and DID _i . Hence, the adversary cannot generate a valid login message.

4.4 The proposed scheme can resist a stolen-verifier attack

The server stores only the transformed user's identity in the database and does not store the user's other secret information corresponding to her transformed identity in the proposed scheme. Thus, only the malicious insider or intruder gets the table of the user's transformed identity. Hence, the adversary cannot launch a stolen-verifier attack.

4.5 The proposed scheme can resist impersonation attack

If an adversary wants to impersonate U _i , she has to create a valid login message: DID _i , CTID _i , C _i and k _i . First, she has to choose a nonce n _i ^* and compute CTID _i ^* = TID _i ⊕n _i ^* , C _i * = h(B _i ⊕h(PW _i ))⊕n _i ^* , M _i * = y mod k _i ^* , DID_i* = h _ⁱ *(TID_i⊕B_i⊕h(PW_i)). Next, she summits the login message : DID _i ^* , CTID _i ^* , C _i ^* , k _i ^* to the server. The adversary cannot forge a valid login message as she has no idea about B _i , PW _i , and y. Hence, she cannot launch an impersonation attack.

4.6 The proposed scheme can provide user anonymity

Consider an adversary eavesdrops on the login message, DID _i , CTID _i , C _i and k _i . Here, DID _i is the dynamic identity and as CTID _i and C _i are computed by nonce, n _i , they are different in the login phase. In addition, the value k _i is not the same in each login phase. Thus, the login messages submitted to the server are different in the login sessions. Hence, it is difficult for the adversary to discover a user's identity.

4.7 The proposed scheme can provide forward secrecy

Suppose, the long-term secret key material (e.g. server's secret key K _s and user's password PW _i ) is revealed to an adversary. Although the adversary knows the secret key material, she cannot compromise the secrecy of the agreed keys in earlier runs because the session key is computed using the long-term secret key material and nonce n_i(j-th) and n_s(j-th). Thus, if the adversary does not know the values n_i(j-th) and n_s(j-th), she cannot derive the j-th session key. Hence, the proposed scheme provides forward secrecy.

4.8 The proposed scheme can provide known-key security

Suppose that in the j-th session, the session key SK_i(j-th) is compromised by an adversary. Then the adversary cannot further compromise other secret keys or session keys because the session key SK_i(k-th)(j≠k) uses nonce n_i(k-th) and n_s(k-th). Hence, the proposed scheme can achieve known-key security.

4.9 The proposed scheme can provide mutual authentication

In the login and authentication phase, U _i and the server securely exchange a nonce of user, n _i and a nonce of server, n _s respectively. Thus, U _i generates session key SK _i = h(B _i ⊕h(PW _i )⊕n _i ⊕n _s ) and the server generates session key SK_s = h((g^A_i mod p)⊕n_i⊕n_s). (g^A_i mod p) = B_i⊕h(PW_i) and the values n _i and n _s are not revealed in a common channel. Thus, the values SK _i and SK _s are the same and are secure.

5. Performance and Functionality Analysis

The proposed scheme achieves mutual authentication using only a one-way hash function and bitwise exclusive-or operation in a smart card. We prefer to adopt modular exponentiation, a relatively expensive operation, in the registration phase. However, it is performed only at the remote server. Thus, the proposed authentication in this paper is pertinent to using a practical smart card. In addition, it provides session key agreement and a secure password change. Table 2 compares performance.

Table 2.

Performance comparisons of authentication schemes.

	Registration	Login and Authentication	Key Agreement	Password Update
Our scheme	1C, 3H, 2⊕, 1M	8H+, 16⊕, 1M, 1A, 3O	Yes	Yes
Das et al.[15]	2H, 1⊕	8H, 14⊕, 1A, 2O	No	Yes
Liao et al.[14]	1C, 1H, 2⊕, 1M	4C, 3H, 13⊕, 1M, 2A, 3O	Yes	Yes
Lin et al.[8]	3C, 3H 1⊕	3C, 7H, 6⊕, 1O	No	No
Bindu et al.[6]	4H, 3⊕	2H, 8⊕, 1M, 2E, 2D, 3A, 3O	Yes	No
Juang[10]	1H, 1⊕	1C, 2H, 1⊕, 3E, 3D	Yes	No
Khan et al.[13]	2C, 2H, 1⊕	8C, 6H, 5⊕, 2A, 3O	Yes	Yes
Tseng et al.[16]	5H, 4⊕, 1A	10H, 19⊕, 2M, 2E, 2D, 3A	Yes	Yes

C : Concatenation

H : One-way hash function

⊕: Bitwise exclusive-or

M : Modular exponentiation

E : Encryption

D : Decryption

A : Arithmetic operation, such as add, subtraction and absolute value.

O : Comparison operation

+ : More

We summarize the functionalities of our proposed scheme in this section. The crucial criteria in the user authentication scheme are listed below:

F1. Freely chosen password: in the registration phase, a user can choose her identity and password freely for remote-access services.

F2. Secure password change: the user can change her password when she wants to change her password for the sake of security. In our scheme, after the user and server are authenticated, the password change is securely accomplished. Then, the generated value TID _i ^* is encrypted by the session key and transmitted to the server.

F3. No verification table: if the server maintains the verification table, when the verification table is revealed to an adversary, the overall authentication mechanism breaks down. Our scheme does not maintain the verification table with the user identity and corresponding password for user authentication. Only the server has a transformed identity table for user authentication.

F4. Low computation: computation overhead must be low in smart cards due to their constrained resources. Our scheme accomplishes mutual authentication merely by hash operation and bitwise exclusive-or operation.

F5. Mutual authentication: a malicious person can disguise herself as the server or can disguise herself as the user. However, our scheme can provide mutual authentication between user and server.

F6. Session key agreement: the user and the server communicate via a common channel after mutual authentication is accomplished. The session key agreement is provided for secure transmission of the important messages. The security of the session key is very important. Our scheme provides session key agreement and at the end of the key exchange, the session key is known to nobody but the user and the server.

F7. Avoiding time synchronization: our scheme adopts a nonce instead of using a time-stamp to prevent replay attacks and a synchronization problem. Thus, our scheme does not need time synchronization between user and server.

F8. User anonymity: our scheme uses dynamic identity for user anonymity. Whenever a user connects to the server for remote-access services, she sends a different identity. Thus, our scheme provides user anonymity.

Table 3 compares functionality. The proposed scheme satisfies the required functionalities.

Table 3.

Functionality comparisons of authentication schemes.

		F2	F3	F4	F5	F6	F7	F8
Our scheme	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Das et al[15]	Yes	No	Yes	Yes	Yes	No	No	No
Liao et al[14]	Yes	No	Yes	Yes	Yes	Yes	Yes	No
Lin et al[8]	No	No	Yes	Yes	No	No	No	No
Bindu et al[6]	Yes	No	Yes	Yes	Yes	Yes	No	Yes
Juang[10]	Yes	No	Yes	Yes	Yes	Yes	Yes	No
Khan et al[13]	Yes	No	Yes	Yes	Yes	No	No	Yes
Tseng et al[16]	Yes	Yes	Yes	Yes	Yes	Yes	No	Yes

F1. Freely chosen password

F2. Secure password change

F3. No verification table

F4. Low calculation for authentication

F5. Mutual authentication

F6. Session key agreement

F7. Avoiding time synchronization

F8. User anonymity

6. Conclusion

In this paper we proposed a security enhancement scheme of mutual authentication and user anonymity using smart cards. The proposed scheme does not send the user specific value in the login and authentication phase. Thus, it achieves user anonymity. The proposed scheme can resist insider, replay, guessing, stolen-verifier and impersonation attacks, and provides forward secrecy, known-key security and mutual authentication to enhance security. A user can freely choose her password and can change the password safely. In addition, our scheme provides the following functionalities: no verification table, avoiding time synchronization, eviction mechanism, session key agreement and low computation.