∎

11institutetext: Hafeez Ur Rehman 22institutetext: Department of Computer
Science and Software Engineering, International Islamic University
Islamabad,Pakistan
Tel.: +92-312-901823
22email<EMAIL_ADDRESS>33institutetext: Anwar Ghani* 44institutetext:
Department of Computer Science and Software Engineering, International Islamic
University Islamabad,Pakistan
44email<EMAIL_ADDRESS>55institutetext: Shehazad Ashraf Chudhry
66institutetext: Department of Computer Engineering, Faculty of Engineering
and Architecture Istanbul Gelisim University Istanbul, Turkey
66email<EMAIL_ADDRESS>77institutetext: Mohammed H. Alsharif
88institutetext: Department of Computer Engineering, Faculty of Engineering
and Architecture Istanbul Gelisim University Istanbul, Turkey
88email<EMAIL_ADDRESS>99institutetext: Narjes Nabipour* 1010institutetext:
Institute of Research and Development, Duy Tan University, Da Nang, Vietnam
1010email<EMAIL_ADDRESS>
# A Secure and Improved Multi Server Authentication Protocol Using Fuzzy
Commitment

Hafeez Ur Rehman  Anwar Ghani  Shehzad Ashraf Chaudhry  Mohammed H. Alsharif
Narjes Nabipour

(August 27, 2024)

###### Abstract

Very recently, Barman et al. proposed a multi-server authentication protocol
using fuzzy commitment. The authors claimed that their protocol provides
anonymity while resisting all known attacks. In this paper, we analyze that
Barman et al.’s protocol is still vulnerable to anonymity violation attack and
impersonation based on stolen smart attack; moreover, it has scalability
issues. We then propose an improved and enhanced protocol to overcome the
security weaknesses of Barman et al.’s scheme. The security of the proposed
protocol is verified using BAN logic and widely accepted automated AVISPA
tool. The BAN logic and automated AVISPA along with the informal analysis
ensures the robustness of the scheme against all known attacks.

###### Keywords:

multi-server authentication fuzzy commitment security BAN logic AVISPA

††journal: Multimedia tools and applications

##  1 Introduction

The multi-server environment provides convenient and suitable online services
as unlike conventional single server authentication (SSA), the multi-server
environment provides single sign-on without registering with multiple servers
and keeping the multiple secrets of passwords and identities. The multi-server
works using the centralized trusted registration authority, responsible for
registering the servers and users, in return it enables both the servers and
users to get hassle free communication with each other. The users keeps only a
secret password and an identity. The common use of a multi-server environment
requires an efficient and robust user authentication protocol to establish a
secure connection between both the requesting user and service providers.

In 1981, Lamport 1lamport1981  presented the first authentication protocol
based on a server database containing the passwords of each registered user.
Due to storage of the verifier in server database Lamport’s protocol is
subjected to the stolen verifier attack. Over time, many researchers proposed
their protocols to resolve the issues of stolen verifier attack 2fan2005robust
; 3juang2008robust .Wu et al.’s 4wu2012secure  presented a smart card-based
authentication protocol; later He et al. 5debiao2012more  noticed that the
protocol of Wu is vulnerable to insider attack and impersonation attack. Wu et
al.’s 4wu2012secure  then presented an improved and enhanced protocol based on
He et al.’s protocol. later Zhu et al.6zhu2012efficient  found that the
protocol of He et al. still has some weaknesses like offline password guessing
attack.

Anticipating the failure and/or unsuitability of two factor authentication
protocols, many researchers proposed fingerprint-based three factor
authentication protocols to enhance the security7lee2002fingerprint ;
8fan2009provably ; 9li2010efficient . Lee et al. 7lee2002fingerprint
presented fingerprint-based authentication. Lee et al. enhanced the security
using three factors including: 1)smart card, 2)fingerprint minutiae, and
3)user password. Later Lin et al.’s 10lin2004flexible  claimed that Lee et
al.’s protocol has weaknesses against spoofing and masquerade attacks. So they
proposed an enhanced protocol based on Lee et al.’s protocol. Regretfully,
Mitchell et al. 11mitchell2005security  noticed that Lin et al.’s protocol
still has some weaknesses. Amin et al.’s 12amin2015novel  presented a novel
protocol for multi-server architecture in which the authors claimed that their
protocol provides security against the known attacks. Later Das et al.’s
13das2015secure  noticed that Amin et al.’s protocol suffers from many
attacks. Das et al. also proved that Amin et al.’s protocol does not reinforce
the biometric update.

Mir and Nikooghadam14mir2015secure  presented an enhanced biometrics-based
authentication protocol and claimed their protocol provides security against
well-known attacks like (user anonymity and untraceability, impersonation
attacks, Online password guessing attacks, etc.) Later Chaudhry et al.
15chaudhry2018enhanced  noticed that Mir and Nikooghadam 14mir2015secure
suffers from user anonymity attack as well as stolen smart attack.
Unfortunately, Qi et al. 16qi2018new  claimed Chaudhry et al.’s
15chaudhry2018enhanced  protocol still has some weaknesses including non-
resilience against denial of service attack; moreover, protocol in
15chaudhry2018enhanced  is lacking perfect forward secrecy.

In 2016, Wang et al. 17wang2016cryptanalysis  proposed another biometric-based
multi-server authentication and key agreement protocol based on Mishra et
al.’s protocol. Wang et al. claimed their protocol provides various security
features along-with user revocation/re-registration and biometric information
protection. Soon, AG Reddy et al. 18reddy2017design  showed that Wang et al.’s
17wang2016cryptanalysis  protocol is vulnerable to server impersonation, user
impersonation and insider attacks, as their protocol share user credential to
the server. Qi et al.’s 19qi2017efficient  proposed yet another key-exchange
authentication protocol and claimed it to provide security against well-known
attacks. later AG Reddy et al.’s 20reddy2018privacy  noticed some
vulnerabilities like session key leakage attack, user impersonation attack,
insider attack, and user anonymity in the protocol of Qi et al.

Very recently, Barman et al.21barman2018provably  proposed a provably secure
multi-server authentication protocol using fuzzy commitment. The authors in
21barman2018provably  claimed that their protocol provides various security
features like confidentiality of user identity/biometric data, mutual
authentication and session key establishment between user and servers, besides
this authors also claimed their protocol to provide security against the known
attacks. However, the in-depth analysis in this article shows that the
protocol of Barman et al. is facing some serious security threats. It is to
show that the protocol proposed by Barman et al. is vulnerable to anonymity
violation attack and impersonation attack based on stolen smart-card.
Moreover, their protocol is not practicable owing to the scalability issues.
Then we propose an improved and enhanced protocol to overcome the security
weaknesses of Barman et al.’s protocol. We analyze the security of our
proposed protocol through formal and informal analysis. In the formal
analysis, we used a BAN Login and widely accepted AVISPA tool, a well known
and widely accepted automated tool for security analysis . The informal
security features analysis also shows the robustness of the proposed protocol.

##  2 Preliminaries

A brief review of the basics relating to fuzzy commitment technique, one-way
hash function, error correction coding, and revocable template generation, is
solicited in this section.

###  2.1 Fuzzy Commitment

The fuzzy commitment as proposed by Juels and Wattenberg 26juels1999fuzzy  is
a method to hide the secrets under the witness and then release the conceal
secrets later in the presence of a witness. In the Registration/enrollment
phase a randomly generated key $K_{c}$ is cipher with codeword
$C_{w}=\aleph_{enc}(K_{c})$. $\aleph_{enc}$ is an error correction technique
and it helps in a noisy channel to recover equivalent match. When a user
imprints his biometric then the binary string is generated against that
biometric $C_{T_{u}}$ used to conceal the key with binary string through XOR
operation [$C_{T_{u}}\oplus C_{w}=H_{public}$]. The system contain only
$H_{public}$ and the hash of key $(h(K_{c}))$. In the authentication phase
this $H_{public}$ is available, so every legitimate user imprints his/her
biometric to unlock $C_{w}$.

###  2.2 Hash Function

Hash function h: X $\xrightarrow{}$ Y is deterministic mapping set X =
$\\{0,1\\}^{*}$ of strings having variable length to another set Y =
$\\{0,1\\}^{t}$ of strings of fixed length, properties include:

  * •

The input value say, $a\in X$ it is easy to compute h(a), in polynomial times
moreover, h(.) function is deterministic in nature.

  * •

The change in input value $a\in X$ results in a completely uncorrelated with
h(a).

  * •

$One-Way$ $property:$ It is difficult to find the actual message $x$ given the
message digest $h(a)$ of $a\in X$.

  * •

$Weak-Collision$ $resistant$ $property$: Any given value input $a\in X$. it is
difficult to find another $a^{*}\in X$ such that $h(a)=h(a^{*})$.

  * •

$Strong-Collision$ $resistance$ $property$: $h(a)=h(a^{*})$ for any $a$,
$a^{*}\in X$ and $a\neq a^{*}$, this property states that, it is also
difficult to find any two inputs $a,a^{*}\in X$ such that $a\neq a^{*}$ with
$h(a)=h(a^{*})$.

###  2.3 Revocable Template Generation

A revocable template 27ratha2007generating , provides the privacy and
Revocability of user biometric. By using transformation parameter $TP_{u}$ and
transformation function, $f(\cdot)$, user biometric data is convert into a
cancel able template $CT_{u}=f(BIO_{u},TP_{u})$, properties includes:

  1. 1.

Collision-free property: If $CT_{u}=f(BIO_{u},TP_{u})$ and
$CT_{k}=f(BIO_{k},TP_{k})$, then $CT_{u}\neq CT_{k}$. for $BIO_{u}\neq
BIO_{k}$. Moreover, if $CT_{n}=f(BIO,TP_{n})$ and $CT_{m}=f(BIO,TP_{m})$, then
$CT_{n}\neq CT_{m}$ for $TP_{n}\neq TP_{m}$.

  2. 2.

Intra-user variability property : This property states; two different
templates $CT_{u}=f(BIO_{u},TP_{u})$,
$CT^{{}^{\prime}}_{u}=f(BIO^{{}^{\prime}}_{u},TP_{u})$ can be generated form
same fingerprint.

  3. 3.

Revocation of biometric: If user biometric is comprised, then new template can
be generated by using new transformation parameter $TP^{new}_{u}$ with same
transformation function $f(\cdot)$.

  4. 4.

User confidentiality: Cancel-able template should protect the confidentiality
of user, moreover template should protect the information about original
biometric of a user.

###  2.4 Error Correction Technique

In the biometric template, the intra-user variation is considered an error. To
remove the errors in the user biometric template, error correction technique
28hao2006combining  is used for noisy biometric image. In the time of
enrollment/Registration $CT_{enrol_{u}}=f(BIO_{enrol_{u}},TP_{u})$ is
generated, which is match with query template
$CT_{query_{u}}=f(BIO_{query_{u}},TP_{u})$, at the authentication time. So the
difference can be calculated through Hamming distance
$e=HamDis(CT_{enrol_{u}},CT_{query_{u}})$.

###  2.5 Adversarial Model

According to the well known and widely accepted Dolev-Yao threat (DY) model
22dolev1983security , an attacker not only listen to the communication between
two participants but also the attacker can change the entire message or delete
the message as well on open channel. An attacker can also extract the secret
credential of legitimate user form stolen smart card through power analysis
attack23kocher1999differential ; 24messerges2002examining . Second adversarial
model is Canetti and Krawczyk model (CK-model). In authentication and key
exchange protocol, it is considered as De-facto standard. According to the
(CK-adversary model)25canetti2001analysis , it is not only fallowed Dolev-Yao
threat (DY) model but the adversary is also able to get the session key and
session states as well.

###  2.6 Our contributions

  1. 1.

We have cryptanalyzed the recent fuzzy commitment based multi-server
authentication protocol proposed by Barman et al.’s 21barman2018provably  to
find out its security issues and vulnerabilities.

  2. 2.

We proposed an improved and enhanced authentication protocol based on Barman
et al.’s 21barman2018provably

  3. 3.

The security of the proposed protocol is checked through BAN logic and widely
accepted AVISPA.

  4. 4.

The security discussion and security features comparisons of the proposed
protocol with related protocols including Barman et al.’s protocol is
explained.

  5. 5.

We have also provided the comparative computation and communication costs
analysis of the proposed protocol with competing related protocols

###  2.7 Notations

The notations used in this paper are provided in fig 1.

Symbols | Representations
---|---
$U_{u}$,$S_{k}$ | user and server
$SID_{k}$ | identity of server
$ID_{u},PW_{u},BIO_{u}$ | identity, password and biometric of $U_{u}$
$CT_{u},TP_{u},f(.)$ | cancel-able template, transformation parameter
| and transformation function of $U_{u}$
$RC$ | trusted registration center
$X_{c}$ | secret/private key of $RC$
${XR_{k}}$ | shared keys between $S_{k}$ and $RC$
$E_{X_{c}},D_{X_{c}}$ | encryption and decryption using private key of $RC$
$R_{cu}$ | user’s random number
$H_{u}$ | fuzzy commitment helper data
$SK_{u,_{k}}$ | session key between user $U_{u}$, $S_{k}$
$PSK_{k}$ | secret/private key of $S_{k}$
$h(.)$ | hash function
$R_{u},r_{n},R_{s}$ | random number generated by $U_{u}$, $RC$, $S_{k}$
$T_{1},T_{2},T_{3},$ | time stamped generated by $U_{u},RC,S_{k}$
$T_{u}$ | time bound generated by $S_{k}$
$\Delta$T | time delay
$\oplus,\parallel$ |  $(XOR)$ and string concatenation operator
$\aleph_{enc}(.),\aleph_{dec}(.)$ | encoding and decoding operator ,
| of the error correction technique
$SC_{u}$, $A_{adv}$ | smart card and adversary

Figure 1: Notations

##  3 Review Of Barman et al’s Protocol

This section briefly reviews Barman et al.’s protocol 21barman2018provably .
The six phases of the protocol are detailed in following subsection:

###  3.1 Server Registration Procedure

In Barman et al protocol, all servers $S_{k}:(1\leq k\leq n)$, where $n$
denotes the total number of servers in the network. Initially, all servers
$S_{k}$, $(1\leq k\leq n)$ will registered with $RC$. Every server $S_{k}$
selects their particular identity $SID_{k}$ and dispatches a registration
request to the $RC$. $RC$ sends a secret key $PSK_{K}$ = $h(SID_{k}||X_{c})$
to each $S_{k}(1\leq k\leq n)$. $RC$ may also consider another
$n_{{}^{\prime}}$ servers, which will register themselves with the $RC$ near
in future. Therefore, the $RC$ chooses their identities $SID_{S}$ and
generates the shared keys $PSK_{S}$ = $h(SID_{S}||X_{c})$ for $n+1\leq S\leq
n+n^{{}^{\prime}}$ The server identities (for $n+n^{{}^{\prime}}$ server)
along with their corresponding key pairs ${(SID_{k},PSK_{k})|1\leq k\leq
n+n_{{}^{\prime}}}$ are stored in $RC$ database.

###  3.2 User Registration Procedure

The detail steps of the user registration phase are defined below:

  1. 1.

Initially, every user $U_{u}$ needs to register with the $RC$ to gets the
services, via a protected channel. $U_{u}$ select a unique user identity
$ID_{u}$, and password $PW_{u}$, a transformation parameter $T_{P_{u}}$ and a
random number $Rc_{u}$. $U_{u}$ also imprint $BIO_{u}$.

  2. 2.

$U_{u}$ produce the cancel-able biometric template using transformation
functions $CT_{u}$ = $f(BIO_{u},TP_{u})$ and computes $RPW_{u}$ =
$h(PW_{u}||CT_{u})$, $r_{u}$ = $h(Rc_{u}||ID_{u}||PW_{u})$. $U_{u}$. $U_{u}$
then generates a random secret $k_{u}$ and sends the registration request
$\langle ID_{u},RPW_{u}\oplus k_{u}\rangle$ to the $RC$, via a protected
channel.

  3. 3.

After checking validity of $ID_{u}$. $RC$ computes $US_{k}$ =
$h(ID_{u}||PSK_{k})$, $AM_{k}$ = $US_{k}\oplus(RPW_{u}\oplus k_{u})$, $SV_{k}$
= $h(SID_{k}||PSK_{k})$ and $BM_{k}$ = $SV_{k}\oplus$$RPW_{u}\oplus k_{u}$ for
1 $\leq k\leq(n+n^{{}^{\prime}})$. $RC$ issues a smart card $SC_{u}$ having
$\\{(SID_{k},AM_{k},BM_{k})$$|1\leq k\leq(n+n^{{}^{\prime}})\\}$ and sends it
to $U_{u}$, via a protected channel.

  4. 4.

Using error correction technique $\varepsilon$. $U_{u}$ encodes $Rc_{u}$
produced codeword $R_{cod}=\varepsilon_{enc}(Rc_{u})$, computes $H_{u}$ =
$CT_{u}\oplus R_{cod}$, $R$ = $h(Rc_{u})$ and $P$ = $h(r_{u})$. $U_{u}$ then
computes $AM_{uk}$ = $(AM_{k}\oplus k_{u})\oplus r_{u}$ and $BM_{uk}$ =
$(BM_{k}\oplus k_{u})\oplus r_{u}$ for $1\leq k\leq(n+n^{{}^{\prime}})$.

$U_{u}$ stores $\\{(AM_{uk},BM_{uk})\\}|1\leq k\leq(n+n^{{}^{\prime}}),$
$TP{u},H_{u},R,$ $P,h(\cdot),\aleph_{enc}(\cdot),\aleph_{dec}(\cdot)\\}$ in
smart card $SC_{u}$. $U_{u}$ cancels the $Rc{u},BIO_{u},CT{u},r_{u},AM_{k}$
and $BM_{k}$ for security reasons.

###  3.3 Login Procedure

The detail steps of login request are:

  1. 1.

$U_{u}$ inserts the smart card into the terminal and provides the credentials
$ID_{u},PW_{u}$ and $BIO^{{}^{\prime}}_{u}$ for authentication.

  2. 2.

The smart card $SC_{u}$ generates the cancel-able fingerprint
$CT^{{}^{\prime}}_{u}=f(BIO^{{}^{\prime}}_{u},TP_{u})$, and extracts
$R^{{}^{\prime}}_{cod}=H_{u}\oplus CT^{{}^{\prime}}_{u}$ and then decodes
$R^{{}^{\prime}}_{cod}$ using error correction technique,
$Rc^{{}^{\prime}}_{u}=\aleph_{dec}(R^{{}^{\prime}}_{cod})$. $SC_{u}$ compares
both values, $h(Rc^{{}^{\prime}}_{u})$ with $R$ which is stored in $SC_{u}$.
If they are equal than proceed further else terminate the session.

  3. 3.

$SC_{u}$ computes $r^{{}^{\prime}}_{u}=h(Rc_{u}||ID_{u}||PW_{u})$ and checks
if $h(r^{{}^{\prime}}_{u})=h(r_{u})$, proceed further otherwise terminate the
session.

  4. 4.

$SC_{u}$ computes $US_{k}=AM_{uk}\oplus h(PW_{u}||CT_{u})\oplus
r^{{}^{\prime}}_{u}=h(ID_{u}||PSK_{k})$ and $SV_{k}=BM_{uk}\oplus
h(PW_{u}||CT_{u})\oplus r^{{}^{\prime}}_{u}=h(SID_{k}||PSK_{k})$. $SC_{u}$
selects a random number $R_{u}$, generates current time stamp $T_{1}$, and
computes
$M^{{}^{\prime}}_{1}=h(ID_{u}||US_{k}),M^{{}^{\prime}}_{2}=ID_{u}\oplus
h(SV_{k}||T_{1}),M_{3}=M_{1}\oplus
R_{u},M_{4}=h(ID_{u}||M^{{}^{\prime}}_{1}||M^{{}^{\prime}}_{2}||T_{1}||R_{u})$.

  5. 5.

Finally, $SC_{u}$ sends the request $\langle
M^{{}^{\prime}}_{2},M^{{}^{\prime}}_{3},M^{{}^{\prime}}_{4},T_{1}\rangle$ to
the server $S_{k}$.

###  3.4 Mutual Authentication and Key Agreement Procedure

The mutual authentication and key agreement consist of following steps:

  1. 1.

$S_{k}$ receives login request $\langle
M^{{}^{\prime}}_{2},M^{{}^{\prime}}_{3},M^{{}^{\prime}}_{4},T_{1}\rangle$ at
time $T^{{}^{\prime}}_{1}$ and after computing the time delay,
$|T^{{}^{\prime}}_{1}-T_{1}|$. Computes
$M^{{}^{\prime}}_{5}=M^{{}^{\prime}}_{2}\oplus h(h(SID_{k}||$
$PSK_{k})||T_{1}),M^{{}^{\prime}}_{6}=h(M^{{}^{\prime}}_{5}||h(M^{{}^{\prime}}_{5}||PSK_{k}))$
$M^{{}^{\prime}}_{7}=M^{{}^{\prime}}_{3}\oplus M^{{}^{\prime}}_{6}=R_{u}$ and
$M^{{}^{\prime}}_{8}=h(M^{{}^{\prime}}_{5}||M^{{}^{\prime}}_{6}||M^{{}^{\prime}}_{2}||T_{1}||M^{{}^{\prime}}_{7})$.
Check if $M^{{}^{\prime}}_{8}\neq M^{{}^{\prime}}_{4}$, $S_{k}$ cancel the
login request, else proceed further.

  2. 2.

$S_{k}$ select a random number $R_{s}$ and generates $T_{3}$ then computes
$M^{{}^{\prime}}_{9}=h(h(M^{{}^{\prime}}_{5}||PS_{k})||R_{u})\oplus R_{s}$,
and session key
$SK_{uk}=$$h(M^{{}^{\prime}}_{5}||h(SID_{k}||PSK_{k})||R_{u}||R_{s}||T_{1}||T_{3})$
and
$M^{{}^{\prime}}_{10}=h(h(M^{{}^{\prime}}_{5}||PSK_{k})||SK_{uk}||T_{3}||R_{s})$
sends $\langle M^{{}^{\prime}}_{9},M^{{}^{\prime}}_{10},T_{3}\rangle$ to
$U_{u}$.

  3. 3.

The $U_{u}$ receives $\langle
M^{{}^{\prime}}_{9},M^{{}^{\prime}}_{10},T_{3}\rangle$. After checking the
delay $|T_{3}\leq T_{c}|$. $SC_{u}$ computes
$R^{{}^{\prime}}_{s}=M^{{}^{\prime}}_{9}\oplus h(US_{k}||R_{u})$, the session
key $SK^{{}^{\prime}}_{uk}=h(ID_{u}||SV_{k}$$||R_{u}||R_{s}||T_{1}||T_{3})$
shared with $S_{k}$ and
$M^{{}^{\prime}}_{11}=h(US_{k}||SK^{{}^{\prime}}_{uk}||T_{3}||R^{{}^{\prime}}_{s})$.
$SC_{u}$ check the condition if $M^{{}^{\prime}}_{11}\neq
M^{{}^{\prime}}_{10}$ terminated. Otherwise, the session key $SK_{uk}$ is
established between $U_{u}$ and $S_{k}$.

###  3.5 Password and Biometric Template Update Procedure

$U_{u}$ provides the current credentials $ID_{u},PW_{u}$ $BIO_{u}$ and
extracts feature $BIO^{{}^{\prime}}_{u}$ from the $BIO_{u}$. $SC_{u}$ then
computes $CT^{{}^{\prime}}_{u}=f(BIO^{{}^{\prime}}_{u},TP_{u})$ and
$Rc^{{}^{\prime}}_{u}=\aleph_{dec}(H_{u}\oplus CT^{{}^{\prime}}_{u})$ and then
check if $h(Rc^{{}^{\prime}}_{u})=R,SC_{u}$ further computes
$r^{{}^{\prime}}_{u}=h(Rc^{{}^{\prime}}_{u}||ID_{u}||PW_{u})$ check if
$h(r^{{}^{\prime}}_{u})=P$ proceed further otherwise terminate. $SC_{u}$ then
request to the user $U_{u}$ to modify their password and biometric template.

  1. 1.

To update the password, $U_{u}$ inputs $PW^{new}_{u}$. Then, $SC_{u}$ computes
$r^{new}_{u}=h(Rc^{{}^{\prime}}_{u}||ID_{u}||$ $PW^{new}_{u}),AM^{new}_{uk}$ =
$AM_{uk}\oplus r^{{}^{\prime}}_{u}\oplus r^{new}_{u}=h(ID_{u}||PSK_{u})\oplus
h(PW^{{}^{\prime}}_{new}||CT_{u})\oplus$ $h(Rc^{{}^{\prime}}_{u}$
$||ID_{u}||PW^{new}_{u})$, $BM^{new}_{uk}$ = $BM_{uk}\oplus
r^{{}^{\prime}}_{u}\oplus r^{new}_{u}=$ $h(SID_{k}||PSK_{k})\oplus
h(PW^{new}||CT_{u})\oplus$ $h(Rc^{{}^{\prime}}_{u}$ $||ID_{u}$
$||PW^{new}_{u})$ for $1\leq k\leq(n+n^{{}^{\prime}})$ and
$P^{new}=h(r^{new}_{u}).SC_{u}$ updates its parameters
$\\{AM_{uk},BM_{uk},\\}$ with the newly computed values
$\\{AM^{new}_{uk}$,$BM^{new}_{uk}$ $,P^{new}\\}$ and stored in the $SC_{u}$.

  2. 2.

To update the biometric template, $SC_{u}$ request $U_{u}$ for a new
transformation parameter $TP_{u}$. $SC_{u}$ have the old $TP_{u}$ and then set
new $TP^{new}_{u}=TP_{u}$ and new cancel-able template is produce
$CT^{new}_{u}=f(BIO^{{}^{\prime}}_{u},TP^{new}_{u})$. $SC_{u}$ also computes
$RPW^{new}_{u}=h(PW_{u}||CT^{new}_{u})$, $AM^{new}_{uk}=AM_{uk}\oplus
RPW_{u}\oplus RPW^{new}_{u}$ = $h(ID_{u}||$ $PSK_{k})\oplus h(PW_{u}$
$||CT^{new}_{u})r^{{}^{\prime}}_{u},BM^{new}_{uk}=BM_{uk}\oplus RPW_{u}\oplus$
$RPW^{new}_{u}$ = $h(SID_{k}||$ $PSK_{k})\oplus h(PW_{u}||CT^{new}_{u})\oplus
r^{{}^{\prime}}_{u}$, and the new helper data
$H^{new}_{u}=CT^{new}_{u}\oplus\aleph_{enc}(Rc^{{}^{\prime}}_{u})$.
Accordingly, the information $\\{AM_{uk},BM_{uk},H_{u}\\}$ is replaced by
$\\{AM^{new}_{ij}$ $BM^{new}_{uk},H^{new}_{u}\\}$ stored in the $SC_{u}$ .

###  3.6 Smart Card Revocation Procedure

If the $SC_{u}$ of a authorized $U_{u}$ is damaged, lost or stolen, then
$U_{u}$ can get a new $SC_{u}$ from the $RC$. $U_{u}$ provides $ID_{u}$ and
$PW_{u}$ and to imprint $BIO_{u}$, Steps are:

  1. 1.

$U_{u}$ computes $CT^{{}^{\prime}}_{u}=f(BIO_{u},TP_{u})$ and
$RPW_{u}=h(PW_{u}||CT^{{}^{\prime}}_{u})$, $U_{u}$ generates a random number
$k^{{}^{\prime}}_{u}$, then computes a parameter
$RPW^{{}^{\prime}}_{u}=RPW_{u}\oplus k^{{}^{\prime}}_{u}$ and then sends the
request $\langle ID_{u},RPW^{{}^{\prime}}_{u}\rangle$ to the $RC$ via a
protected channel for a new $SC^{new}_{u}$

  2. 2.

$RC$ computes $AM_{k}=h(ID_{u}||PSK_{k})\oplus
RPW^{{}^{\prime}}_{u},BM_{k}=h(SID_{k}||PSK_{k})\oplus RPW^{{}^{\prime}}_{u}$
for $k=1,2,,,,,,(n+n^{{}^{\prime}})$ and issue a new $SC^{new}_{u}$ containing
$\\{(SID_{k},AM_{k},BM_{k})|1\leq k\leq n+n_{{}^{\prime}}\\}$. $SC^{new}_{u}$
sends to these parameter to $U_{u}$ via a protected channel.

  3. 3.

$U_{u}$ generates a new random number $R^{new}_{u}$ and computes
$r_{u}=h(R^{new}_{u}||ID_{u}||PW_{u}),H^{new}_{u}=CT^{{}^{\prime}}_{u}\oplus\aleph_{enc}(R^{new}_{u}),AM_{uk}=(AM_{k}\oplus
k^{{}^{\prime}}_{u})\oplus r_{u},BM_{uk}=(BM_{k}\oplus
k^{{}^{\prime}}_{u})\oplus r_{u},R=h(Rc^{new}_{u}),P=h(r_{u})$ and stores
these values in $SC^{new}_{u},$ memory. $U_{u}$ also stores
$\\{TP_{u},\aleph_{enc}(\cdot),\aleph_{dec}(\cdot),h(\cdot)\\}$ in
$SC^{new}_{u}$ memory.

##  4 Cryptanalysis of Barman et al. protocol

Barman et al.’s protocol 21barman2018provably  provides multi-server based
authentication protocol using a fuzzy commitment approach. The in depth
analysis proves that the protocol entails serious security flaws as described
in following subsections:

###  4.1 Incomplete Login Request

The login message,
$\\{M^{{}^{\prime}}_{2},M^{{}^{\prime}}_{3},M^{{}^{\prime}}_{4},T_{1}\\}$ sent
by user $U_{u}$ to the server $S_{k}$ is incomplete, because the identity of
server $SID_{k}$ is not included in the login request, which is the most
important parameter while communication29lwamo2019suaa  and without the server
identity, the $RC$ cannot direct the request of $U_{u}$ to his intended
server. This crucial mistake may be treated as typing mistake. The protocol
can only work if the login message contains the identity of the server.

###  4.2 User Anonymity Violations Attack

Here, we show that the protocol of Barman et al. is vulnerable to user
anonymity violation attack. Let $U_{a}$ be a legal but dishonest user of the
system and wants to violate user anonymity. In the Mutual Authentication phase
of Barman et al.’s protocol user $U_{u}$ sends the message
$\\{M^{{}^{\prime}}_{2},M^{{}^{\prime}}_{3},M^{{}^{\prime}}_{4},T_{1},SID_{k}\\}$
to the server $SID_{k}$ on public channel. During the communication, let
$U_{a}$ intercepts the message and from $M^{{}^{\prime}}_{2}=ID_{u}\oplus
h(SV_{k}\|T_{1})$, $U_{a}$ can easily extract the $ID_{u}$ of every users.
Because all the users connected to the $SID_{k}$ has $SV_{k}$(secret
identifier generated by RC for $SID_{k}$) which are stored in the smart card.
$U_{a}$ can extract the identity of user as follows:

  * Step AV 1:

$U_{u}$ sends the login message to $SID_{k}$. During the communication, let
user $U_{a}$ intercepts the message
$\\{M^{{}^{\prime}}_{2},M^{{}^{\prime}}_{3},M^{{}^{\prime}}_{4},T_{1},SID_{k}\\}$.

  * Step AV 2:

$U_{a}$ using his own smart card, enters his credentials including: $ID_{a}$,
$PW_{a}$ and $BIO_{a}$. $U_{a}$ extracts $\\{BM_{ak},AM_{ak}\\}$ pair from his
own smart card and then computes $CT_{a}=f(BIO_{a},TP_{a})$,
$R^{{}^{\prime}}_{cod}=H_{a}\oplus CT_{a}$,
$Rc^{{}^{\prime}}_{a}=\aleph_{dec}(R^{{}^{\prime}}_{cod})$,
$r_{a}=h(Rc_{u}||ID_{a}||PW_{a})$, similar to login steps. $U_{a}$ then
computes:

$\displaystyle US_{k_{a}}=AM_{ak}\oplus h(PW_{a}||CT_{a})\oplus r_{a}$ (1)
$\displaystyle SV_{k}=BM_{ak}\oplus h(PW_{a}||CT_{a})\oplus
r^{{}^{\prime}}_{a}=h(SID_{k}||PSK_{k})$ (2) $\displaystyle
Z=h(SV_{k}||T_{1})$ (3)

  * Step AV 3:

Based on $SV_{k}$, $Z$ and the $M^{{}^{\prime}}_{2}$ from login request,
$U_{a}$ computes:

$\displaystyle ID_{u}$ $\displaystyle=M^{{}^{\prime}}_{2}\oplus Z$ (4)

In Eq.4, the $ID_{u}$ is the real identity of $U_{u}$. Therefore, $U_{a}$ has
successfully broke the user anonymity.

###  4.3 User Impersonation Attack based on stolen smart card

Using the stolen smart card of some user say $U_{a}$, another legal but
dishonest user of the system can launch user impersonation attack in Barman et
al.’s protocol. Let $U_{a}$ be a legal user, gets his card $SC_{a}$ containing
$\\{SID_{k},AM_{a_{k}},BM_{a_{k}}|1\leq k\leq(n+n^{{}^{\prime}})\\}$ along
with $\\{TP_{a},H_{a},P,h(\cdot),\aleph_{enc},\aleph_{dec}\\}$ and steals the
smart card $SC_{u}$ of $U_{a}$ performs following steps to impersonate on
behalf of $U_{u}$:

  * Step ISC 1:

$U_{a}$ enter his credential $ID_{a},PW_{a}$ and biometric $BIO_{a}$. $U_{a}$
computes $US_{k},CT^{{}^{\prime}}_{a},r^{{}^{\prime}}_{a}$,
$SV_{k}=BM_{uk}\oplus h(PW_{a}||CT_{a})\oplus
r^{{}^{\prime}}_{a}=h(SID_{k}||PSK_{k})$. As $SV_{k}$ is common in all smart
cards.

  * Step ISC 2:

Extracts $AM_{k_{u}}=US_{k_{u}}\oplus(RPW_{u}\oplus k_{u})$ and
$BM_{uk}=SV_{k}\oplus(RPW_{u}\oplus k_{u})$ form $U_{u}$’s stolen smart card
$SC_{u}$.

  * Step ISC 3:

$U_{a}$ using $SV_{k}$ computes:

$\displaystyle X=AM_{k_{u}}\oplus BM_{k_{u}}=\\{US_{k_{u}}\oplus(RPW_{u}\oplus
k_{u})\\}\oplus\\{SV_{k}\oplus(RPW_{u}\oplus k_{u})\\}$ (5) $\displaystyle
X=US_{k_{u}}\oplus SV_{k}$ (6) $\displaystyle US_{k_{u}}=X\oplus SV_{k}$ (7)

  * Step ISC 4:

$U_{a}$ has $SV_{k}$ and $US_{k_{u}}$ of $U_{u}$ with $ID_{u}$. $U_{u}$
generates a random number $R_{u}$ and time stamp $T_{1}$ computes:

$\displaystyle M^{{}^{\prime}}_{1}$ $\displaystyle=h(ID_{u}||US_{k})$ (8)
$\displaystyle M^{{}^{\prime}}_{2}$ $\displaystyle=ID_{u}\oplus
h(SV_{k}||T_{1})$ (9) $\displaystyle M^{{}^{\prime}}_{3}$
$\displaystyle=M^{{}^{\prime}}_{1}\oplus R_{u}$ (10) $\displaystyle
M^{{}^{\prime}}_{4}$
$\displaystyle=h(ID_{u}||M^{{}^{\prime}}_{1}||M^{{}^{\prime}}_{2}||T_{1}||R_{u})$
(11)

  * Step ISC 5:

$U_{a}$ sends the login request message $\langle
M^{{}^{\prime}}_{2},M^{{}^{\prime}}_{3}$, $M^{{}^{\prime}}_{4},T_{1}$,
$SID_{k}\rangle$ to the $S_{k}$. $S_{k}$ receives the login request $\langle
M^{{}^{\prime}}_{2},M^{{}^{\prime}}_{3},M^{{}^{\prime}}_{4},T_{1},SID_{k}\rangle$
after checking time delay, $|T^{{}^{\prime}}_{1}-TS_{1}|$, computes following:

$\displaystyle M^{{}^{\prime}}_{5}=M^{{}^{\prime}}_{2}\oplus
h(h(SID_{k}||PSK_{k})||T_{1})=(ID_{u})$ (12) $\displaystyle
M^{{}^{\prime}}_{6}=h(M^{{}^{\prime}}_{5}||h(M^{{}^{\prime}}_{5}||PSK_{k}))$
(13) $\displaystyle M^{{}^{\prime}}_{7}=M^{{}^{\prime}}_{3}\oplus
M^{{}^{\prime}}_{6}=R_{u}$ (14) $\displaystyle
M^{{}^{\prime}}_{8}=h(M^{{}^{\prime}}_{5}||M^{{}^{\prime}}_{6}||M^{{}^{\prime}}_{2}||T_{1}||M^{{}^{\prime}}_{7})$
(15)

  * Step ISC 6:

$S_{k}$ checks if $M^{{}^{\prime}}_{8}=M^{{}^{\prime}}_{4}$, $U_{u}$ will pass
this test because $M^{{}^{\prime}}_{8}$ and $M^{{}^{\prime}}_{4}$ both have
same values. Therefore user $U_{a}$ pass test on behalf of $U_{u}$. $S_{k}$
selects a nonce $R_{s}$, generates current time stamp $T_{3}$, and computes:

$\displaystyle
M^{{}^{\prime}}_{9}=h(h(M^{{}^{\prime}}_{5}||PS_{k})||R_{u})\oplus R_{s}$ (16)
$\displaystyle
SK_{uk}=h(M^{{}^{\prime}}_{5}||h(SID_{k}||PSK_{k})||R_{u}||R_{s}||T_{1}||T_{3})$
(17) $\displaystyle
M^{{}^{\prime}}_{10}=h(h(M^{{}^{\prime}}_{5}||PSK_{k})||SK_{uk}||T_{3}||R_{s})$
(18)

  * Step ISC 7:

Then, $S_{k}$ sends $\langle M^{{}^{\prime}}_{9},$
$M^{{}^{\prime}}_{10},T_{3}\rangle$ to $U_{a}$. $U_{a}$ receives the
authentication request message $\langle
M^{{}^{\prime}}_{9},M^{{}^{\prime}}_{10},T_{3}\rangle$ at time
$T^{{}^{\prime}}_{3}$. $U_{a}$ computes following:

$\displaystyle R_{s}=M^{{}^{\prime}}_{9}\oplus h(US_{k}||R_{u})$ (19)
$\displaystyle
SK^{{}^{\prime}}_{uk}=h(ID_{u}||SV_{k}||R_{u}||R_{s}||T_{1}||T_{3})$ (20)
$\displaystyle
M^{{}^{\prime}}_{11}=h(US_{k}||SK^{{}^{\prime}}_{uk}||T_{3}||R_{s})$ (21)

The session key as computed by $U_{a}$ in Eq. 20 is same as computed by
$S_{k}$ in Eq.17. Therefore, $U_{a}$ has succesffuly established a secure
connection with $S_{k}$ by impersonating on behalf of $U_{a}$.

###  4.4 Scalability problem

In the registration phase of Barman et al.’s protocol smart card stores
$AM_{k}$. As in multi-server environment, there may be several servers and
users. So it is inefficient to store $(AM_{k})$ against every server within
smart card due to its small magnetic chip which has limited storage. This
protocol is not practical, suppose we have n servers, so we need to store
$US_{k}$ and $SV_{k}$ of n servers within the smart card, each of size 160
bits. For large number of servers like 100, the bits stored for $US_{k}$ and
$SV_{k}$ in the smart card are 32000 bits, which can be problematic due to its
storage restrictions. Moreover, authors did not mention the procedure to
update the smart card if some new servers are added, $AM_{uk}$ =
$(AM_{k}\oplus k_{u})\oplus r_{u}$ and $BM_{uk}$ = $(BM_{k}\oplus k_{u})\oplus
r_{u}$ for $1\leq k\leq(n+n^{{}^{\prime}})$.

##  5 Proposed Protocol

This section details the proposed scheme consisting of three entities
including, users, servers and the Registration Center (RC). The details are in
following subsections:

###  5.1 Server Registration Phase

Every Sk along with its particular identity $SID_{k}$ must send a registration
request to the $RC$, if they are willing to provide services to the legitimate
users $U_{u}$. RC computes $X_{RS_{k}}=h(SID_{k}||X{c})$ and
$M_{k}=E_{X_{c}}(X_{RS_{k}})$ and stores $(SID_{k},E_{X_{c}}(X_{RS_{k}}))$ in
the database of $Rc$ and send the share key to the server $(X_{RS_{k}})$.

###  5.2 User Registration Phase

$U_{u}$ chooses $ID_{u},PW_{u},TP_{u}$, then imprint $BIO_{u}$ and selects
random number $N_{1}$. $U_{u}$ computes
$CT_{u}=f(BIO_{u},TP_{u}),A_{u}=h(N_{1}||PW_{u}||ID_{u}||CT_{u})$ and sends
$A_{u},ID_{u}$ to the $RC$. On receiving $RC$ computes
$X_{u}=h(ID_{u}||X_{c})$ and $Y_{u}=Xu\oplus A_{u}$ then generate a random
number $r_{o}$ and compute the pseudo identity
$PID_{u}=E_{X_{c}}(ID_{u}||r_{o})\oplus A_{u}$, then store
$Y_{u},PID_{u},h(.)$ in smart card. $RC$ sends the smart card to user using
some secure channel. On receiving smart card, $U_{u}$ computes
$R_{c}=\aleph_{enc}(Rc_{u}),H_{u}=CT_{u}\oplus R_{cod},R=h(Rc_{u})$,
$r_{u}=(Rc_{u}||ID_{u}||PW_{u})$, $P=h(r_{u})$ and $E_{u}=N_{1}\oplus r_{u}$.
$U_{u}$ stores $\\{TP_{u},H_{u},R,P,h(.)$,
$\aleph_{enc}(\cdot),\aleph_{dec}(\cdot),Y_{u},$ $PID_{u},E_{u}\\}$ in the
smart card.

Server | Registration Center
---|---
choose $SID_{k}$ |
$\phantom{h}\xrightarrow[Secure-channel]{SID_{k}}$ |
| compute $X_{RS_{k}}=h(SID_{k}||X_{c})$
| $M_{k}=E_{X_{c}}(X_{RS_{k}})$
| Stored $(SID_{k},E_{X_{c}}(X_{RS_{k}}))$
| in Database(RC)
| $\phantom{h}\xleftarrow[Channel-Secure]{(X_{RS_{k}})}$
Stores $(X_{RS_{k}})$ in Database(Server) |
Users/Smart Card | Registration center
Chooses $ID_{u},PW_{u},TP_{u}$ |
Imprint $BIO_{u}$ |
Selects $N_{1}$ |
Computes $CT_{u}=f(BIO_{u},TP_{u})$ |
$A_{u}=h(N_{1}||PW_{u}||ID_{u}||CT_{u})$ |
$\phantom{hhhhhhh}\xrightarrow[SECURE-CHANNEL]{A_{u},ID_{u}}$ |
| compute $X_{u}=h(ID_{u}||X_{c})$
| $Y_{u}=X_{u}\oplus A_{u}$
| Generates $r_{o}$
| $PID_{u}=E_{X_{c}}(ID_{u}||r_{o})\oplus A_{u}$
| Stores $Y_{u},PID_{u},h(.)$ in $SC_{u}$
| $\phantom{hhhhhhh}\xleftarrow[SECURE-CHANNEL]{Y_{u},PID_{u},h(.)}$
$R_{cod}=\aleph_{enc}(Rc_{u})$ |
$H_{u}=CT_{u}\oplus R_{cod},R=h(Rc_{u})$ |
$r_{u}=(Rc_{u}||ID_{u}||PW_{u})$ |
$P=h(r_{u})$ |
$E_{u}=N_{1}\oplus r_{u}$ |
Stores $\\{TP_{u},H_{u},R,P,h(.)$ |
$\aleph_{enc}(\cdot),\aleph_{dec}(\cdot)$ |
$Y_{u},PID_{u},E_{u}\\}$ in $SC_{u}$ |

Figure 2: Registration phase of Sever and User

###  5.3 Login and Authentication Phase

The following steps define the login and authentication phase briefly:

  * Step AP 1:

User need to insert the smart card provides the credentials
$ID_{u},PW_{u},BIO^{{}^{\prime}}_{u}$ and calculate
$CT^{{}^{\prime}}_{u}=f(BIO^{{}^{\prime}}_{u},TP_{u})$,
$R^{{}^{\prime}}_{cod}=H_{u}\oplus CT^{{}^{\prime}}_{u}$,
$Rc^{{}^{\prime}}_{u}=\aleph_{dec}(R^{{}^{\prime}}_{cod})$, and check if
$h(Rc^{{}^{\prime}}_{u})\neq R$, terminate the session, otherwise calculate
$r^{{}^{\prime}}_{u}=h(Rc^{{}^{\prime}}_{u}||ID_{u}||PW_{u})$, and check again
if $h(r^{{}^{\prime}}_{u})\neq h(r_{u})$ terminate the session, else compute
$N_{1}=(E_{u}\oplus r_{u})$,
$A^{{}^{\prime}}_{u}=h(ID_{u}||PW_{u}||N_{1}||CT_{u})$, $X_{u}=(Y_{u}\oplus
A^{{}^{\prime}}_{u})$, $DID_{u}=(PID_{u}\oplus A^{{}^{\prime}}_{u})$, generate
a random no $R_{u}$ and time stamp $T_{1}$, and to get the services of server
needs the address $SID_{k}$, and computes $G_{u}=R_{u}\oplus
h(X_{u}||ID_{u}||SID_{k}||T_{1})$,
$H_{u}=h(ID_{u}||G_{u}||X_{u}||R_{u}||T_{1}||SID_{k})$, sends
$\\{DID_{u},H_{u}$, $G_{u},T_{1},SID_{k}\\}$ to the Registration on public
channel.

  * Step AP 2:

$RC$ receives the login request and checks the time delay
$(T_{c}-T_{1}\leq\delta T)$. $RC$ decrypts
$(ID_{u}||r_{o})=D_{X_{c}}(PID_{u})$ using $X_{c}$ and computes
$X_{u}=h(ID_{u}||X_{c})$ $R_{u}=G_{u}\oplus h(X_{u}||ID_{u}||SID_{k}||T_{1})$
$H^{{}^{\prime}}_{u}=h(ID_{u}||G_{u}||X_{u}||R_{u}||T_{1}||SID_{k})$. $RC$
then check $H^{{}^{\prime}}_{u}\stackrel{{\scriptstyle?}}{{=}}H_{u}$ if not
true, terminates the session. Otherwise, $RC$ verify user successfully, and
then $RC$ extracts $X_{RS_{k}}$ from verifier table of $RC$, and generate time
stamp $T_{2}$ computes $X^{{}^{\prime}}_{u}=h(X_{u}||ID_{u}||SID_{k}||T_{1})$,
$H_{R_{c}}=$ $h(X_{RS_{k}}||X^{{}^{\prime}}_{u}||ID_{u}||SID_{k}||T_{2})$, and
encrypt the parameters
$(X^{{}^{\prime}}_{u},R_{u},ID_{u},H_{R_{c}},SID_{k},T_{1},T_{2})$ using share
secret key $X_{RS_{k}}$ and sends $E_{X_{RS_{k}}}$, $(X^{{}^{\prime}}_{u}$
$R_{u},ID_{u},H_{R_{c}},SID_{k},T_{1},T_{2})$ ,$SID_{k}$ to the server over
public channel.

  * Step AP 3:

On receiving the message, $S_{k}$ after checking the time delay
$(T_{c}-T_{2}\leq\delta T)$, decrypts
$D_{X_{RS_{k}}}(X^{{}^{\prime}}_{u},R_{u},ID_{u},H_{R_{c}},$ $SID_{k},T_{1})$
using the shared key ${X_{RS_{k}}}$. $S_{k}$ then computes
$H^{{}^{\prime}}_{R_{c}}=h(X_{RS_{k}}||$
$X^{{}^{\prime}}_{u}||ID_{u}||SID_{k}||T_{2})$ and checks the equality
$H^{{}^{\prime}}_{R_{c}}\stackrel{{\scriptstyle?}}{{=}}H_{R_{c}}$ if condition
is true, $S_{k}$ verifies $RC$ successfully. Further $S_{k}$ generates
$R_{s}$, $T_{3}$ and computes $M_{x}=R_{s}\oplus
h(ID_{u}||X^{{}^{\prime}}_{u}||R_{u}||T_{3})$
$H^{{}^{\prime\prime}}_{R_{c}}=h(R_{s}||M_{x}||T_{u}||ID_{u}||$ $T_{3})$.
$S_{k}$ further sends $\\{M_{x},H^{{}^{\prime\prime}}_{R_{c}},T_{3},T_{u},\\}$
to the $RC$, which in turn checks $(T_{c}-T_{3}\leq\delta T)$ and in
successful verification computes
$R_{s}=M_{x}\oplus(ID_{u}||X^{{}^{\prime}}_{u}||R_{u}||T_{3})$
$H^{{}^{\prime\prime\prime}}_{R_{c}}=h(R_{s}||M_{x}||T_{u}||ID_{u}||T_{3})$.
$RC$ then checks
$H^{{}^{\prime\prime\prime}}_{R_{c}}\stackrel{{\scriptstyle?}}{{=}}H^{{}^{\prime\prime}}_{R_{c}}$
terminates the session on success; otherwise, computes new dynamic identity
$RID_{u}=E_{X_{c}}(ID_{u}||r_{n})\oplus R_{s}$ for $U_{u}$ and forwards
$\\{M_{x},H^{{}^{\prime\prime}}_{R_{c}},T_{3},T_{u},RID_{u}\\}$ to the
legitimate user $U_{u}$.

  * Step AP 4:

$U_{u}$ on receiving the message, checks $T_{3}\leq\delta T_{c}$ and on
success computes
$R_{s}=M_{x}\oplus(ID_{u}||X^{{}^{\prime}}_{u}||R_{u}||T_{3})$,
$H^{{}^{\prime\prime\prime\prime}}_{R_{c}}=h(R_{s}||M_{x}||T_{u}||ID_{u}||T_{3})$
and checks whether $H^{{}^{\prime\prime\prime\prime}}_{R_{c}}$
$\stackrel{{\scriptstyle?}}{{=}}H^{{}^{\prime\prime}}_{R_{c}}$ if true then
session key $SK_{uk}=$
$h(X^{{}^{\prime}}_{u}$$||ID_{u}||SID_{k}||R_{s}||R_{u})$ is established
between user and server.

###  5.4 Password and Biometric Update Process

In this section, we also proposed the password change and biometric template
update process of our protocol, the $U_{u}$ will need to log in successfully
to change their current password and update their biometric template, The
detailed steps are described below:

  * Step CPB 1:

$U_{u}$ provides the credentials $ID_{u},PW_{u}$, and $BIO_{u}$ after
inserting the smart-card into a card reader to login. $BIO^{{}^{\prime}}_{u}$
is extracted from the captured $BIO_{u}$. $SC_{u}$ then computes
$CT^{{}^{\prime}}_{u}=f(BIO^{{}^{\prime}}_{u},TP_{u})$ and
$R^{{}^{\prime}}_{cu}=\varepsilon_{dec}(H_{u}\oplus CT^{{}^{\prime}}_{u})$.
Checks if $h(R^{{}^{\prime}}_{cu})=R$, then $SC_{u}$ computes
$r^{{}^{\prime}}_{i}=h(R^{{}^{\prime}}_{cu}||ID_{u}||PW_{u})$, and check if
$h(r^{{}^{\prime}}_{i})=P$, smart card then asks users $U_{u}$ to change their
password and update their biometric template.

$U_{u}$ | $RC$ | $S_{k}$
---|---|---
Insert Smart card |  |
Inputs $ID_{u},PW_{u},BIO^{{}^{\prime}}_{u}$ |  |
Calculates $CT^{{}^{\prime}}_{u}=f(BIO^{{}^{\prime}}_{u},TP_{u})$ |  |
$R^{{}^{\prime}}_{cod}=H_{u}\oplus CT^{{}^{\prime}}_{u}$ |  |
$Rc^{{}^{\prime}}_{u}=\aleph_{dec}(R^{{}^{\prime}}_{cod})$ |  |
Checks $h(Rc^{{}^{\prime}}_{u})=R?$ |  |
Calculates $r^{{}^{\prime}}_{u}=h(Rc^{{}^{\prime}}_{u}||ID_{u}||PW_{u})$ |  |
Checks $h(r^{{}^{\prime}}_{u})=h(r_{u})?$ |  |
Computes $N_{1}=(E_{u}\oplus r_{u})$ |  |
$A^{{}^{\prime}}_{u}=h(ID_{u}||PW_{u}||N_{1}||CT_{u})$ |  |
$X_{u}=(Y_{u}\oplus A^{{}^{\prime}}_{u})$ |  |
$DID_{u}=(PID_{u}\oplus A^{{}^{\prime}}_{u})$ |  |
Generates $R_{u}$ & $T_{1}$ |  |
$G_{u}=R_{u}\oplus h(X_{u}||ID_{u}||SID_{k}||T_{1})$ |  |
$H_{u}=h(ID_{u}||G_{u}||X_{u}||R_{u}||T_{1}||SID_{k})$ |  |
$\phantom{hhhhh}\xrightarrow[]{\\{M_{1}=(DID_{u},H_{u},G_{u},T_{1},SID_{k})\\}}$ |  |
| Checks $(T_{c}-T_{1}\leq\delta T)$ |
| $(ID_{u}||r_{o})=D_{X_{c}}(DID_{u})$ |
| Computes $X_{u}=h(ID_{u}||X_{c})$ |
| $R_{u}=G_{u}\oplus h(X_{u}||ID_{u}||SID_{k}||T_{1})$ |
| $H^{{}^{\prime}}_{u}=h(ID_{u}||G_{u}||X_{u}||R_{u}||T_{1}||SID_{k})$ |
| Checks $H^{{}^{\prime}}_{u}\stackrel{{\scriptstyle?}}{{=}}H_{u}$ |
| Extracts $X_{RS_{k}}$ from verifier table |
| Generates $T_{2}$ |
| Computes $X^{{}^{\prime}}_{u}=h(X_{u}||ID_{u}||SID_{k}||T_{1})$ |
| $H_{R_{c}}=h(X_{RS_{k}}||X^{{}^{\prime}}_{u}||ID_{u}||SID_{k}||T_{2})$ |
| $E_{X_{RS_{k}}}(X^{{}^{\prime}}_{u},R_{u},ID_{u},H_{R_{c}},SID_{k},T_{1},T_{2})$ |
| $\phantom{}\xrightarrow[]{\\{M_{2}=(E_{X_{RS_{k}}}(X^{{}^{\prime}}_{u},R_{u},ID_{u},H_{R_{c}},SID_{k},T_{1}),T_{2},SID_{k})\\}}$ |
|  | Check $(T_{c}-T_{2}\leq\delta T)$
|  | Server Decrypt using their share key
|  | $D_{X_{RS_{k}}}(X^{{}^{\prime}}_{u},R_{u},ID_{u},H_{R_{c}},SID_{k},T_{1})$
|  | Compute $H^{{}^{\prime}}_{R_{c}}=h(X_{RS_{k}}||X^{{}^{\prime}}_{u}||ID_{u}||SID_{k}||T_{2})$
|  | Check $H^{{}^{\prime}}_{R_{c}}\stackrel{{\scriptstyle?}}{{=}}H_{R_{c}}$
|  | Server verify Rc Successfully
|  | Generate random no $R_{s}$ time stamp $T_{3}$
|  | Compute $M_{x}=R_{s}\oplus h(ID_{u}||X^{{}^{\prime}}_{u}||R_{u}||T_{3})$
|  | $H^{{}^{\prime\prime}}_{R_{c}}=h(R_{s}||M_{x}||T_{u}||ID_{u}||T_{3})$
|  | $\phantom{}\xleftarrow[]{\\{M_{3}=(M_{x},H^{{}^{\prime\prime}}_{R_{c}},T_{3},T_{u})\\}}$
| Check $(T_{c}-T_{3}\leq\delta T)$ |
| Compute $R_{s}=M_{x}\oplus h(ID_{u}||X^{{}^{\prime}}_{u}||R_{u}||T_{3})$ |
| Generate $r_{n}$ |
| $RID_{u}=E_{X_{c}}(ID_{u}||r_{n})\oplus R_{s}$ |
| $H^{{}^{\prime\prime\prime}}_{R_{c}}=h(R_{s}||M_{x}||T_{u}||ID_{u}||T_{3})$ |
| Check $H^{{}^{\prime\prime\prime}}_{R_{c}}\stackrel{{\scriptstyle?}}{{=}}H^{{}^{\prime\prime}}_{R_{c}}$ |
| $\phantom{}\xleftarrow[]{\\{M_{4}=(M_{x},H^{{}^{\prime\prime}}_{R_{c}},T_{3},T_{u},RID_{u})\\}}$ |
Checks $(T_{c}-T_{3}\leq\delta T)$ |  |
Computes $R_{s}=M_{x}\oplus h(ID_{u}||X^{{}^{\prime}}_{u}||R_{u}||T_{3})$ |  |
$H^{{}^{\prime\prime\prime\prime}}_{R_{c}}=h(R_{s}||M_{x}||T_{u}||ID_{u}||T_{3})$ |  |
Checks $H^{{}^{\prime\prime\prime\prime}}_{R_{c}}\stackrel{{\scriptstyle?}}{{=}}H^{{}^{\prime\prime}}_{R_{c}}$ |  |
$DID_{new}=RID_{u}\oplus R_{s}\oplus A^{{}^{\prime}}_{u}$ |  |
Replaces $DID_{u}$ by $DID_{new}$ |  |
| $SK_{uk}=h(X^{{}^{\prime}}_{u}||ID_{u}||SID_{k}||R_{s}||R_{u})$ |

Figure 3: Login and Authentication phase

  * Step CPB 2:

For password change, $SC_{u}$ asks $U_{u}$ for a new password. $U_{u}$ inputs
the new password $PW^{new}_{u}$. $SC_{u}$ computes
$r^{new}_{u}=h(R^{{}^{\prime}}_{cu}||ID_{u}||PW^{new}_{u}),E^{new}_{u}=N_{1}\oplus
r^{new}_{u}$ and $P^{new}=h(r^{new}_{i})$. $SC_{u}$ updates its parameters
stored $\\{TP_{u},H_{u},R,$
$P^{new},h(\cdot),\varepsilon_{enc}(\cdot),\varepsilon_{dec}(\cdot),Y_{u},PID_{u},E^{new}_{u}\\}$
in smart card in its memory.

  * Step CPB 3:

To update the biometric template, $SC_{u}$ asks $U_{u}$ for a new
transformation parameter $TP^{new}_{i}$. The new cancel-able template is
generated as $CT^{new}_{i}=f(BIO_{u},TP^{new}_{i})$, and the new helper data
$H^{new}_{i}=CT^{new}_{i}\oplus\varepsilon_{enc}(R^{{}^{\prime}}_{ci})$ and
are stored in $SC_{u}$.

###  5.5 Smart Card Revocation Procedure

In this section, we proposed the smart card revocation, if the $SC_{u}$ of the
legitimate user $U_{u}$ is damaged, lost or stolen, then $RC$ will issue the
new smart card. For this process, the user provides their credential
$ID_{u},PW_{u},BIO_{u}$. The following steps are essential to complete this
procedure:

  * Step SCR 1:

$U_{u}$ computes $CT^{{}^{\prime}}_{i}=f(BIO_{i},TP_{i})$ and generates a
$160$-bit secret $N^{{}^{\prime}}_{1}$, then computes
$A^{{}^{\prime}}_{u}=h(N^{{}^{\prime}}_{1}||PW_{u}||ID_{u}||$
$CT^{{}^{\prime}}_{u})$, and transmits the request message
$\\{A^{{}^{\prime}}_{u},ID_{u}\\}$ to the $RC$ via a protected channel for
$SC^{new}_{u}$.

  * Step SCR 2:

$RC$ computes $X_{u}=h(ID_{u}||Xc),Y^{{}^{\prime}}_{u}=X_{u}\oplus
A^{{}^{\prime}}_{u}$, generate random $r^{{}^{\prime}}_{o}$ and computes
$PID^{{}^{\prime}}_{u}=E_{X_{c}}(IDu||r^{{}^{\prime}}o)\oplus
A^{{}^{\prime}}_{u}$ store $Y^{{}^{\prime}}_{u},PID^{{}^{\prime}}_{u},h(.)$ in
$SC_{u}$, then issue a $SC^{new}_{i}$ containing the credentials
$,Y_{u},PID^{{}^{\prime}}_{u},h(.)$. $SC^{new}_{i}$ is then sent to $U_{i}$
via a protected channel.

  * Step SCR 3:

$U_{u}$ computes $r^{{}^{\prime}}_{u}=h(Rc^{new}_{i}||ID_{u}||PW_{u})$,
$H^{u}_{new}=CT^{{}^{\prime}}_{u}\oplus\varepsilon_{enc}(Rc^{new}_{u}),,R=h(Rc^{new}_{u}),P=h(r_{u})$
and stores these values in $SC^{new}_{i}$ memory.

##  6 Security Analysis

In this section, we analyze our protocol using widely accepted Burrows-Abadi-
Needham (BAN) logic 30burrows1989logic , used to check the mutual
authentication between the user $U_{u}$, server $S_{k}$ and registration
center $RC$, The notation used in the BAN logic is given in fig 4.

Figure 4: Notations

###  6.1 Rules of BAN-Logic

The rules of authentication protocol are clearly mentioned in
30burrows1989logic , which illustrate that if only one rule is violate, then
the entire protocol is consider as flawed. Rules are define table in 1:

| Rules | Definition
---|---|---
Rule 1 | Message Meaning | $\frac{M|\equiv M\overset{K}{\longleftrightarrow}N.M\lhd<A>_{K}}{M|\equiv N|\sim A}$
Rule 2 | Nonce Verification | $\frac{M|\equiv\\#(A),M|\equiv N|\sim A}{M|\equiv N|\equiv A}$
Rule 3 | Jurisdiction | $\frac{M|\equiv N\Rightarrow A,M|\equiv N|\equiv A}{M|\equiv A}$
Rule 4 | Acceptance Conjuncatenation | $\frac{M|\equiv\ A,M|\equiv B}{M|\equiv(A,B)}$
Rule 5 | Freshness Conjuncatenation | $\frac{M|\equiv\\#(A)}{M|\equiv\\#(A,B)}$
Rule 6 | Session Key | $\frac{M|\equiv\\#(A),M|\equiv N\equiv A}{M|\equiv\ M\overset{K}{\longleftrightarrow}N}$
Table 1: Rules of BAN-Logic

###  6.2 Assumptions

  * •

A1:$U_{u}|\equiv\\#(R_{u},T_{1})$

  * •

A2:$S_{k}|\equiv\\#(R_{s},T_{3},T_{u})$

  * •

A3:$RC|\equiv\\#(T_{2})$

  * •

A4:$RC|\equiv U_{u}|\equiv\\#(R_{u},T_{1})$

  * •

A5:$RC|\equiv S_{k}|\equiv\\#(R_{u},T_{1})$

  * •

A6:$RC|\equiv RC\overset{X_{RS_{k}}}{\longleftrightarrow}S_{k}$

  * •

A7:$S_{k}|\equiv RC\overset{X_{RS_{k}}}{\longleftrightarrow}S_{k}$

  * •

A8:$RC|\equiv U_{u}\Rightarrow R_{u}$

  * •

A9:$RC|\equiv S_{k}\Rightarrow R_{s},T_{u}$

  * •

A10:$U_{u}|\equiv RC|\equiv S_{k}|\equiv\\#(R_{s},T_{3},T_{u})$

  * •

A11:$S_{k}|\equiv RC|\equiv U_{u}|\equiv\\#(R_{u},T_{1})$

  * •

A12:$RC|\equiv U_{u}|\equiv S_{k}|\overset{SK_{uk}}{\longleftrightarrow}U_{u}$

  * •

A13:$RC|\equiv S_{k}|\equiv U_{u}|\overset{SK_{uk}}{\longleftrightarrow}S_{k}$

###  6.3 Goals

  * •

$U_{u}|\equiv U_{u}\overset{SK_{uk}}{\longleftrightarrow}S_{k}$

  * •

$S_{k}|\equiv U_{u}\overset{SK_{uk}}{\longleftrightarrow}S_{k}$

The Idealized Form of Messages Four message are used in session key agreement
process which are:

  * •

Messages(1)$U_{u}\xrightarrow{}RC$:$\\{DID_{u},H_{u},G_{u},T_{1},SID_{k}\\}$

  * •

Messages(2)$RC\xrightarrow{}S_{k}$:$\\{E_{X_{RS_{k}}}(X^{{}^{\prime}}_{u},R_{u},ID_{u},H_{R_{c}},SID_{k},$
$T_{1},T_{2}),SID_{k}\\}$

  * •

Messages(3)$S_{k}\xleftarrow{}RC$:$\\{M_{x},H^{{}^{\prime\prime}}_{R_{c}},T_{3},T_{u}\\}$

  * •

Messages(4)$RC\xleftarrow{}U_{u}$:$\\{M_{x},H^{{}^{\prime\prime}}_{R_{c}},T_{3},T_{u},RID_{u}\\}$

$M_{1}$:- ${U_{u}\lhd\\{DID_{u},H_{u},G_{u},T_{1},SID_{k}}\\}$ or
$U_{u}\lhd\\{ID_{u},r_{o}\\}_{X_{c}}$, $h(ID_{u},G_{u},X_{u},R_{u},$
$T_{1},SID_{k})$, $R_{u}\oplus$ $h(X_{u},ID_{u},$ $SID_{k},T_{1}),\\\
T_{1},SID_{k}>$……….Eq.(A)
$M_{2}$:-
$S_{k}\lhd<\\{X^{{}^{\prime}}_{u},R_{u},ID_{u},H_{R_{c}},SID_{k},T_{1},T_{2}\\}_{X_{c}},SID_{k}>$
or $S_{k}\lhd$ $\\{h(X_{u},ID_{u},T_{1})$, $h(X_{RS_{k}},X^{{}^{\prime}}_{u},$
$ID_{u},SID_{k},T_{2})$,
$R_{u},ID_{u},SID_{k},T_{1},T_{2}\\}_{X_{c}},SID_{k},>$……Eq.(B)
$M_{3}$:- $RC\lhd$ $<M_{x},H^{{}^{\prime\prime}}_{R_{c}},T_{3},T_{u}>$ or
$R_{c}\lhd$ $<R_{s}\oplus h(ID_{u},X^{{}^{\prime}}_{u},R_{u},T_{3})$,
$h(R_{s},M_{x},T_{u},ID_{u},T_{3})$, $T_{3},T_{u}>$…..Eq.(C)
$M_{4}$:- $U_{u}\lhd$
$<M_{x},H^{{}^{\prime\prime}}_{R_{c}},T_{3},T_{u},RID_{u}>$ or $R_{c}\lhd$
$<U_{i}\oplus h(ID_{u},X^{{}^{\prime}}_{u},R_{u},T_{3})$,
$h(R_{s},M_{x},T_{u},ID_{u},T_{3})$,
$T_{3},T_{u},\\{{ID_{u},r_{n}\\}_{X_{c}}}$…..Eq.(D)

###  6.4 Protocol Analysis

The main security proofs are consist of the following steps:

  * •

From message "$M_{1}$" using (A1, A12) and Rule-1 we get
BN1: $RC|\equiv U_{u}\sim R_{u}$

  * •

Using A1 and Rule-2 on "BN1" we get
BN2: $RC|\equiv U_{u}|\equiv R_{u}$

  * •

Using A8 and Rule-3 on "BN2" we get.
BN3: $RC|\equiv R_{u}$
$RC$ believes that $R_{u}$ is fresh based on A3 and Rule-5

  * •

From message "$M_{2}$" using A7 and Rule-1 we get
BN4: $S_{k}|\equiv RC\sim X_{RS_{k}}$

  * •

Using (A7, A11) and Rule-3 on "BN4" we get
BN5: $S_{k}\equiv X_{RS_{k}}$
Server believes that $X_{RS_{k}}$ is secret parameter which is only known to
$S_{k}$ and $RC$. Using (A7, A11) and Rule-6 on "BN5" we get
BN6: $S_{k}|\equiv U_{u}\overset{SK_{uk}}{\longleftrightarrow}S_{k}$ Goal-1
achieved

  * •

From message "$M_{3}$" using (A2, A5) and Rule-1 we get
BN6: $RC|\equiv S_{k}\sim(R_{s},T_{3},T_{u})$

  * •

Using A2 and (Rule-2) on "BN6" we get
BN7: $RC|\equiv S_{k}|\equiv(R_{s},T_{3},T_{u})$

  * •

Using A9 and Rule-3 on "BN7" we get
BN8: $RC|\equiv(R_{s},T_{3},T_{u})$

  * •

From message "$M_{4}$" using (A4, A10) and Rule-1 we get
BN9: $U_{u}|\equiv RC\sim(R_{s},T_{3},T_{u},RID_{u})$

  * •

Using (A10) and Rule-3 on "BN9" we get
BN10: $U_{u}|\equiv RC|\equiv(R_{s},T_{3},T_{u},RID_{u})$

  * •

Using A9 and Rule-3 on "BN10" we get
BN11: $U_{u}|\equiv(R_{s},T_{3},T_{u},RID_{u})$
$U_{u}$ believes that $(R_{s},T_{3},T_{u},RID_{u})$ are fresh. $R_{s}$ is an
important parameter for session key agreement process.

  * •

Using A1 and Rule-6 on "BN11" we get
BN12: $U_{u}\equiv U_{u}\overset{SK_{uk}}{\longleftrightarrow}S_{k}$. Goal-2
achieved

##  7 Discussion on Functional Security

Following subsection solicits brief discussions on several security features
and resistance to known attacks provided by the proposed scheme.

###  7.1 Anonymity and Untraceability

In the authentication protocol, user anonymity and untraceability are
substantial aspects and if anonymity is broken, an adversary $A_{adv}$ can
easily recover sensitive information of the legitimate user like his current
location, moving tracks, a personal record and social circle, etc. In the
registration phase $RC$ encrypt the identity with random number
$E_{X_{c}}(ID_{u}||r_{o})$ by using his own secret key $X_{c}$. $SC_{u}$ does
not store this pseudo identity directly, as it is hidden by $PID_{u}$, So even
if the smart card were stolen by $A_{adv}$ he will still be incapable to get
the identity of the user. Moreover, after each successful authentication
request, this pseudo-identity is dynamically changed. Therefore, the proposed
protocol provides anonymity and untreceability.

###  7.2 Impersonation Attacks

To act as $RC$ an $A_{adv}$ required the secret key $X_{c}$ of $RC$, which is
hash with user identity $h(ID_{u}||X_{c})$, to compute the session key
$SK=h(X^{{}^{\prime}}_{u}||ID_{u}||SID_{k}||R_{s}||R_{u})$ an $A_{adv}$ also
requires to first compute $X_{u}=h(ID_{u}||X_{c})$. In addition $X_{u}$ is
also used in the construction of $RC$ signature that is,
$X^{{}^{\prime}}_{u}=h(X_{u}||ID_{u}||SID_{k}||T_{1})$. So without secret key
$X_{c}$ an $A_{adv}$ does not impersonate themselves as $RC$. Similarly to act
as legitimate user an $A_{adv}$ will required a valid login request that
is,$\\{DID_{u},H_{u},G_{u},T_{1},SID_{k}\\}$. To get all these values an
$A_{adv}$ needs the user credential like password $PW_{u}$ as well as
biometric $BIO_{u}$.

###  7.3 Replay Attack

Our protocol combat replay attack against all the login and authentication
messages. Suppose an $A_{adv}$ replays a past message that is
$\\{DID_{u},H_{u},G_{u},T_{1},SID_{k}\\}$. then on receiving side $RC$ will
always check the time-stamp $T_{1}$, as $T_{1}$ is outdated, $RC$ will
considered as replay, they neglect the message request.

###  7.4 Stolen Verifier Attack

Our protocol is fully secured against stolen verifier attack. $RC$ encrypt
shared key $E_{X_{c}}(X_{RS_{k}})$ using their own secret key $X_{c}$ to
handle stored verifier table, so adversary does not extract anything without
knowing the $X_{c}$.

###  7.5 Privileged Insider Attack

The proposed protocol successfully prevents a privilege insider attack. In the
registration phase $ID_{u}$ and $A_{u}=h(N_{1}||PW_{u}||ID_{u}||CT_{u})$ are
sent to $RC$, where password $PW_{u}$ identity $ID_{u}$ a random number
$N_{1}$ and cancel able template $CT_{u}$ are protected by one way hash
function. So it is impossible for an insider to guess these value.

###  7.6 Password Guessing Attacks

The proposed protocol is fully secured against the password guessing attack.
Suppose $RC$ take the screen shot of the user sensitive parameters like
$\\{TP_{u},H_{u},R,P,h(.)\aleph_{enc}(\cdot),\aleph_{dec}(\cdot)$
$Y_{u},PID_{u},E_{u}\\}$ which is stored on user smart card. Then they still
requires the cancel-able transformation parameter $CT_{u}$ along with $N_{1}$.
Moreover, an $A_{adv}$ still needs to guess identity $ID_{u}$ and password
$PW_{u}$ of user, if they unfortunately gets the $N_{1}$ and $CT_{u}$.

###  7.7 Denial of Services Attack

Our protocol is fully protected against the denial of services. $SC_{u}$
checks the validity of identity $ID_{u}$, password $PW_{u}$ and template
$CT_{u}$. If $A_{adv}$ or legitimate user try to enter the incorrect values,
then the $SC_{u}$ just simply cancel the request.

###  7.8 Perfect Forward Secrecy

The proposed protocol posses the prefect forward secrecy. The shared session
key $SK_{uk}=h(X^{{}^{\prime}}_{u}||ID_{u}||SID_{k}||R_{s}||R_{u})$
incorporate a random number $R_{u}$ used by the user. Suppose if $RC$
signature $X^{{}^{\prime}}_{c}$ is exposed to some $A_{adv}$ he will not be
able to compute previously shared session keys.

###  7.9 Resolve the Scalability Issues

In previous protocol the smart card store the $AM_{uk}=(AM_{k}\oplus
k^{{}^{\prime}}_{u})\oplus r_{u},BM_{uk}=(BM_{k}\oplus
k^{{}^{\prime}}_{u})\oplus r_{u}$ for every server $1\leq
k\leq(n+n^{{}^{\prime}})$, which is insufficient to store $(AM_{k})$ within
smart card due to its small magnetic chip which has limited storage. In the
proposed protocol there is no such parameter which stored the information of a
server.

##  8 Simulation tool for Formal Security Verification Using AVISPA Tool

In this section, we analyze proposed protocol using formal simulation tool,
for this purpose a well known and widely accepted AVISPA 31armando2006avispa
tool, is used for security verification used by different authentication
protocols 13das2015secure ; 32wazid2017design ; 33srinivas2018cloud ;
34chattaraj2018new . AVISPA

Figure 5: Role specification of user

Figure 6: Role specification of server

implements the HLPSL language which is then translated into the intermediate
formate (IF) with the help of translator known as "hlpsl2if". Four back ends
are used by IF, to check security goals, is satisfied or disrupt. The output
shows safe, unsafe or unsatisfactory. Details are mentioned in
31armando2006avispa . We define the three basic role i.e. role of user
$U_{u}$, role of registration center $RC$ and role of server $S_{k}$ along
with the session (between these participant), environment role and goals
fig[5,6,7,8], are stated in HLPSL. The results of AVISPA are shown in fig[9]
which tells that proposed protocol is secure against man in the middle attack
as well as replay attack. The OFMC back end shows the parse time: 0.00
seconds, the search time: 42.16 seconds, the number of visited nodes is 3344
and the depth 12 plies. whereas ATSE analyzes 8 states, the translation time
is 0.98 seconds. Hence, form this results it is shown our protocol provides
better security against Barman et al.’s protocol 21barman2018provably .
Although the search time, the translation time is slightly high compared to
Barman et al.’s protocol, because the number of visited nodes depth of
proposed protocol is greater than the previous protocol.

Figure 7: Role specification of Rc

Figure 8: Role specification of Session/Goal

Figure 9: Results of OFMC and CL-AtSe backends

##  9 Performance Analysis

In this section, we evaluate the performance of the proposed protocol with
other multi-server authentication protocols. The purpose of performance
analysis is to check resilience of proposed protocol against various attacks.

###  9.1  Security and functionality comparisons

The security and functionality comparison of proposed scheme with related
schemes is solicited in Table 2 under the DY and CK adversarial model as
described in subsection 2.5. The security comparison shows that only proposed
scheme provides resistance to all known attacks and fulfills related security
features; whereas, all the competing schemes either lacks one or more security
features or vulnerable to some security attacks.

Property/Feature | Our | 21barman2018provably  | 39chuang2014anonymous  | 40amin2015novel  | 41sood2011secure  | 42mishra2014secure  | 43he2014robust  | 44lu2015robust  | 45ali2017three
---|---|---|---|---|---|---|---|---|---
$FUN_{1}$ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗
$FUN_{2}$ | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ | ✓
$FUN_{3}$ | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ | ✓ | ✓
$FUN_{4}$ | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ | ✓
$FUN_{5}$ | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ | ✓
$FUN_{6}$ | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ | ✓
$FUN_{7}$ | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ✓
$FUN_{8}$ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓
$FUN_{9}$ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ | ✓ | ✓
$FUN_{10}$ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓
$FUN_{11}$ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗

  * •

$FUN_{1}$: user anonymity violation and untraceability; $FUN_{2}$: three-
factor security feature; $FUN_{3}$: error detection mechanism; $FUN_{4}$:
participant having mutual authentication; $FUN_{5}$: exchange of session key;
$FUN_{6}$: password update security; $FUN_{7}$: resistance against stolen
smart card attack; $FUN_{8}$: resistance against offline password guessing;
$FUN_{9}$: resistance against replay attack; $FUN_{10}$:resistance against
forgery attack; $FUN_{11}$: resistance against privileged-insider attack.

  * •

✓: a protocol safeguard the security functionality feature; ✗: a protocol is
lack of the security functionality feature.

Table 2: Security and functionality features comparison

###  9.2 Computation cost

In this subsection, we compare our protocol with the existing multi-server
authentication protocols considering the computation cost of login and
authentication phases. The following notation used for computation cost
describe below:

$\bullet$

$F_{H_{cost}}$: one-way cryptographic hash cost

$\bullet$

$F_{BH_{cost}}$: bio-hashing cost

$\bullet$

$F_{FE_{cost}}$: fuzzy extractor cost

$\bullet$

$F_{FCS_{cost}}$: fuzzy commitment cost

$\bullet$

$F_{ECM_{cost}}$: ecc point multiplication cost

$\bullet$

$F_{ASYM_{cost}}$: asymmetric key encryption/decryption cost

$\bullet$

$F_{Enc_{cost}}$: cost of block cipher encryption

The experimental results disclosed in 18reddy2017design , we choose
$F_{H_{cost}}$ = 0.0023 ms, $F_{Enc_{cost}}$ = 0.0046 ms, $F_{ECM_{cost}}$ =
2.226 ms and $F_{ASYM_{cost}}$ = 0.0046 ms. Furthermore,
$F_{FE_{cost}}=F_{ECM_{cost}}$, we also assume $F_{BH_{cost}}=F_{ECM_{cost}}$
and $F_{FCS_{cost}}=F_{ECM_{cost}}$. Although our protocol has slightly high
computation cost compared to Barman et al 21barman2018provably , but the
security level of our protocol is high. The comparison are briefly shown in
Table 3.

Protocol | Login phase | Authentication phase | Total cost | Rough estimation (ms)
---|---|---|---|---
Chuang-Chen39chuang2014anonymous  | $4C_{h}$ | $13C_{h}$ | $17C_{h}$ | 0.0391
Amin-Biswas40amin2015novel  | $C_{bh}+4C_{h}$ | $14C_{h}$ | $C_{bh}+18C_{h}$ | 2.2674
Sood41sood2011secure  | $7C_{h}c$ | $24C_{h}$ | $31C_{h}$ | 0.0713
Mishra42mishra2014secure  | $6C_{h}$ | $12C_{h}$ | $18C_{h}$ | 0.0414
He-Wang43he2014robust  | $3C_{h}+2C_{ecm}$ | $18C_{h}+6C_{ecm}$ | $21C_{h}+8C_{ecm}$ | 17.856
Lu44lu2015robust  | $C_{bh}+4C_{h}$ | $11C_{h}$ | $C_{bh}+15C_{h}$ | 2.2605
Ali-Pal45ali2017three  | $6C_{h}+C_{asym}+C_{bh}$ | $7C_{h}+C_{asym}$ | $13C_{h}+C_{bh}+2C_{asym}$ | 2.2651
Barman21barman2018provably  | $C_{fcs}+6C_{h}$ | $11C_{h}$ | $C_{fcs}+17C_{h}$ | 2.2651
Our | $C_{fcs}+6C_{h}$ | $13C_{h}+1C_{{E_{X_{c}}}}+1C_{{h}_{D_{X_{c}}}}$ | $C_{fcs}+19C_{h}+1C_{{E_{X_{c}}}}+1C_{{h}_{D_{X_{c}}}}$ | 2.2789

Table 3: Computation costs comparison

###  9.3 Communication cost

In this subsection, we evaluate and compare the communication cost of proposed
with existing protocols. During the login and authentication phases, the
communication cost is computed by the total number of bits which is
transmitted to other parties in the network, over a protected channel. We are
assuming the "SHA-1" hash function which has the cost of 160
bits35burrows2015secure , in the symmetric key encryption/decryption, has the
cost of 256 bits of length36kumar2019sebap , time stamp is 32 bits of length,
an elliptic curve point $P=(P_{a},P_{b})$ is 160 length of bits, where $P_{a}$
and $P_{b}$ is x and y coordinate of P point. Furthermore the security of
RSA37rivest1978method  public key cryptosystem is 1024-bit which is comparable
to ECC (elliptic curve cryptography) of 160-bits of length
38barker2012recommendation . In the proposed protocol, the communication cost
for the login request message $\\{DID_{u},H_{u},G_{u},T_{1},SID_{k}\\}$, which
is transmitted from a user $U_{u}$ to the$RC$ has cost of (160+160+160+32+32)
= 544 bits of length and the message
$\\{E_{X_{RS_{k}}}(X^{{}^{\prime}}_{u},R_{u},ID_{u},H_{R_{c}},SID_{k},T_{1}),SID_{k},T_{2}\\}$
transmitted to server $S_{k}$ from $RC$ is (256+32+32) = 332 bits and the
message transmitted to $RC$ from server $S_{k}$ is
$\\{M_{x},H^{{}^{\prime\prime}}_{R_{c}},T_{3},T_{u},\\}$ (160+160+32+32) = 384
bits and message transmitted to $U_{u}$ from $RC$ is
$\\{M_{x},H^{{}^{\prime\prime}}_{R_{c}},T_{3},T_{u},RID_{u}\\}$
(160+160+32+32+160) = 544 bits hence, the total number of bits for
communication is (544+332+384+544) = 1804 bits. The comparison results are
shown in Table 4.

protocol | Cost in login phase | Cost in authentication phase | Total cost | Communication mode
---|---|---|---|---
Chuang-Chen39chuang2014anonymous  | 512 | 512 | 1024 | $U_{u}\xrightarrow{}S_{k},S_{k}\xrightarrow{}U_{u}$
Amin-Biswas40amin2015novel  | 768 | 1152 | 1920 | $U_{u}\xrightarrow{}{}MS,MS\xrightarrow{}PS,PS\xrightarrow{}U_{u}$
Sood41sood2011secure  | 896 | 1216 | 2112 | $U_{u}\xrightarrow{}S_{k},S_{k}\xrightarrow{}CS,CS\xrightarrow{}S_{k},S_{k}\xrightarrow{}U_{u},U_{u}\xrightarrow{}S_{k}$
Mishra42mishra2014secure  | 640 | 640 | 1280 | $U_{u}\xrightarrow{}S_{k},S_{k}\xrightarrow{}U_{u},U_{u}\xrightarrow{}S_{k}$
He-Wang43he2014robust  | 640 | 2880 | 3520 | $U_{u}\xrightarrow{}S_{k},S_{k}\xrightarrow{}RC,RC\xrightarrow{}S_{k},S_{k}\xrightarrow{}U_{u},U_{u}\xrightarrow{}S_{k}$
Lu44lu2015robust  | 672 | 554 | 1226 | $U_{u}\xrightarrow{}S_{k},S_{k}\xrightarrow{}U_{u},U_{u}\xrightarrow{}S_{k}$
Ali-Pal45ali2017three  | 1344 | 320 | 1664 | $U_{u}\xrightarrow{}S_{k},S_{k}\xrightarrow{}U_{u}$
Barman21barman2018provably  | 544 | 1164 | 896 | $U_{u}\xrightarrow{}S_{k},S_{k}\xrightarrow{}U_{k}$
Our | 544 | 1260 | 1804 | $U_{u}\xrightarrow{}RC,RC\xrightarrow{}S_{k},RC\xleftarrow{}S_{k},U_{u}\xleftarrow{}RC$

Table 4: Communication cost comparison

##  10 Conclusion

Very recently Barman et al. presented a provably secure multi-server
authentication protocol using fuzzy commitment. The authors claimed that their
protocol provides various security services like privacy preservation of
user’s identity and biometric data, mutual authentication and session key
establishment between user and servers. Furthermore, barman et al. also
claimed that their protocol is secure against all known attacks. However, the
analysis in this paper shows that Barman et al.’s protocol cannot withstand
user anonymity violation as well as impersonation attack alongwith the
scalability issues. Then we proposed an improved and enhanced protocol to fix
the weaknesses of Barman et al.’s protocol. The proposed protocol is more
robust than Barman et al. and related protocols which is evident from rigorous
formal and informal security analysis. We have also validated the security of
the proposed protocol by simulation in popular and widely accepted security
analysis tool AVISPA.

## References

  * (1) Ali, R., Pal, A.K.: Three-factor-based confidentiality-preserving remote user authentication scheme in multi-server environment.  Arabian Journal for Science and Engineering 42(8), 3655–3672 (2017)
  * (2) Amin, R., Biswas, G.: A novel user authentication and key agreement protocol for accessing multi-medical server usable in tmis.  Journal of medical systems 39(3), 33 (2015)
  * (3) Amin, R., Biswas, G.: A novel user authentication and key agreement protocol for accessing multi-medical server usable in tmis.  Journal of medical systems 39(3), 33 (2015)
  * (4) Armando, A., Basin, D., Cuellar, J., Rusinowitch, M., Viganò, L.: Avispa: automated validation of internet security protocols and applications.  ERCIM News 64(January) (2006)
  * (5) Barker, E., Barker, W., Burr, W., Polk, W., Smid, M.: Recommendation for key management part 1: General (revision 3).  NIST special publication 800(57), 1–147 (2012)
  * (6) Barman, S., Das, A.K., Samanta, D., Chattopadhyay, S., Rodrigues, J.J., Park, Y.: Provably secure multi-server authentication protocol using fuzzy commitment.  IEEE Access 6, 38,578–38,594 (2018)
  * (7) Burrows, J.: Secure hash standard. fips pub 180-1, national institute of standards and technology (nist), us department of commerce, april 1995 (2015)
  * (8) Burrows, M., Abadi, M., Needham, R.M.: A logic of authentication.  Proceedings of the Royal Society of London. A. Mathematical and Physical Sciences 426(1871), 233–271 (1989)
  * (9) Canetti, R., Krawczyk, H.: Analysis of key-exchange protocols and their use for building secure channels.  In: International Conference on the Theory and Applications of Cryptographic Techniques, pp. 453–474. Springer (2001)
  * (10) Chattaraj, D., Sarma, M., Das, A.K.: A new two-server authentication and key agreement protocol for accessing secure cloud services.  Computer Networks 131, 144–164 (2018)
  * (11) Chaudhry, S.A., Naqvi, H., Khan, M.K.: An enhanced lightweight anonymous biometric based authentication scheme for tmis.  Multimedia Tools and Applications 77(5), 5503–5524 (2018)
  * (12) Chuang, M.C., Chen, M.C.: An anonymous multi-server authenticated key agreement scheme based on trust computing using smart cards and biometrics.  Expert Systems with Applications 41(4), 1411–1418 (2014)
  * (13) Das, A.K., Odelu, V., Goswami, A.: A secure and robust user authenticated key agreement scheme for hierarchical multi-medical server environment in tmis.  Journal of medical systems 39(9), 92 (2015)
  * (14) Debiao, H., Jianhua, C., Rui, Z.: A more secure authentication scheme for telecare medicine information systems.  Journal of Medical Systems 36(3), 1989–1995 (2012)
  * (15) Dolev, D., Yao, A.: On the security of public key protocols.  IEEE Transactions on information theory 29(2), 198–208 (1983)
  * (16) Fan, C.I., Chan, Y.C., Zhang, Z.K.: Robust remote authentication scheme with smart cards.  Computers & Security 24(8), 619–628 (2005)
  * (17) Fan, C.I., Lin, Y.H.: Provably secure remote truly three-factor authentication scheme with privacy protection on biometrics.  IEEE Transactions on Information Forensics and Security 4(4), 933–945 (2009)
  * (18) Hao, F., Anderson, R., Daugman, J.: Combining crypto with biometrics effectively.  IEEE transactions on computers 55(9), 1081–1088 (2006)
  * (19) He, D., Wang, D.: Robust biometrics-based authentication scheme for multiserver environment.  IEEE Systems Journal 9(3), 816–823 (2014)
  * (20) Juang, W.S., Chen, S.T., Liaw, H.T.: Robust and efficient password-authenticated key agreement using smart cards.  IEEE Transactions on Industrial Electronics 55(6), 2551–2556 (2008)
  * (21) Juels, A., Wattenberg, M.: A fuzzy commitment scheme.  In: Proceedings of the 6th ACM conference on Computer and communications security, pp. 28–36. ACM (1999)
  * (22) Kocher, P., Jaffe, J., Jun, B.: Differential power analysis.  In: Annual International Cryptology Conference, pp. 388–397. Springer (1999)
  * (23) Kumar, V., Ahmad, M., Kumari, A., Kumari, S., Khan, M.: Sebap: A secure and efficient biometric-assisted authentication protocol using ecc for vehicular cloud computing.  International Journal of Communication Systems p. e4103 (2019)
  * (24) Lamport, L.: Password authentication with insecure communication.  Communications of the ACM 24(11), 770–772 (1981)
  * (25) Lee, J., Ryu, S., Yoo, K.: Fingerprint-based remote user authentication scheme using smart cards.  Electronics Letters 38(12), 554–555 (2002)
  * (26) Li, C.T., Hwang, M.S.: An efficient biometrics-based remote user authentication scheme using smart cards.  Journal of Network and computer applications 33(1), 1–5 (2010)
  * (27) Lin, C.H., Lai, Y.Y.: A flexible biometrics remote user authentication scheme.  Computer Standards & Interfaces 27(1), 19–23 (2004)
  * (28) Lu, Y., Li, L., Yang, X., Yang, Y.: Robust biometrics based authentication and key agreement scheme for multi-server environments using smart cards.  PLoS One 10(5), e0126,323 (2015)
  * (29) Lwamo, N.M., Zhu, L., Xu, C., Sharif, K., Liu, X., Zhang, C.: Suaa: A secure user authentication scheme with anonymity for the single & multi-server environments.  Information Sciences 477, 369–385 (2019)
  * (30) Messerges, T.S., Dabbish, E.A., Sloan, R.H.: Examining smart-card security under the threat of power analysis attacks.  IEEE transactions on computers 51(5), 541–552 (2002)
  * (31) Mir, O., Nikooghadam, M.: A secure biometrics based authentication with key agreement scheme in telemedicine networks for e-health services.  Wireless Personal Communications 83(4), 2439–2461 (2015)
  * (32) Mishra, D., Das, A.K., Mukhopadhyay, S.: A secure user anonymity-preserving biometric-based multi-server authenticated key agreement scheme using smart cards.  Expert Systems with Applications 41(18), 8129–8143 (2014)
  * (33) Mitchell, C.J., Tang, Q.: Security of the lin-lai smart card based user authentication scheme.  Technical Report (2005)
  * (34) Qi, M., Chen, J.: An efficient two-party authentication key exchange protocol for mobile environment.  International Journal of Communication Systems 30(16), e3341 (2017)
  * (35) Qi, M., Chen, J.: New robust biometrics-based mutual authentication scheme with key agreement using elliptic curve cryptography.  Multimedia Tools and Applications 77(18), 23,335–23,351 (2018)
  * (36) Ratha, N.K., Chikkerur, S., Connell, J.H., Bolle, R.M.: Generating cancelable fingerprint templates.  IEEE Transactions on pattern analysis and machine intelligence 29(4), 561–572 (2007)
  * (37) Reddy, A.G., Das, A.K., Odelu, V., Ahmad, A., Shin, J.S.: A privacy preserving three-factor authenticated key agreement protocol for client–server environment.  Journal of Ambient Intelligence and Humanized Computing pp. 1–20 (2018)
  * (38) Reddy, A.G., Yoon, E.J., Das, A.K., Odelu, V., Yoo, K.Y.: Design of mutually authenticated key agreement protocol resistant to impersonation attacks for multi-server environment.  IEEE access 5, 3622–3639 (2017)
  * (39) Rivest, R.L., Shamir, A., Adleman, L.: A method for obtaining digital signatures and public-key cryptosystems.  Communications of the ACM 21(2), 120–126 (1978)
  * (40) Sood, S.K., Sarje, A.K., Singh, K.: A secure dynamic identity based authentication protocol for multi-server architecture.  Journal of Network and Computer Applications 34(2), 609–618 (2011)
  * (41) Srinivas, J., Das, A.K., Kumar, N., Rodrigues, J.: Cloud centric authentication for wearable healthcare monitoring system.  IEEE Transactions on Dependable and Secure Computing (2018)
  * (42) Wang, C., Zhang, X., Zheng, Z.: Cryptanalysis and improvement of a biometric-based multi-server authentication and key agreement scheme.  Plos one 11(2), e0149,173 (2016)
  * (43) Wazid, M., Das, A.K., Odelu, V., Kumar, N., Conti, M., Jo, M.: Design of secure user authenticated key management protocol for generic iot networks.  IEEE Internet of Things Journal 5(1), 269–282 (2017)
  * (44) Wu, Z.Y., Lee, Y.C., Lai, F., Lee, H.C., Chung, Y.: A secure authentication scheme for telecare medicine information systems.  Journal of medical systems 36(3), 1529–1535 (2012)
  * (45) Zhu, Z.: An efficient authentication scheme for telecare medicine information systems.  Journal of medical systems 36(6), 3833–3838 (2012)