ITSSAKA-MS: An Improved Three-Factor Symmetric-Key Based Secure AKA Scheme for Multi-Server Environments

Abstract

A variety of three-factor smart-card based schemes, specifically designed for telecare medicine information systems (TMIS) are available for remote user authentication. Most of the existing schemes for TMIS are customarily proposed for the single server-based environments and in a single-server environment. Therefore, there is a need for patients to distinctly register and login with each server to employ distinct services, so it escalates the overhead of keeping the cards and memorizing the passwords for the users. Whereas, in a multi-server environment, users only need to register once to resort various services for exploiting the benefits of a multi-server environment. Recently, Barman et al. proposed an authentication scheme for e-healthcare by employing a fuzzy commitment and asserted that the scheme can endure many known attacks. Nevertheless, after careful analysis, this paper presents the shortcoming related to its design as well as it is to prove in this paper that the scheme of Barman et al. is prone to many attacks including: server impersonation, session-key leakage, user impersonation, secret temporary parameter leakage attacks as well as its lacks user anonymity. Moreover, their scheme has the scalability issue. In order to mitigate the aforementioned issues, this work proposes an amended three-factor symmetric-key based secure authentication and key agreement scheme for multi-server environments (ITSSAKA-MS). The security of ITSSAKA-MS is proved formally under automated tool AVISPA along with a security feature discussion. Although, the proposed scheme requisites additional communication and computation costs, but the informal and automated formal security analysis indicate that only proposed scheme withstands several known attacks as compared with recent schemes. INDEX TERMS Authentication and key-agreement (AKA), AVISPA tool, E-Healthcare, Fuzzy commitment scheme, Multi-server authentication, Telecare medicine information system (TMIS).

Comments on “ITSSAKA-MS: An Improved Three-Factor Symmetric-Key Based Secure AKA Scheme for Multi-Server Environments”

“…• M A can steal the legal user's smart card and extract the stored secret credentials in memory by performing power analysis [3]- [5]. • M A can be a legitimate and privileged insider, which is able to reveal the verifier table stored in the RC database [1]. • After getting the secret credentials of the smart card, an adversary may attempt potential attacks such as "MITM", "masquerade", "off-line password guessing" attacks and so on [6]- [8].…”

“…We briefly review Ali et al's AKA scheme for multiserver environments. Ali et al's scheme [1] is composed of three processes: user registration, server registration, authentication, and key establishment. The symbols utilized in this paper are summarized in Table 1.…”

“…This comment is about "ITSSAKA-MS: An Improved Three-Factor Symmetric-Key Based Secure AKA Scheme for Multi-Server Environments", that is proposed by Ali et al [1]. They claimed that their scheme can prevent various security attacks, and also ensure secure authentication.…”

“…In 2020, Ali et al [1] designed a biometric-based secure AKA scheme to provide secure services in multi-server environments. Ali et al claimed that their scheme is able to resist various security threats such as impersonation, replay, session key exposure, and insider attacks.…”

“…However, this comment shows that their scheme is vulnerable to session key exposure, man-in-the-middle (MITM) and masquerade attacks, and also does not provide mutual authentication. Therefore, we suggest the some guidelines to resolve the security threats of Ali et al [1].…”