A two‐factor authentication scheme with anonymity for multi‐server environments

Abstract

In a multi‐server environment, remote user authentication is essential for secure communication. Recently, Liao and Wang, Hsiang and Shih, and Lee et al. have successively proposed various remote user authentication schemes for multi‐server environments. However, each of these schemes exhibits distinct security weaknesses. The Liao–Wang scheme is vulnerable to insider attacks and masquerade attacks, and fails to provide two‐factor security and mutual authentication. The Hsiang–Shih scheme is vulnerable to masquerade attacks and cannot provide mutual authentication. This paper shows that the Lee et al. scheme does not provide two‐factor security and cannot withstand masquerade attacks. Their scheme demonstrates poor reparability and fails to provide mutual authentication. Its password change process is inconvenient and inefficient for users who wish to update passwords. Therefore, we propose a novel two‐factor authentication scheme with anonymity for multi‐server environments and use the Burrows–Abadi–Needham logic method to verify our scheme. We compare the performance and functionality of the proposed scheme with those of previous schemes. Cryptanalysis demonstrated that our improved scheme not only overcomes the drawbacks of the Lee et al., Hsiang–Shih, and Liao–Wang schemes but also satisfies crucial design criteria for secure remote user authentication schemes in multi‐server environments. This paper presents a real‐case scenario and provides practical examples. We show that our improved authentication scheme provides more functionality than the mentioned schemes do, and can enhance effectiveness in protecting multi‐server environments. We also show that the proposed scheme is efficient and can enhance the efficiency of the authentication scheme in a multi‐server environment. Copyright © 2014 John Wiley & Sons, Ltd.

Design of a secure smart card-based multi-server authentication scheme

“…It is evident from the reported results that our scheme fulfills the design properties, and our scheme is also secure under the test of AVISPA using OFMC and CLAtSe backends with the bounded number of sessions. (Li et al, 2015) and Chen-Lee's scheme (Chen et al, 2015). …”

“…Li et al's scheme (Li et al, 2015) is vulnerable to privileged-insider attack, stolen smart card attack and user impersonation attack, and it does not support formal security verification using AVISPA tool. Similar to Li et al's scheme, Chen-Lee's scheme (Chen et al, 2015) is vulnerable to privilegedinsider attack, stolen smart card attack and user impersonation attack, and it does not support formal security verification using AVISPA tool. On the other hand, our proposed scheme provides better security features as compared to those for both Pippal et al's scheme and Wei et al's scheme.…”

“…Communication overhead Lee et al (2014) 3 messages (2880 bits) Li et al (2015) 4 messages (2240 bits) Chen et al (2015) 3 messages (1280 bits) Pippal et al (2013) 3 messages (5056 bits) Wei et al (2014) 3 messages (2994 bits) Ours 2 messages (2592 bits)…”

“…We take 1024-bit prime p for modular exponentiation. The service period in ChenLee's scheme (Chen et al, 2015) is taken as 32 bits. …”

“…Chen-Lee (Chen et al, 2015) also presented a two-factor authentication scheme with anonymity for multi-server environments. Similar to the above analysis done in Li et al's scheme (Li et al, 2015), it can be shown that Chen-Lee's scheme is insecure against privileged-insider attack.…”