Source-linked AI summary
A lightweight dynamic pseudonym identity based authentication and key agreement protocol without verification tables for multi-server architecture
Kaiping Xue, Peilin Hong, Changsha Ma
TL;DR
Traditional password authentication creates registration and verification-table burdens in multi-server environments, while the paper reports attacks against Li et al.’s protocol. It proposes a lightweight dynamic pseudonym identity protocol without server-side verification tables and claims essential security requirements with efficient overhead and storage.
Problem
Traditional password schemes require per-server registration and server verification tables, while Li et al.’s protocol is reported unable to resist several known attacks.
Method
The paper proposes a lightweight dynamic pseudonym identity authentication and key-agreement protocol for multi-server environments without verification tables at service-providing servers.
Results
The proposed protocol is reported to satisfy essential multi-server authentication and key-agreement security requirements while maintaining low computational, communication, and storage overhead.
Takeaways & Limitations
The protocol extends the declared security features with traceability and identity protection for multi-server authentication.
Takeaways & Limitations
The authors identify that Li et al.’s protocol remains vulnerable to replay, denial-of-service, internal, eavesdropping, smart-card forgery, and forgery attacks.
Abstract
from arXiv · showhide
Traditional password based authentication schemes are mostly considered in single server environments. They are unfitted for the multi-server environments from two aspects. On the one hand, users need to register in each server and to store large sets of data, including identities and passwords. On the other hand, servers are required to store a verification table containing user identities and passwords. Recently, On the base on Sood et al.'s protocol(2011), Li et al. proposed an improved dynamic identity based authentication and key agreement protocol for multi-server architecture(2012). Li et al. claims that the proposed scheme can make up the security weaknesses of Sood et al.'s protocol. Unfortunately, our further research shows that Li et al.'s protocol contains several drawbacks and can not resist some types of known attacks, such as replay attack, Deny-of-Service attack, internal attack, eavesdropping attack, masquerade attack, and so on. In this paper, we further propose a light dynamic pseudonym identity based authentication and key agreement protocol for multi-server architecture. In our scheme, service providing servers don't need to maintain verification tables for users. The proposed protocol provides not only the declared security features in Li et al.'s paper, but also some other security features, such as traceability and identity protection.
1. Introduction
The paper motivates multi-server authentication by identifying storage and registration burdens in traditional password schemes, then argues that Li et al.’s protocol retains important security weaknesses.
- Traditional password schemes require users to register with each server and store large sets of identities and passwords.
- They also require servers to maintain verification tables containing user identities and passwords.
- Hsiang and Shih proposed a multi-server protocol without verification tables, but Sood et al. reported replay, impersonation, and stolen-smart-card vulnerabilities.
- Li et al. claimed to remove Sood et al.’s weaknesses, but the paper reports vulnerabilities including verifier leakage, stolen smart cards, eavesdropping, replay, denial-of-service, and forgery attacks.
- The paper analyzes Li et al.’s protocol weaknesses, presents a replacement protocol, and evaluates its security and performance.
2. Overview of Li et al.’s protocol
Li et al.’s protocol uses users, service-providing servers, and a trusted control server across registration, login, authentication, and key-agreement operations. Messages are exchanged through the control server, which verifies participants before the shared session key is computed.
- The protocol involves users, service-providing servers, and a trusted control server responsible for registration and authentication.
- During registration, the control server distributes security elements, while the user derives Ai from a random value and password and receives a smart card.
- The user’s login phase checks the entered identity and password against smart-card data before authentication and key agreement begin.
- The user sends {Fi, Gi, Pij, CIDi} to a service server, which forwards the data with SIDj, Ki, and Mi to the control server.
- The control server recovers and verifies values associated with the service server and user, selects Ni3, and returns {Qi, Ri, Vi, Ti}.
- The service server verifies the control server’s response, sends {Vi, Ti} to the user, and the participants separately compute a shared session key.
3. Security weakness analysis of the protocol
The analysis identifies multiple weaknesses in Li et al.’s protocol, including replay, internal, eavesdropping, forgery, and masquerade attacks. These weaknesses can enable unauthorized session-key computation, denial of service, and impersonation of users or servers.
- Replay and Deny-of-Service attacks: Replayed login messages can force servers and the control server to perform unnecessary protocol steps, enabling denial-of-service attacks.The protocol cannot identify the replayed message before consuming computing, communication, and storage resources.
- Internal attack: An internal attacker with a legitimate smart card can obtain h(y) and h(y||x), then derive session keys shared by other participants.The attack uses values stored in the smart card and enables eavesdropping on other users’ sessions.
- Smart card forgery attack: A malicious attacker can forge a smart card because the control server does not verify Ai and Bi, allowing forged credentials to pass legitimacy checks.The attacker selects random As and Bi values, constructs the remaining card elements, and uses the forged card to establish a session key with Sj and CS.
- Eavesdropping attack: Eavesdropping public messages exposes Am, Bm, and Nm1, after which the attacker can compute the negotiated session key and decrypt encrypted data.The attack extracts intermediate values from the exchanged messages and recovers the session key among Um, Sn, and CS.
- Masquerade attack against a user: With leaked security information, an attacker can impersonate a legitimate user and cause the server and control server to accept a forged first message.The parties agree on a session key while mistakenly believing they are communicating with Um.
- Masquerade attack against a server: An attacker can also impersonate a service server, causing the user to believe the attacker is Sn while enabling decryption of the user’s encrypted data.The attacker attaches Ki and Mi to the user’s message, passes CS verification, and later obtains the session key through the masquerade procedure.
4. Our proposed improved protocol
The proposed protocol uses a trusted control server, smart cards, dynamic pseudonym identities, and three phases to support multi-server authentication and key agreement. It also supports password and pseudonym updates.
- The protocol has three participants—users, service providing servers, and a controlling server—and three phases: registration, login, and authentication with key agreement.
- Initialization and registration phase: The control server registers users and servers, while users store protocol values in smart cards and servers store protected registration values.
- Login phase: During login, users verify their password through the smart card and send pseudonym-based authentication data to the service provider over a public channel.
- Authentication and key agreement phase: The service provider and control server exchange authenticated values before sending responses that allow the user, server, and control server to compute a common session key.
- Updating credentials and identities: Users can change passwords and periodically update pseudonym identities, while service providers can also update their protected pseudonym identities.
5. Security analysis of our protocol
The paper evaluates its protocol through a security-functionality comparison with two related protocols. It reports that the proposed protocol is more secure than both comparison protocols.
- The security analysis compares the proposed protocol with two related protocols using a security-functionality comparison.
- The authors report that their protocol is more secure than the two related protocols.
5.1. Providing user anonymity
The protocol provides user anonymity by replacing real identities with protected pseudonyms and periodically changing those pseudonyms. The control server retains the ability to recover and link real identities, providing traceability.
- Protected pseudonym identities prevent malicious attackers and service providing servers from obtaining users’ real identities.
- Periodic pseudonym updates prevent attackers from linking eavesdropped messages from different sessions to the same user.
- The control server can extract users’ real identities and link them to protected pseudonyms, adding traceability.
5.3. Providing identity protection
Dynamic protected pseudonym identities shield user and server identities from malicious attackers while allowing the legitimate control server to obtain real identities. User-specific parameters also limit insider attacks against other users.
- Protected pseudonym identities for users and servers prevent malicious attackers from learning their private identities.
- Because the pseudonym identities can change over time, attackers cannot link eavesdropped messages across sessions as easily.
- User-specific values such as B_f prevent an insider from generating another user’s smart-card parameters or masquerading as that user.
5.5. Resistance of stolen smart card attack
The protocol assumes that stolen smart-card data alone does not let an attacker recover protected values without the correct password. Timestamp verification also makes replay and denial-of-service attacks harder to launch.
- A stolen smart card exposes (Ci, Di, h(·), b) to an attacker under the protocol’s stated assumption.
- Without the correct password Pi, the attacker cannot compute Ai or extract Bi from Di.
- Timestamp use prevents early messages from being reused, making replay and denial-of-service attacks harder to launch.The protocol also uses Pij and TSi when computing Ki to avoid replay using eavesdropped Ki and Mi values from Li et al.’s protocol.
5.7. Resistance of eavesdrop attack
The protocol protects user security information against eavesdropping and limits cross-user exploitation of protocol values. It also prevents attackers from computing the session key from intercepted messages.
- Resistance of eavesdrop attack: Eavesdroppers cannot extract private security information from messages sent over public channels.Using PID in computing B_i and withholding h(x) and h(y||x) from users prevents cross-user extraction of security elements.
- Resistance of eavesdrop attack: An attacker cannot compute the session key because the required N_i1 ⊕ N_i2 ⊕ N_i3 value cannot be derived.The protocol also prevents deriving U_i's security information from eavesdropped messages among U_i, S_j, and CS.
6. Performance Analysis
The proposed protocol is evaluated for computational, communication, and storage overhead against Li et al.'s and Sood et al.'s protocols. It has comparable computation, four message transmissions, and no verification table at service-providing servers.
- Computational complexity: Table 4 compares the computational complexity of the proposed protocol with Li et al.'s and Sood et al.'s protocols.XOR and concatenation operations are omitted because they require very few computations.
- Computational complexity: The proposed protocol has almost the same computational complexity as the two related protocols.The comparison covers the login, authentication, and session key agreement phases; five optional CS hash operations support traceability.
- Communication overhead: All three protocols require 4 message transmissions during authentication and key agreement.The four transmissions are U_i → S_j, S_j → CS, CS → S_j, and S_j → U_i.
- Storage overhead: Service-providing servers do not maintain verification tables, while CS uses its table only during registration.Each user needs one smart card, and each service-providing server stores only protocol-specific values.
7. Conclusions
The paper proposes an improved dynamic pseudonym identity-based authentication and key agreement protocol for multi-server environments. Compared with related protocols, it reports essential security requirements and low computational, communication, and storage overhead.
- Conclusions: The paper proposes an improved dynamic pseudonym identity-based authentication and key agreement protocol for multi-server environments.The proposal is based on analyzing security weaknesses in Li et al.'s protocol.
- Conclusions: The proposed protocol is reported to maintain low computational complexity, low communication overhead, and low storage overhead compared with related protocols.The authors state that these efficiency properties are retained while satisfying essential security requirements.