Secure and Efficient User Authentication Scheme Based on Password and Smart Card for Multiserver Environment

Abstract

The rapid development of information and network technologies motivates the emergence of various new computing paradigms, such as distributed computing, cloud computing, and edge computing. This also enables more and more network enterprises to provide multiple different services simultaneously. To ensure these services can only be accessed conveniently by authorized users, many password and smart card based authentication schemes for multiserver architecture have been proposed. Recently, Truong et al. introduced an identity based user authentication scheme on elliptic curve cryptography in multiserver environment and claimed that their scheme is secure against popular attacks. However, in this paper, we point out that their scheme suffers from offline password guessing and impersonation attack and fails to achieve security requirements of this kind of authentication scheme. Moreover, we put forward a new scheme to conquer security pitfalls in the above scheme. Security analysis indicates that the proposed scheme can be free from well-known attacks. Performance discussion demonstrates that our scheme has advantages in terms of both security property and computation efficiency and thus is more desirable for practical applications in multiserver environment.

D-FAP: Dual-Factor Authentication Protocol for Mobile Cloud Connected Devices

“…Recently, many smart card authentication protocols based on the password were proposed [42][43][44]. Most of these protocols are still vulnerable to ID-theft attack, offline password guessing attacks, undetectable online password guessing attacks, and user impersonation attack.…”

Security of Low Computing Power Devices: A Survey of Requirements, Challenges & Possible Solutions

“…The methodology of calculating the computational time is the same as discussed in Subsection 4.1. The smart card protocols [106][107][108][109] are based on modular exponentiations whereas protocol [105] and [110][111][112] The cost of other operations has been ignored in this analysis as the time taken by them is reasonably small in comparison to modular exponentiation and elliptic curve point multiplication. Computational cost of the smart card protocols has been publicized in Table 14 (p is the number of elliptic curve point multiplications;…”

“…3 presents the graphical analysis of computational of different smart card security protocols. [110] 3 0 3 0 6 0 7.503 7.503 15.006 Xie et al [105] 3 0 3 0 6 0 7.503 7.503 15.006 T r u o n g et al [111] 2 0 2 0 4 0 5.002 5.002 10.004 Z h a o, L i and J i a n g [112] 2 0 2 0 4 0 5.002 5.002 10.004…”

“…Yeh [107] × ×  × ×    ×   × W a n g et al [108]   ×         × O d e l u, Das and G o s w a m i [109]        × × ×   C h a u d h r y et al [110]             Xie et al [105]             T r u o n g et al [111]     ×    × ×  × Z h a o, L i and J i a n g [112]            …”

Block-hash of blockchain framework against man-in-the-middle attacks

“…An information system improves usability, maintainability, and security through standardization and development of best practices [3,4]. Authentication is the main gateway in an information system to get authorization to access the account [5]. The authentication process is a user validation process in a smart card, biometric, or username-password [6,7].…”