A Robust IoT-Based Three-Factor Authentication Scheme for Cloud Computing Resistant to Session Key Exposure

Abstract

With the development of Internet of Things (IoT) technologies, Internet-enabled devices have been widely used in our daily lives. As a new service paradigm, cloud computing aims at solving the resource-constrained problem of Internet-enabled devices. It is playing an increasingly important role in resource sharing. Due to the complexity and openness of wireless networks, the authentication protocol is crucial for secure communication and user privacy protection. In this paper, we discuss the limitations of a recently introduced IoT-based authentication scheme for cloud computing. Furthermore, we present an enhanced three-factor authentication scheme using chaotic maps. The session key is established based on Chebyshev chaotic-based Diffie–Hellman key exchange. In addition, the session key involves a long-term secret. It ensures that our scheme is secure against all the possible session key exposure attacks. Besides, our scheme can effectively update user password locally. Burrows–Abadi–Needham logic proof confirms that our scheme provides mutual authentication and session key agreement. The formal analysis under random oracle model proves the semantic security of our scheme. The informal analysis shows that our scheme is immune to diverse attacks and has desired features such as three-factor secrecy. Finally, the performance comparisons demonstrate that our scheme provides optimal security features with an acceptable computation and communication overheads.

Chaotic-map based authenticated security framework with privacy preservation for remote point-of-care

“…In 1991, Frank et al [43] presented a key agreement protocol that completely relies on HTTP. Conversely, Yang et al [41] presented that Frank et al were uncertain to withstand the vulnerabilities such as redirection, replay attack, and man-in-themiddle. Yang et al constructed a competent user authentication, which resolves the key issues of Frank et al Of late, several authentication mechanisms, namely two-factor [41], three-factor [11], identity-based [8], etc.…”

“…Conversely, Yang et al [41] presented that Frank et al were uncertain to withstand the vulnerabilities such as redirection, replay attack, and man-in-themiddle. Yang et al constructed a competent user authentication, which resolves the key issues of Frank et al Of late, several authentication mechanisms, namely two-factor [41], three-factor [11], identity-based [8], etc. have been constructed using pairing-based, factoring and discrete logarithm, elliptic-curve (EC) cryptography [22], and chaotic-map [40].…”

“…Hence, it is widely identified to be chaotic-map based authentication schemes to achieve less computation and communication efficiencies than ECC or RSA-based authentication protocol. Many chaotic-map based authentication protocols are susceptible to desynchronization [41] and denial-of-service (DoS) attack [11]. Moreover, their schemes cannot offer client anonymity [46] and revocation mechanism for stolen or lost smartcard [11].…”

An Improved Three-Factor Session Initiation Protocol Using Chebyshev Chaotic Map

“…As far as we know, we are the first to apply Chebyshev chaotic map to SIP. Chebyshev chaotic map has been used in many environments to achieve identity verification, such as medical information system environment [25], cloud computing environment [26], and IOT environment [27]. Compared with other lightweight authentication schemes, Chebyshev chaotic map has higher level of efficiency and security.…”

Security Analysis on “Anonymous Authentication Scheme for Smart Home Environment with Provable Security”

“…Recently, numerous user authentication schemes are proposed [4][5][6][7]. Most recently, Shuai et al [8] designed a new anonymous authentication scheme for a smart home environment.…”