An improved anonymous authentication scheme for roaming in ubiquitous networks

Abstract

With the evolution of communication technology and the exponential increase of mobile devices, the ubiquitous networking allows people to use our data and computing resources anytime and everywhere. However, numerous security concerns and complicated requirements arise as these ubiquitous networks are deployed throughout people’s lives. To meet the challenge, the user authentication schemes in ubiquitous networks should ensure the essential security properties for the preservation of the privacy with low computational cost. In 2017, Chaudhry et al. proposed a password-based authentication scheme for the roaming in ubiquitous networks to enhance the security. Unfortunately, we found that their scheme remains insecure in its protection of the user privacy. In this paper, we prove that Chaudhry et al.’s scheme is vulnerable to the stolen-mobile device and user impersonation attacks, and its drawbacks comprise the absence of the incorrect login-input detection, the incorrectness of the password change phase, and the absence of the revocation provision. Moreover, we suggest a possible way to fix the security flaw in Chaudhry et al’s scheme by using the biometric-based authentication for which the bio-hash is applied in the implementation of a three-factor authentication. We prove the security of the proposed scheme with the random oracle model and formally verify its security properties using a tool named ProVerif, and analyze it in terms of the computational and communication cost. The analysis result shows that the proposed scheme is suitable for resource-constrained ubiquitous environments.

Introduction

The development of communication technology provides efficient services based on sustainable infrastructures that improve the human quality of life. As smart devices such as smartphones, smart watches, and tablets become widely available, it has become possible to access various services and to allow people to utilize information anytime and anywhere. Also, the ubiquitous smart society, in which the combining of the data from smart devices and various sensors enables intelligent communication, is being built in the form of the smart city [1, 2].

In this smart city, the ubiquitous network provides useful information and resources for remote operations such as human-resource management and enterprise-resource management by connecting to a home agent (HA) through the roaming of a foreign agent (FA) while a citizen is moving [3, 4].

For a user mobile device to be able to remotely access the authority of various services via the HA, remote user authentication is required. In the remote authentication scheme, the user identifier is required to verify that the user is legitimate. This identifier such as an ID and password is associated with user privacy, and it can seriously affect the user security when they are leaked; therefore, the login and authentication requests of the user that are transmitted to the public channel with the identifier can be easily targeted by an attacker. Due to this issue, the user anonymity and untraceability should be maintained in the remote authentication process [5].

In addition, after the user login and authentication requests are accepted, the participants on the ubiquitous network must share the same session key for secure future communications. At this time, to establish a secure session key from an attacker’s spoofing attack that threatens the security of the participants, the key should not be directly distributed from one node to the other. The key agreement must be performed after a mutual authentication in which the participants identify each other’s legitimacy [6].

In recent years, authentication techniques [7–13] have been frequently proposed. A two-factor authentication scheme using the user ID and password is widely used. However, the password-based authentication scheme has the security issue that it is vulnerable to password-guessing attacks. A key technology to overcome this security issue is a biometric-based three-factor authentication method. Since biometric keys (irises, fingerprints, hand geometry, palm prints, etc.) represent unique human characteristics, they have the following advantages [14]: (1) Biometric keys cannot be lost or forgotten; (2) it is extremely difficult to forge or distribute biometric keys; (3) biometric keys maintain uniqueness; and (4) it is difficult to guess biometric keys. Thus, it is obvious that the biometric-based user authentication methods are more secure and reliable than the traditional password-based user authentication methods.

Combining password and biometric key makes it difficult to guess the user credentials. Because of this, three-factor authentication schemes that use the uniqueness of users have recently been proposed [15, 16]. However, there are some caveats to be noted when practically applying biometric-based authentication techniques. First, as mentioned, biometrics is a human characteristic, so it cannot be changed, unlike a password. Consequently, if it is leaked, it will cause serious privacy problems [17]. Therefore, the original biometric template or the feature-vector value of users should not be directly exported. To enhance the security, many biometric-based authentication schemes have been proposed using techniques for extracting user’s biometrics into a random value such as a bio-hash or a fuzzy-extractor [18–20].

Over the past few years, a number of authentication scheme have been proposed to support the roaming in ubiquitous networks. In 2004, Zhu and Ma [21] presented the first password-based authentication scheme for ubiquitous networks to protect the security of ubiquitous networks, but Lee et al. [22] then demonstrated that this scheme does not achieve a perfect backward secrecy and a mutual authentication, and also its failure to resist the forgery attack. To enhance the security of Zhu and Ma’s scheme [21], Lee et al. [22] proposed an improved password-based authentication scheme. In 2008, however, Wu et al. [23] proved that the schemes of both Zhu and Ma [21] and Lee et al. [22] do not preserve the user anonymity, and the latter scheme does not achieve a perfect backward secrecy; additionally, Wu et al. [23] proposed simple solutions to fix the drawbacks of the two schemes. In 2012, however, Mun et al. [24] showed that the scheme of Wu et al. [23] does not achieve the user anonymity and a perfect forward secrecy and they presented an enhanced password-based authentication scheme to overcome these weaknesses. Unfortunately, in 2014, Zhao et al. [25] then proved that the scheme of Mun et al. [24] is vulnerable to various attacks.

In 2011, He et al. [26] proposed a lightweight password-based authentication scheme, claiming that it satisfies the various security requirements for ubiquitous networks. In 2013, however, Jiang et al. [27] proved that He et al.’s scheme [26] does not prevent the off-line password guessing, server-spoofing, replay, and privileged-insider attacks, and they also presented an enhanced password-based authentication scheme to overcome these weaknesses. Wen et al. [28] subsequently showed that Jiang et al.’s scheme [27] is vulnerable to stolen-verifier, server-spoofing, replay, and denial-of-service attacks and its failure regarding the provision of the forward secrecy. In 2015, in a different study of Farash et al. [29], and Gope and Hwang [30], it was common that Wen et al.’s scheme [28] is insecure against the known attacks. Then, Farash et al. [29], and Gope and Hwang [30] independently introduced the improved password-based authentication schemes that prevent the various attacks. Nevertheless, Wu et al. [31] showed both schemes of Farash et al. [29], and Gope and Hwang [30] are vulnerable to various attacks. In addition, Chaudhry et al. [32] also found a number of security pitfalls in Farash et al.’s scheme [29] such as a user-anonymity violation and the disclosure of the secret parameters of the mobile node (MN) and the session key.

Contributions of the paper

Recently, Chaudhry et al. [32] proposed a privacy-preserving password-based authentication scheme for roaming in ubiquitous networks to solve the security issues of Farash et al.’s scheme [29]. They claimed that their scheme is secure against the various known attacks and is lightweight compared with the earlier scheme of Farash et al. [29]. However, We found that Chaudhry et al.’s scheme [32] is still vulnerable to several attacks; therefore, in this paper, we provide the proof that Chaudhry et al.’s scheme [32] is vulnerable to stolen-mobile devices and user impersonation attacks, and has drawbacks to the absence of the incorrect login-input detection, incorrect password change phase, and the absence of the revocation-process provision. To fix the security flaw of the scheme of Chaudhry et al. [32], we present an improved biometric-based authentication scheme for roaming in ubiquitous networks in this paper. In addition, to achieve the three-factor authentication that protects the user’s biometrics, a bio-hash technique is applied in the proposed scheme whenever the user imprints his/her biometrics on a mobile device. Furthermore, we perform formal and informal analyses to prove that the proposed scheme meets the various security requirements, and conduct the comparisons in terms of the computational and communication cost to show the efficiency of the proposed scheme.

Organization of the paper

The remainder of this paper is organized as follows. In Section 2, a number of preliminaries are introduced. A brief review of the scheme of Chaudhry et al. [32] is presented in Section 3, and a cryptanalysis of Chaudhry et al. [32]’s scheme is presented in Section 4. The proposed scheme is presented in Section 5. The proposed scheme is analyzed in terms of formal and informal security in Section 6. Data from the comparisons of the performance of the proposed scheme with other related works are presented in Section 7. The conclusion of this paper is provided in Section 8.

Preliminary knowledge

This section introduces the requisite basic knowledge for the attainment of an understanding of the authentication process in ubiquitous networks, adversarial models, security requirements, and bio-hash functions.

User authentication in ubiquitous networks

To enable the roaming service in ubiquitous networks, MN and FA perform a mutual authentication and share the session key with the support of the HA. The brief description of the user authentication process that is depicted in Fig 1 is as follows:

1. MN sends a login and authentication request message to FA while it visits foreign networks.

2. After it receives the request message from MN, FA transmits it to HA for the authentication of MN.

3. HA authenticates MN by checking the received message from FA, and it responds accordingly to FA.

4. FA sends a response to MN, and then both MN and FA authenticate each other.

Fig 1. User authentication process in ubiquitous networks.

Adversarial model

For the analysis of the security of Chaudhry et al. and the proposed scheme in this paper, we consider the adversarial model with following the capacity of adversary:

1. The adversary $\mathcal{A}$ has full control over the public communication channel, which means that $\mathcal{A}$ can eavesdrop, insert, delete, alter, or intercept any of the transmitted messages of the public channel.

2. If $\mathcal{A}$ obtains a stolen or lost mobile device of a user in some way, he/she is able to extract the secret parameters from the device using side-channel attacks [33–36].

3. $\mathcal{A}$ is capable of enumerating off-line all of the possible items in the Cartesian product ${\mathcal{D}}_{id}*{\mathcal{D}}_{pw}$ within polynomial time, where ${\mathcal{D}}_{id}$ and ${\mathcal{D}}_{pw}$ denote the dictionary spaces of the identity and password, respectively [37, 38].

Security requirements

Based on recent research efforts [6, 39–41], a biometrics-based authentication scheme for roaming in ubiquitous networks should meet the following security requirements against the adversarial model and the functional requirements to provide user-friendliness:

1. User anonymity: The scheme must ensure the user anonymity to preserve the privacy of MN, i.e., $\mathcal{A}$ should not be able to discover the real identity of MN.

2. Unlinkability: To provide greater security for the user’s privacy, the scheme should ensure unlinkability, i.e., $\mathcal{A}$ should not be able to trace the user’s actions.

3. Mutual authentication: The schemes should support mutual authentication to ensure the legitimacy of each participant, i.e., MN, FA, and HA are capable of authenticating each other in the authentication phase.

4. Session key agreement: When the scheme permits the establishment of a session key between each of the participants, the session key that is used to encrypt and decrypt messages in the future communications should be fresh and provide the forward secrecy.

5. Three-factor secrecy: To ensure the secrecy of the user’s private keys, the scheme should provide three-factor (e.g., identity, password, and biometrics) secrecy. The $\mathcal{A}$ should not be able to extract one secret value from the remaining two factors.

6. Resilience to various attacks: The scheme should provide all major security goals and should be resistant to different types of the known attacks.

Bio-hash function

The biometrics provides a unique identification method to solve the security vulnerabilities of passwords, pins, and tokens that are easy to forget or can be stolen. The imprint biometric characteristics may be slightly different each time due to a variety of reasons such as the user’s dry or cracked skin, and the presence of dirt on the imprint sensor [42]. Therefore, high false rejection of genuine users that results in a denial of access often occur in the evaluation of biometric systems, and this consequently impacts on the usability of a system [43]. To resolve the problem of high false rejection instances, Jin et al. [44] proposed a two-factor authenticator in 2004 that is based on the iterated inner products between a tokenized pseudorandom number and the user-specific fingerprint features. To achieve this, a set of user-specific compact codes called the bio-hash code can be created. The bio-hash is a random mapping of biometric feature onto binary strings with user-specific tokenized pseudorandom numbers. In recent times, many authentication schemes using bio-hash have been proposed [45–47]. According to the recent bio-hash researches [48–51], the execution times of bio-hash are considered to be the same as the one-way hash function. In contrast, the execution time of the fuzzy extractor that is also generally used in biometric-system is considered to be the same as the elliptic-curve cryptography (ECC) [52]. Bio-hash is an effective technique for biometrics-based authentication schemes [53], and it is convenient mechanisms for small devices such as smart cards and mobile devices.

Review of Chaudhry et al.’s scheme

This section discusses Chaudhry et al.’s [32] user authentication scheme for roaming in ubiquitous networks. This scheme consists of the following three phases: (1) registration, (2) login and authentication, and (3) password change. All of the notations that are used in this paper are presented in Table 1.

Table 1. Notations.

Values	Description
MNi	Mobile node
FAj	Foreign agent
HAk	Home agent
IDmi, IDfj, IDhk	Identities of MNi, FAj, HAk
PWmi	Password of MNi
BIOmi	Biometrics of MNi
Tx	Timestamp of x
nx	Random number of x
rx	Random nonce for a specific purpose
SKx	Session key of x
Ek(⋅), Dk(⋅)	Symmetric encryption/decryption
h(⋅)	Hash function
H(⋅)	Bio-hash function
||	Concatenation
⊕	XOR operation
KF,H	Pre-shared secret key between FAj and HAk
KH	Private key of HAk

Registration phase

In the registration phase, MN_i registers with HA_k and the following operations are performed:

1. MN_i → HA_k: ID_mi, h(PW_mi||r_A||ID_mi)

   MN_i selects his/her identity ID_mi and password PW_mi, and generates r_A. MN_i then computes h(PW_mi||r_A||ID_mi) and sends a registration request message 〈ID_mi, h(PW_mi||r_A||ID_mi)〉 to HA_k via a secure channel.

2. HA_k → MN_i: PID_mi, A_mi

   HA_k verifies whether MN_i’s ID_mi is valid. If it is valid, HA_k computes the following equations:

   $$\begin{array}{c}\hfill EI{D}_{mi}=E_{h\left(K_H\right)}\left(I{D}_{mi}\right)\end{array}$$ (1)

   $$\begin{array}{c}\hfill A_{mi}=h(K_H\oplus I{D}_{mi})\oplus (P{W}_{mi}\left|\right|r_A\left|\right|I{D}_{mi})\end{array}$$ (2)

   HA_k then sends EID_mi and A_mi to MN_i via a secure channel.

3. MN_i retains the secret parameters EID_mi, A_mi and r_A in the mobile device.

Login and authentication phase

In this phase, MN_i and FA_j perform a mutual authentication to establish a session key with the support of MN_i’s HA_k. It is assumed that each pair of FA_j and HA_k share pre-shared key K_F,H. The details of the login and authentication procedure, which are depicted in Fig 2 are as follows:

1. MN_i → FA_j: M₁ = 〈PID_mi, MV₂, MV₃, T_mi, ID_hk〉

   MN_i enters his/her ID_mi and PW_mi, generates the random number n_mi, and computes the following equations:

   $$\begin{array}{c}\hfill M{V}_1=A_{mi}\oplus h(P{W}_{mi}\left|\right|r_A\left|\right|I{D}_{mi})\end{array}$$ (3)

   $$\begin{array}{c}\hfill M{V}_2=h(M{V}_1\left|\right|I{D}_{mi}\left|\right|n_{mi}\left|\right|T_{mi})\end{array}$$ (4)

   $$\begin{array}{c}\hfill M{V}_3=M{V}_1\oplus n_{mi}\end{array}$$ (5)

   MN_i sends the login request message M₁ = 〈EID_mi, MV₂, MV₃, T_mi, ID_hk〉 to FA_j via a public channel.

2. FA_j → HA_k: M₂ = 〈ID_fj, EM₁)〉

   FA_j checks the freshness of T_mi. If it is fresh, FA_j generates the random number n_fj and computes as follows:

   $$\begin{array}{c}\hfill E{M}_1=E_{K_{F,H}}(M_1,n_{fj})\end{array}$$ (6)

   FA_j then sends the message M₂ = 〈ID_fj, EM₁)〉 to HA_k.

3. HA_k → FA_j: M₃ = 〈EM₂)〉

   HA_k checks ID_fj and finds its corresponding K_F,H. To obtain M₁ and n_fj, HA_k decrypts EM₁ and computes the following equations:

   $$\begin{array}{c}\hfill \{M_1,n_{fj}\}=D_{K_{F,H}}\left(E{M}_1\right)\end{array}$$ (7)

   $$\begin{array}{c}\hfill I{D}_{mi}^{*}=D_{h\left(K_H\right)}\left(EI{D}_{mi}\right)\end{array}$$ (8)

   $$\begin{array}{c}\hfill M{V}_1^{*}=h(K_H\oplus I{D}_{mi}^{*})\end{array}$$ (9)

   $$\begin{array}{c}\hfill n_{mi}^{*}=M{V}_3\oplus M{V}_1^{*}\end{array}$$ (10)

   Then, HA_k checks the validity of the following equation:

   $$\begin{array}{c}\hfill M{V}_2\stackrel{?}{=}h(M{V}_1^{*}\left|\right|I{D}_{mi}^{*}\left|\right|n_{mi}^{*}\left|\right|T_{mi})\end{array}$$ (11)

   If Eq (11) does not hold, this phase is terminated; otherwise, HA_k computes as follows:

   $$\begin{array}{c}\hfill S{K}_{fj}=h(M{V}_1^{*}\left|\right|n_{mi}^{*}\left|\right|n_{fj}\left|\right|I{D}_{mi}^{*}\left|\right|I{D}_{fj}\left|\right|T_{mi})\end{array}$$ (12)

   $$\begin{array}{c}\hfill E{M}_2=E_{K_{F,H}}\left(S{K}_{fj}\right)\end{array}$$ (13)

   Lastly, HA_k sends the message M₃ = 〈EM₂〉 to FA_j.

4. FA_j → MN_i: M₄ = 〈ID_fj, FV₁, n_fj〉

   To obtain SK_fj, FA_j decrypts the received message EM₂ and computes as follows:

   $$\begin{array}{c}\hfill S{K}_{fj}=D_{K_{F,H}}\left(E{M}_2\right)\end{array}$$ (14)

   $$\begin{array}{c}\hfill F{V}_1=h(S{K}_{fj}\left|\right|n_{fj})\end{array}$$ (15)

   Then, FA_j sends the message M₄ = 〈ID_fj, FV₁, n_fj〉 to MN_i.
5. To check validity of the session key, MN_i computes the following equations:

   $$\begin{array}{c}\hfill S{K}_{mi}=h(M{V}_1\left|\right|n_{mi}\left|\right|n_{fj}\left|\right|I{D}_{mi}\left|\right|I{D}_{fj}\left|\right|T_{mi})\end{array}$$ (16)

   $$\begin{array}{c}\hfill h(S{K}_{mi}\left|\right|n_{fj})\stackrel{?}{=}F{V}_1\end{array}$$ (17)

   If Eq (17) does not hold, MN_i terminates connection; otherwise, MN_i accepts FA_j as legal and authenticated.

Fig 2. The login and authentication phase of Chaudhry et al.’scheme.

Password change phase

MN_i inputs ID_mi, a old password $P{W}_{mi}^{old}$ and a new password $P{W}_{mi}^{new}$ into his/her mobile device. The mobile device then computes the following equations:

$$\begin{array}{c}\hfill M{V}_1=A_{mi}\oplus h(P{W}_{mi}^{old}\left|\right|r_A\left|\right|I{D}_{mi})\end{array}$$ (18)

$$\begin{array}{c}\hfill A_{mi}^{new}=M{V}_1\oplus (P{W}_{mi}^{new}\left|\right|r_A\left|\right|I{D}_{mi})\end{array}$$ (19)

Lastly, the mobile device replaces A_mi with $A_{mi}^{new}$.

Cryptanalysis of Chaudhry et al.’s scheme

This section consists of the cryptanalysis of Chaudhry et al.’s scheme [32].

Stolen-mobile device attack

Under the previously explained adversarial model, it is assumed that $\mathcal{A}$ somehow acquires MN_i’s mobile device, extracts the secret parameters, and captures the login request message M₁. Using the extracted parameters and the captured messages, $\mathcal{A}$ can attempt to guess MN_i’s identity and password until the correct identity and password are found.

In [33, 34, 37, 38, 54], the identity and password can be guessed simultaneously after the user’s device is stolen by $\mathcal{A}$; therefore, it is prudent to consider off-line identity and password guessing attacks.

Based on [37], $|{\mathcal{D}}_{id}|\le |{\mathcal{D}}_{pw}|\approx 2^{20}\approx {10}^6$. The time complexity to determine a identity and password is linear to $|{\mathcal{D}}_{id}|$ and $|{\mathcal{D}}_{pw}|$ because the more candidate data the attacker has, the more that matching operations are required to determine the desired value.

To demonstrate the vulnerability of Chaudhry et al.’s scheme [32] to the stolen-mobile device attack, the following scenario is used:

1. $\mathcal{A}$ eavesdrops the previous login messages M₁ = 〈EID_mi, MV₂, MV₃, T_mi〉, and compromises the secret parameters 〈A_mi, EID_mi, r_A〉 from the mobile device.

2. $\mathcal{A}$ selects any of the identity and password candidates $I{D}_{mi}^{*}$ and $P{W}_{mi}^{*}$.

3. $\mathcal{A}$ computes $M{V}_2^{*}=h(A_{mi}\oplus h(P{W}_{mi}^{*}\left|\right|r_A\left|\right|I{D}_{mi}^{*}\left)\right||I{D}_{mi}^{*}\left|\right|M{V}_3\oplus A_{mi}\oplus h(P{W}_{mi}^{*}\left|\right|r_A\left|\right|I{D}_{mi}^{*}\left)\right||T_{mi})$.

4. $\mathcal{A}$ compares $M{V}_2^{*}\stackrel{?}{=}M{V}_2$.

5. If the comparison shows they are equal, $\mathcal{A}$ successfully guesses the correct ID_mi and PW_mi. Otherwise, $\mathcal{A}$ selects another identity and password, and repeats the steps 3 and 4 until he/she finds the correct identity and password.

In Chaudhry et al.’s scheme [32], the time complexity of the guessing attack process is $O\left(\right|{\mathcal{D}}_{id}|*|{\mathcal{D}}_{pw}|*(2T_h+3T_{XOR}))$, where T_h is the execution time of the hash operation and T_XOR is the execution time of the exclusive-or operation. Therefore, the time complexity of the guessing attack in Chaudhry et al.’s scheme is not negligible, and their scheme is consequently vulnerable to the stolen-mobile device attack.

User impersonation attack

This subsection presents a demonstration of the way that Chaudhry et al.’s scheme [32] allows $\mathcal{A}$ to impersonate a legal user if $\mathcal{A}$ obtains the MN_i’s identity and password through a guessing attack, as presented in the previous subsection, as follows:

1. $\mathcal{A}$ obtains the secret parameters 〈A_mi, EID_mi, r_A〉, correctly guessing the identity $I{D}_{mi}^{*}$ and password $P{W}_{mi}^{*}$ of MN_i by completing the stolen-mobile device attack.

2. The mobile device of $\mathcal{A}$ generates the random number n_ai, and computes the following equation:

   $$\begin{array}{cc}\hfill M{V}_1^{*}=A_{mi}\oplus h(P{W}_{mi}^{*}\left|\right|r_A\left|\right|I{D}_{mi}^{*})& \\ \hfill M{V}_2^{*}=h(M{V}_1^{*}\left|\right|I{D}_{mi}^{*}\left|\right|n_{ai}\left|\right|T_A)& \\ \hfill M{V}_3^{*}=M{V}_1^{*}\oplus n_{ai}\end{array}$$

   $\mathcal{A}$ sends the login request message $M_1^{*}=\langle EI{D}_{mi},M{V}_2^{*},M{V}_3^{*},T_A\rangle$ to FA_j, where T_A is the current timestamp of $\mathcal{A}$.
3. Because of the validation of $M_1^{*}$, FA_j and HA_k successfully proceed the subsequent steps of the authentication phase. Lastly, FA_j sends the message M₄ = 〈ID_fj, FV₁, n_fj〉 to MN_i, but $\mathcal{A}$ receives M₄ and computes the following equations:

   $$\begin{array}{c}\hfill S{K}_A=h(M{V}_1^{*}\left|\right|n_A\left|\right|n_{fj}\left|\right|I{D}_{mi}^{*}\left|\right|I{D}_{fj}^{*}\left|\right|T_A)\end{array}$$ (20)

   $$\begin{array}{c}\hfill h(S{K}_A\left|\right|n_{fj})\stackrel{?}{=}F{V}_1\end{array}$$ (21)

   If Eq (21) holds, $\mathcal{A}$ has successfully established a session key with FA_j.

Therefore, Chaudhry et al.’s scheme [32] is vulnerable to the user impersonation attack.

Absence of the incorrect login-input detection

The detection of the incorrect login inputs must be performed at the beginning of the login phase. However, Chaudhry et al.’s scheme [32] does not support the incorrect input detection during the login and authentication phase. In their scheme, the MN_i sends the message M₁ without verifying the correctness of the ID_mi and PW_mi. Even if MN_i mistakenly enters the wrong $I{D}_{mi}^{\prime }$ and $P{W}_{mi}^{\prime }$, the mobile device can still compute $M{V}_1^{\prime }=A_{mi}\oplus h(P{W}_{mi}^{\prime }\left|\right|r_A\left|\right|I{D}_{mi}^{\prime })$, $M{V}_2^{\prime }=h(M{V}_1^{\prime }\left|\right|I{D}_{mi}^{\prime }\left|\right|n_{mi}\left|\right|T_{mi})$ and $M{V}_3^{\prime }=M{V}_1^{\prime }\oplus n_{mi}$. As a result, an invalid form of the login request message, M₁, is transmitted to HA_k through FA_j, thereby resulting in unnecessary computations and communication costs.

Incorrectness of the password change phase

Chaudhry et al.’s scheme [32] allows the user to change his/her password easily without any server assistance. However, in the password change phase, the mobile device does not check the accuracy of the old password when MN_i enters the old and new passwords to replace the old password with a new password. If MN_i enters the old password incorrectly, an incorrect MV₁ is computed with Eq (18), and an incorrect $A_{mi}^{new}$ is also computed with Eq (19). As a result, h(K_H ⊕ ID_mi) will be damaged beyond the possibility of a restoration, thereby causing HA_k’s rejection of MN_i in the future authentication phase.

No provision for revocation

The revocation of a stolen or lost mobile device is essential for the practical deployment of smart card-based authentication schemes [55]. If a legal MN_i’s mobile device is lost or stolen, some kind of mechanism must be in place to prevent the misuse of the mobile device. To address this problem, the server needs to maintain the identity information that will serve as the basis for the detection of the invalid mobile device [56]. However, Chaudhry et al.’s scheme [32] scheme does not take this feature into consideration.

Proposed scheme

This section contains the proposal for the improved and anonymous biometrics-based authentication scheme for roaming in ubiquitous networks. The proposed scheme consists of the following three phases: (1) registration, (2) login and authentication, (3) password change, and (4) mobile-device revocation.

Registration phase

The registration phase for the mobile user MN_i that are illustrated in Fig 3 involves the following operations:

1. MN_i → HA_k: ID_mi, PWB_mi

   MN_i selects his/her ID_mi and PW_mi and inputs BIO_mi. MN_i then computes the following equation:

   $$\begin{array}{c}\hfill PW{B}_{mi}=h(P{W}_{mi}\left|\right|H\left(BI{O}_{mi}\right))\end{array}$$ (22)

   MN_i subsequently sends a registration request message 〈ID_mi, PWB_mi〉 to HA_k via a secure channel.

2. HA_k → MN_i: PID_mi, A_mi, B_mi, r_A

   HA_k then verifies the identity of MN_i and computes the following equation:

   $$\begin{array}{c}\hfill RI{D}_{mi}=E_{h\left(K_H\right)}\left(I{D}_{mi}\right)\end{array}$$ (23)

   HA_k searches RID_mi in the database to verify the presence of an already registered user with the same ID_mi; if this is verified, HA_k requests a new identity from MN_i. Otherwise HA_k gernerates r_A and r_D, and computes the following equations:

   $$\begin{array}{c}\hfill PI{D}_{mi}=E_{h\left(K_H\right)}(I{D}_{mi}\left|\right|r_D)\end{array}$$ (24)

   $$\begin{array}{c}\hfill A_{mi}=h(I{D}_{mi}\left|\right|PW{B}_{mi})\end{array}$$ (25)

   $$\begin{array}{c}\hfill B_{mi}=h(I{D}_{mi}\left|\right|r_A\left|\right|PW{B}_{mi})\oplus h(K_H\left|\right|I{D}_{mi})\end{array}$$ (26)

   If MN_i is a new user, HA_k sets I_mi to zero, otherwise, I_mi = I_mi + 1. HA_k then stores I_mi, PID_mi, and RID_mi as a tuple in the database, and it sends 〈PID_mi, A_mi, B_mi, r_A〉 to MN_i via a secure channel.

3. MN_i stores all of the received parameters into the mobile device.

Fig 3. The registration phase of the proposed scheme.

Login and authentication phase

In this phase, MN_i and FA_j perform a mutual authentication to establish a session key with the support of MN_i’s HA_k. It is assumed here that each pair of FA_j and HA_k share the pre-shared key K_F,H. The details of the login and authentication procedure that are illustrated in Fig 4 are as follows:

1. MN_i → FA_j: M₁ = 〈PID_mi, MV₂, MV₃, ID_hk〉

   MN_i enters his/her ID_mi, PW_mi, and BIO_mi, and it then computes as follows:

   $$\begin{array}{c}\hfill PW{B}_{mi}=h(P{W}_{mi}\left|\right|H\left(BI{O}_{mi}\right))\end{array}$$ (27)

   HA_k then checks the validity of:

   $$\begin{array}{c}\hfill A_{mi}\stackrel{?}{=}h(I{D}_{mi}\left|\right|PW{B}_{mi})\end{array}$$ (28)

   If Eq (28) does not hold, MN_i terminates the user’s login request. Otherwise, MN_i generates n_mi and computes the following equations:

   $$\begin{array}{c}\hfill M{V}_1=B_{mi}\oplus h(I{D}_{mi}\left|\right|r_A\left|\right|PW{B}_{mi})\end{array}$$ (29)

   $$\begin{array}{c}\hfill M{V}_2=h(M{V}_2\left|\right|I{D}_{mi}\left|\right|n_{mi})\end{array}$$ (30)

   $$\begin{array}{c}\hfill M{V}_3=M{V}_1\oplus n_{mi}\end{array}$$ (31)

   MN_i then sends the login request message M₁ = 〈PID_mi, MV₂, MV₃, ID_hk〉 to FA_j.

2. FA_j → HA_k: M₂ = 〈ID_fj, FV₂, FV₃, M₁〉

   FA_j generates the random number n_fj and computes the following equations:

   $$\begin{array}{c}\hfill F{V}_1=h(K_{F,H}\left|\right|M{V}_2\left|\right|M{V}_3)\end{array}$$ (32)

   $$\begin{array}{c}\hfill F{V}_2=F{V}_1\oplus n_{fj}\end{array}$$ (33)

   $$\begin{array}{c}\hfill F{V}_3=h(F{V}_1\left|\right|F{V}_2\left|\right|n_{fj})\end{array}$$ (34)

   FA_j sends the message M₂ = 〈ID_fj, FV₂, FV₃, M₁〉 to HA_k.

3. $H{A}_k⟶F{A}_j:M_3=\langle PI{D}_{mi}^{new},H{V}_1,H{V}_2)\rangle$

   HA_k checks ID_fj to find its corresponding K_F,H and computes the following equations:

   $$\begin{array}{c}\hfill F{V}_1^{*}=h(K_{F,H}\left|\right|M{V}_2\left|\right|M{V}_3)\end{array}$$ (35)

   $$\begin{array}{c}\hfill n_{fj}^{*}=F{V}_1^{*}\oplus F{V}_2\end{array}$$ (36)

   $$\begin{array}{c}\hfill F{V}_3\stackrel{?}{=}h(F{V}_1^{*}\left|\right|F{V}_2\left|\right|n_{fj}^{*})\end{array}$$ (37)

   If Eq (37) does not hold, this phase is terminated; otherwise, HA_k accepts FA_j as legitimate. HA_k then computes the following equations:

   $$\begin{array}{c}\hfill \{I{D}_{mi}^{*},r_D\}=D_{h\left(K_H\right)}\left(PI{D}_{mi}\right)\end{array}$$ (38)

   $$\begin{array}{c}\hfill M{V}_1^{*}=h(K_H\left|\right|I{D}_{mi}^{*})\end{array}$$ (39)

   $$\begin{array}{c}\hfill n_{mi}^{*}=M{V}_1^{*}\oplus M{V}_3\end{array}$$ (40)

   $$\begin{array}{c}\hfill M{V}_2\stackrel{?}{=}h(M{V}_1^{*}\left|\right|I{D}_{mi}\left|\right|n_{mi})\end{array}$$ (41)

   If Eq (41) does not hold, this phase is terminated; otherwise, HA_k accepts MN_i as legitimate. HA_k then generates $r_D^{new}$ and computes the following equations:

   $$\begin{array}{c}\hfill PI{D}_{mi}^{new}=E_{h\left(K_H\right)}(I{D}_{mi}^{*}\left|\right|r_D^{new})\end{array}$$ (42)

   $$\begin{array}{c}\hfill S{K}_{fj}=h(M{V}_1^{*}\left|\right|I{D}_{mi}^{*}\left|\right|I{D}_{fj}\left|\right|n_{mi}^{*})\end{array}$$ (43)

   $$\begin{array}{c}\hfill H{V}_1=S{K}_{fj}\oplus h(K_{F,H}\left|\right|n_{fj}^{*})\end{array}$$ (44)

   $$\begin{array}{c}\hfill H{V}_2=h(K_{F,H}\left|\right|S{K}_{fj}\left|\right|I{D}_{hk})\end{array}$$ (45)

   HA_k then replaces PID_mi with $PI{D}_{mi}^{new}$, and it then sends the message $M_3=\langle PI{D}_{mi}^{new},H{V}_1,H{V}_2\rangle$ to FA_j.

4. $F{A}_j⟶M{N}_i:M_4=\langle PI{D}_{mi}^{new},I{D}_{fj},F{V}_4\rangle$

   FA_j computes the following equations:

   $$\begin{array}{c}\hfill S{K}_{fj}=H{V}_1\oplus h(K_{F,H}\left|\right|n_{fj})\end{array}$$ (46)

   $$\begin{array}{c}\hfill H{V}_2\stackrel{?}{=}h(K_{F,H}\left|\right|S{K}_{fj}\left|\right|I{D}_{hk})\end{array}$$ (47)

   If Eq (47) does not hold, FA_j terminates the connection; otherwise, FA_j computes the following equation:

   $$\begin{array}{c}\hfill F{V}_4=h(S{K}_{fj}\left|\right|I{D}_{fj})\end{array}$$ (48)

   FA_j then sends the message $M_4=\langle PI{D}_{mi}^{new},I{D}_{fj},F{V}_4\rangle$ to MN_i.
5. MN_i computes the following equations to check the validity of the session key:

   $$\begin{array}{c}\hfill S{K}_{mi}=h(M{V}_1\left|\right|I{D}_{mi}\left|\right|I{D}_{fj}\left|\right|n_{mi})\end{array}$$ (49)

   $$\begin{array}{c}\hfill F{V}_4^{*}=h(S{K}_{mi}\left|\right|I{D}_{fj})\end{array}$$ (50)

   $$\begin{array}{c}\hfill F{V}_4^{*}\stackrel{?}{=}F{V}_4\end{array}$$ (51)

   If Eq (51) does not hold, MN_i terminates the connection; otherwise, MN_i accepts FA_j as legal and authenticated. That is, MN_i, FA_j and HA_j have all successfully established the same session key, SK. Lastly, MN_i replaces PID_mi with $PI{D}_{mi}^{new}$.

Fig 4. The login and authentication phase of the proposed scheme.

Password change phase

In this phase, MN_i changes its password on the mobile device without the help of the HA. The details of the password change phase that are illustrated in Fig 5 are as follows:

1. MN_i inputs ID_mi, BIO_mi, a old password $P{W}_{mi}^{old}$ and a new password $P{W}_{mi}^{new}$ into his/her mobile device. MN_i then computes the following equations:

   $$\begin{array}{c}\hfill PW{B}_{mi}^{old}=h(P{W}_{mi}^{old}\left|\right|H\left(BI{O}_{mi}\right))\end{array}$$ (52)

   $$\begin{array}{c}\hfill A_{mi}\stackrel{?}{=}h(I{D}_{mi}\left|\right|PW{B}_{mi}^{old})\end{array}$$ (53)

   If Eq (57) does not hold, MN_i terminates this phase; otherwise, MN_i computes the following equations:

   $$\begin{array}{c}\hfill M{V}_1=A_{mi}\oplus h(PW{B}_{mi}^{old}\left|\right|r_A\left|\right|I{D}_{mi})\end{array}$$ (54)

   $$\begin{array}{c}\hfill PW{B}_{mi}^{new}=h(P{W}_{mi}^{new}\left|\right|H\left(BI{O}_{mi}\right))\end{array}$$ (55)

   $$\begin{array}{c}\hfill B_{mi}^{new}=M{V}_1\oplus h(PW{B}_{mi}^{new}\left|\right|r_A\left|\right|I{D}_{mi})\end{array}$$ (56)

   $$\begin{array}{c}\hfill A_{mi}^{new}=h(I{D}_{mi}\left|\right|PW{B}_{mi}^{new})\end{array}$$ (57)

   Finally, MN_i replaces $A_{mi}^{old}$ and $B_{mi}^{old}$ with $A_{mi}^{new}$ and $B_{mi}^{new}$, respectively.

Fig 5. The password change phase of the proposed scheme.

Mobile device revocation phase

To recover a stolen/lost mobile device or a long-term key of MN_i, the mobile device revocation mechanism that is illustrated in Fig 6 is activated as follows:

1. $M{N}_i⟶H{A}_k:I{D}_{mi}^{old},I{D}_{mi}^{new},PW{B}_{mi}^{new}$

   If MN_i wants to revoke and reissue a secret parameter, MN_i selects an old identity $I{D}_{mi}^{old}$ and a new identity $I{D}_{mi}^{new}$, inputs a new password $P{W}_{mi}^{new}$ and BIO_mi into his/her mobile device. MN_i then computes the following equation:

   $$\begin{array}{c}\hfill PW{B}_{mi}^{new}=h(P{W}_{mi}^{new}\left|\right|H\left(BI{O}_{mi}\right))\end{array}$$ (58)

   MN_i subsequently sends a revocation request message $\langle I{D}_{mi}^{old},I{D}_{mi}^{new},PW{B}_{mi}^{new}\rangle$ to HA_k via a secure channel.

2. HA_k → MN_i: A_mi, B_mi

   HA_k then verifies the identity of MN_i and computes the following equation:

   $$\begin{array}{c}\hfill RI{D}_{mi}^{old}=E_{h\left(K_H\right)}\left(I{D}_{mi}^{old}\right)\end{array}$$ (59)

   HA_k searches $RI{D}_{mi}^{old}$ in the database to verify the presence of a registered user. If this is the case, HA_k generates the new random nonces $r_A^{new}$ and $r_D^{new}$, and computes the following equations:

   $$\begin{array}{c}\hfill PI{D}_{mi}^{new}=E_{h\left(K_H\right)}(I{D}_{mi}^{new}\left|\right|r_D^{new})\end{array}$$ (60)

   $$\begin{array}{c}\hfill A_{mi}^{new}=h(I{D}_{mi}^{new}\left|\right|PW{B}_{mi}^{new})\end{array}$$ (61)

   $$\begin{array}{c}\hfill B_{mi}^{new}=h(I{D}_{mi}^{new}\left|\right|r_A^{new}\left|\right|PW{B}_{mi}^{new})\oplus h(K_H\left|\right|I{D}_{mi}^{new})\end{array}$$ (62)

   HA_k updates I_mi, PID_mi, and RID_mi with $I_{mi}=I_{mi}+1,PI{D}_{mi}^{new}$, and $RI{D}_{mi}^{new}$, respectively. It then sends $\langle PI{D}_{mi}^{new},A_{mi}^{new},B_{mi}^{new},r_A^{new}\rangle$ to MN_i via a secure channel.

3. Finally, MN_i stores all of the received parameters into the mobile device.

Fig 6. The revocation phase of the proposed scheme.

Security analysis

In this section, a security analysis of the proposed scheme is performed using formal and informal verification methods. The formal analysis is conducted using automatic analysis tool named ProVerif and a random oracle model.

Formal verification using ProVerif

ProVerif is an automatic tool for analyzing cryptographic protocols according to the formal model (the so-called Dolev–Yao model). It supports a wide range of cryptographic primitives that are defined by rewrite rules or equations, as follows: asymmetric and symmetric en/decryption, digital signatures, and hash functions. This tool can prove the various security properties as follows: secrecy, authentication, and process equivalences of the protocol with unlimited sessions and message space [57].

The verification structure of ProVerif is illustrated in Fig 7. First, ProVerif takes as its input a protocol description to perform a verification in a dialect of the applied pi calculus, which is an extension of the pi-calculus and is a language for describing and analyzing protocols.

Fig 7. Structure of ProVerif.

It also takes an input the security properties that are being proven here. It then automatically translates this protocol description into Horn clauses and the security properties into derivability queries on these clauses, and it determines whether a fact can be proved from these clauses using an algorithm that is based on a resolution with a free selection. If the fact is not derivable, the corresponding security properties are proved. If the fact is derivable, the protocol may be vulnerable to an attack against the corresponding security properties. Actually, the derivation either corresponds to a real attack or a false attack, since the problem of the protocol verifications for an unbounded number of sessions is not decidable.

Recently, many researchers [58–61] have used ProVerif to verify the security of the schemes for the key agreement and authentication. In this section, the security of the proposed scheme is proven using ProVerif, where the ProVerif code is introduced as a description of the proposed scheme, and the analysis results are then provided.

The definitions for the process of the proposed scheme are shown in Fig 8, wherein the following identifiers are used: “cha” denotes the private channel between the MN_i and HA_k; “chb” and “chc” denote the public channels between the MN_i and FA_j and the FA_j and HA_k, respectively; “IDmi”, “PWmi”, and “BIOmi” denote the private MN identity, password, and biometrics, respectively; “IDfj” and “IDhk” denote the public identity of FA_j and HA_k, respectively. “KH” denotes the HA_k’s private key; “KFH” denotes the pre-shared key between the FA_j and HA_k; “SKfj” denotes a HA_k-generated session key that is transmitted to the FA_j; and “SKmi” denotes an MN_i-generated session key. The constructors for the operations of the concatenation, symmetric cryptography, exclusive-or, one-way hash, and bio-hash are defined from the lines 18 to 22. In addition, the destructors for the symmetric decryption and exclusive-or operations are defined in the lines 23 and 24. In the lines 26 to 31, six events that indicate the start and end of each node are defined to verify the correspondence relations for the messages of each node.

Fig 8. ProVerif code for definitions.

Fig 9 shows the code for the entire MN_i process. The MN_i process of the registration phase is modeled in the lines 34 to 36. The MN_i process of the login and authentication phase is modeled in the lines 37 to 50.

Fig 9. ProVerif code for entire MN process.

Fig 10 shows the code for the entire FA_j process. The FA_j process of the login and authentication phase is modeled in the lines 53 to 70.

Fig 10. ProVerif code for entire FA process.

Fig 11 shows the code for the entire HA_k process. The HA_k process of the registration phase is modeled in the lines 73 to 80. The HA_k process of the login and authentication phase is modeled in the lines 81 to 101.

Fig 11. ProVerif code for entire HA process.

The code for the modeling of the adversary capabilities and the verifying of the interprocess equivalences is shown in Fig 12. The lines 103 to 104 prove that the session keys SKfj and SKmi are secret and unknown to the adversary. The lines 105 to 107 verify the internodal relationships to determine the execution of the proposed scheme in the correct order.

Fig 12. ProVerif code for adversary capabilities and verifying equivalences verification.

When the code that defines the elements that are needed to configure the protocol is run, ProVerif prints the results in the following format:

1. RESULT inj–event[Event] ==> inj–event[Event] is true: The event is proved; for example, the authentication of A to B or the others hold.

2. RESULT inj–event[Event] ==> inj–event[Event] is false: The event is not proved; that is, the authentication of A to B or the others does not hold

3. RESULT [Query] is true: The query is proved, so there is no attack. In this case, ProVerif displays no attack derivation and no attack trace.

4. RESULT [Query] is false: The query is false, as ProVerif has discovered an attack against the desired security property. The attack traces with the attack derivations, which represent the real attack, are displayed.

The execution of the ProVerif code for the verification of the security and the authentication of the proposed scheme produces the simulation result, as shown in Fig 13, thereby verifying the accuracy of the results for all of the events and queries. That is, the successful mutual authentication of the proposed scheme has been achieved as the mutual communication with all of the authentication factors among MN_i, FA_j, and HA_k, as defined by the previously mentioned events. Furthermore, the session keys of the proposed scheme are secure against the adversary; therefore, the proposed scheme can be considered as secure against simulated attacks.

Fig 13. ProVerif simulation result of the proposed scheme.

Formal verification using the random oracle model

In this section, the formal security analysis of the proposed scheme is demonstrated using the random oracle model. For this, we define a hash function and symmetric cryptography as follows:

Definition 1. A hash function h: {0, 1}* → {0, 1}ⁿ is a one-way function that takes an input x ∈ {0, 1}* of an arbitrary length and outputs a bit string with a fixed-length h(x) ∈ {0, 1}ⁿ and it satisfies the following three security requirements:

• It is computationally infeasible to find an input x such that y = h(x).

• It is computationally infeasible to find another input x′ ≠ x such that the h(x′) = h(x).

• It is computationally infeasible to find the inputs (x, x′), with x′ ≠ x, such that h(x′) = h(x).

Definition 2. A symmetric cryptography ∏ = (E, K, KSPC, MSPC) is a pair of algorithms that is associated with the finite sets, KSPC(k) and MSPC(k), {0, 1}*, for k ∈ N.

• E, called the encryption algorithm, is a deterministic algorithm that takes a pair of the strings, a and x and produces y = E_a(x).

• D, called the decryption algorithm, is a deterministic algorithm that takes a pair of the strings, a and y and outputs the string x = D_a(y)

It is required here, for any k ∈ N, if a ∈ KSPC(k), x ∈ MSPC, any y = E_a(x), then D_a(y) = x.

Theorem 1. Under the assumption that the one-way hash function and the symmetric cryptography closely behave like an oracle, then the proposed scheme is provably secure against $\mathcal{A}$ for the protection of the identity ID_mi of MN_i, and the private key K_H of HA_k.

Reveal: Given the hash result y = h(x), this random oracle will unconditionally output the input x.

Extract: Given the cipher text C = E_Kx(P), this random oracle will unconditionally output the plain text P.

Proof. A method for the formal security proof that is similar to that used in [62–64] is applied in the proposed scheme. For the proof, it is assumed that $\mathcal{A}$ is able to derive ID_mi and K_H. For this, $\mathcal{A}$ runs the experimental algorithm that is shown in Algorithm 1, $EXP{1}_{HASH,SYMM}^{IAUAS,A}$ for the proposed improved and anonymous user authentication scheme, called IAUAS. The success probability of $EXP{1}_{HASH,SYMM}^{IAUAS,A}$ is defined by the following equation:

$$\begin{array}{c}\hfill Success{1}_{HASH,SYMM}^{IAUAS,A}=|Pr[EXP{1}_{HASH,SYMM}^{IAUAS,A}=1]-1|\end{array}$$ (63)

The advantage function for this experiment becomes as following equation:

$$\begin{array}{c}\hfill Adv{1}_{HASH,SYMM}^{IAUAS,A}(t,q_R,q_E)=ma{x}_A\left\{Success{1}_{HASH,SYMM}^{IAUAS,A}\right\}\end{array}$$ (64)

in which the maximum is determined by all of $\mathcal{A}$ with the execution time t and the number of queries q_R and q_E that are made to the Reveal and Extract oracles, respectively. If $\mathcal{A}$ is able to invert the hash function and the symmetric cryptography that are provided in Definitions 1 and 2, $\mathcal{A}$ can directly derive ID_mi and K_H. Consider the attack experiment that is shown in Algorithm 1. In this case, $\mathcal{A}$ will discover the complete connections between all of the participants. However, it is computationally infeasible to invert the input from the given hash and encrypted values, i.e., $Adv{1}_{HASH,SYMM}^{IAUAS,A}\left(t\right)\le ϵ$, ∀ϵ > 0. Then, $Adv{1}_{HASH,SYMM}^{IAUAS,A}(t,q_R,q_E)\le ϵ$ is obtained, because it depends on $Adv{1}_{HASH,SYMM}^{IAUAS,A}\left(t\right)$. Since $Adv{1}_{HASH,SYMM}^{IAUAS,A}\left(t\right)\le ϵ$ is negligible, $Adv{1}_{HASH,SYMM}^{IAUAS,A}(t,q_R,q_E)\le ϵ$ is also negligible. As a result, $\mathcal{A}$ cannot compute the ID_mi and K_H and the proposed scheme is provably secure against $\mathcal{A}$ for the deriving of them.

Algorithm 1: Algorithm $EXP{1}_{HASH,SYMM}^{IAUAS,A}$

1. Eavesdrop login request message 〈PID_mi, MV₂, MV₃, ID_hk〉 during the login and authentication phase.

2. Call the Reveal oracle. Let $(M{V}_1^{\prime },I{D}_{mi}^{\prime },n_{mi}^{\prime })\leftarrow Reveal\left(M{V}_2\right)$

3. Call the Extract oracle. Let $(I{D}_{mi}^{\prime \prime },r_D^{\prime })\leftarrow Reveal\left(PI{D}_{mi}\right)$

4. Computes $M{V}_3^{\prime }=M{V}_1^{\prime }\oplus h\left(n_{mi}^{\prime }\right)$

5. if $(M{V}_3^{\prime }=M{V}_3\&\&I{D}_{mi}^{\prime \prime }=I{D}_{mi}^{\prime })$ then

6.  Call the Reveal oracle. Let $(K_H^{\prime },I{D}_{mi}^{\prime \prime \prime },r_D^{\prime \prime })\leftarrow Reveal\left(M{V}_1^{\prime }\right)$

7.  if $(I{D}_{mi}^{\prime }=I{D}_{mi}^{\prime \prime \prime }\&\&r_D^{\prime }=r_D^{\prime \prime })$ then

8.   Compute $PI{D}_{mi}^{\prime }=E_{h\left(K_H^{\prime }\right)}(I{D}_{mi}^{\prime \prime \prime },r_D^{\prime \prime })$

9.    if $(PI{D}_{mi}=PI{D}_{mi}^{\prime })$ then

10.    Accept $K_H^{\prime }$ as the correct secret key K_H of HA_k

11.    Accept $I{D}_{mi}^{\prime }$ as the correct secret key ID_mi of MN_i

12.    return 1 (Success)

13.   else

14.    return 0

15.   end if

16.  else

17.   return 0

18.  end if

19. else

20.  return 0

21. end if

Theorem 2. Under the assumption that the one-way hash function and the symmetric cryptography closely behave like an oracle, then the proposed scheme is provably secure against $\mathcal{A}$ for the protection of ID_mi, PW_mi, and BIO_mi of MN_i, and the private key K_H of HA_k.

Proof. For this proof, it is assumed that $\mathcal{A}$ is able to derive ID_mi, PW_mi, BIO_mi and K_H after extracting the secret parameters A_mi, B_mi, and C_mi that are stored in the mobile device using side-channel attacks [33, 34, 65]. $\mathcal{A}$ runs the experimental algorithm $EXP{2}_{HASH,SYMM}^{IAUAS,A}$ that is shown in Algorithm 2. The success of the probability of $EXP{2}_{HASH,SYMM}^{IAUAS,A}$ is defined as the following equation:

$$\begin{array}{c}\hfill Success{2}_{HASH,SYMM}^{IAUAS,A}=|Pr[EXP{2}_{HASH,SYMM}^{IAUAS,A}=1]-1|\end{array}$$ (65)

The advantage function for this experiment becomes as following equation:

$$\begin{array}{c}\hfill Adv{2}_{HASH,SYMM}^{IAUAS,A}(t_2,q_R,q_E)=ma{x}_A\left\{Success{2}_{HASH,SYMM}^{IAUAS,A}\right\}\end{array}$$ (66)

in which the maximum is determined by all of $\mathcal{A}$ with the execution time t₂ and the number of queries q_R and q_E that are made to the Reveal and Extract oracles, respectively. If $\mathcal{A}$ is able to invert the hash function and the symmetric cryptography, $\mathcal{A}$ can directly derive ID_mi, PW_mi, BIO_mi, and K_H. Consider the attack experiment that is shown in Algorithm 2. It is computationally infeasible to invert the input from given hash and encrypted values, i.e., $Adv{2}_{HASH,SYMM}^{IAUAS,A}\left(t_2\right)\le ϵ$, ∀ϵ > 0). Then, $Adv{2}_{HASH,SYMM}^{IAUAS,A}(t_2,q_R,q_E)\le ϵ$ is obtained, because it depends on $Adv{2}_{HASH,SYMM}^{IAUAS,A}\left(t\right)$. Since $Adv{2}_{HASH,SYMM}^{IAUAS,A}\left(t\right)\le ϵ$ is negligible, $Adv{2}_{HASH,SYMM}^{IAUAS,A}(t_2,q_R,q_E)\le ϵ$ is also negligible. As a result, $\mathcal{A}$ cannot compute the ID_mi, PW_mi, BIO_mi, and K_H, and the proposed scheme is provably secure against $\mathcal{A}$ for deriving them even if the mobile device is stolen by $\mathcal{A}$.

Algorithm 2: Algorithm $EXP{2}_{HASH,SYMM}^{IAUAS,A}$

1. Extract the information {PID_mi, A_mi, B_mi, r_A, h(⋅), H(⋅)} that is stored in the mobile device through a physical monitoring of its power consumption.

2. Call the Reveal oracle. Let $(I{D}_{mi}^{\prime },PW{B}_{mi}^{\prime })\leftarrow Reveal\left(A_{mi}\right)$

3. Call the Reveal oracle. Let $(P{W}_{mi}^{\prime },BI{O}_{mi}^{\prime })\leftarrow Reveal\left(PW{B}_{mi}^{\prime }\right)$

4. Computes $A_{mi}^{\prime }=h(I{D}_{mi}^{\prime }\left|\right|PW{B}_{mi}^{\prime \prime })=h(I{D}_{mi}^{\prime }\left|\right|h(P{W}_{mi}^{\prime }\left|\right|H\left(BI{O}_{mi}^{\prime }\right)\left)\right)$

5. if $(A_{mi}^{\prime }=A_{mi})$ then

6.  Accepts $P{W}_{mi}^{\prime }$ and $BI{O}_{mi}^{\prime }$ as the correct PW_mi and BIO_mi of MN_i

7.  Call the Extract oracle. Let $(I{D}_{mi}^{\prime \prime },r_D^{\prime })\leftarrow Reveal\left(PI{D}_{mi}\right)$

8.  if $(I{D}_{mi}^{\prime \prime }=I{D}_{mi}^{\prime })$ then

9.   Compute $F_1=h(I{D}_{mi}^{\prime }\left|\right|r_A\left|\right|PW{B}_{mi}^{\prime \prime })$

10.   Compute $F_2=F_1\oplus B_{mi}^{\prime }=h(K_H\left|\right|I{D}_{mi}\left|\right|r_D)$

11.   Call the Reveal oracle. Let $(K_H^{\prime }\left|\right|I{D}_{mi}^{\prime \prime \prime }\left|\right|r_D^{\prime \prime })\leftarrow Reveal\left(F_1\right)$

12.   if $(I{D}_{mi}^{\prime \prime \prime }=I{D}_{mi}^{\prime }\&\&r_D^{\prime }=r_D^{\prime \prime })$ then

13.    Accepts $I{D}_i^{\prime }$ as the correct ID_i of user MN_i

14.    Compute $PI{D}_{mi}=E_{h\left(k_H^{\prime }\right)}(I{D}_{mi}^{\prime },r_D^{\prime })$

15.    if $(PI{D}_{mi}^{\prime }=PI{D}_{mi})$ then

16.     Accept $K_H^{\prime }$ as the correct secret key K_H of HA_k

17.     return 1 (Success)

18.    else

19.     return 0

20.    end if

21.   else

22.    return 0

23.   end if

24.  else

25.   return 0

26.  end if

27. else

28.  return 0

29. end if

Informal verification

In this section, we perform an informal security analysis of the proposed scheme to prove that it is secure against the various security threats. According to the adversarial model that is described in the preliminary knowledge section, $\mathcal{A}$ can perform the following attacks to undermine the security of the proposed scheme.

1. $\mathcal{A}$ has full control over the public communication channel, eavesdropping on the messages M₁, M₂, M₃, and M₄, and then inserting new values or removing a value.

2. If $\mathcal{A}$ obtains a stolen or lost mobile device of a user in some way, he/she is able to extract the PID_mi, A_mi, B_mi, and r_A from the device using side-channel attacks [33, 34].

3. $\mathcal{A}$ has the ability to make an offline guessing attack within a polynomial time and can try to threaten the privacy of the user by enumerating the eavesdropped messages and the extracted parameters.

Table 2 shows the analysis summary of the comparison of the proposed scheme with the related schemes [26–29, 32].

Table 2. Comparative summary: Security requirements.

Property	Jiang et al. [27]	Wen et al. [28]	Farash et al. [29]	Gope and Hwang [30]	Wu et al. [31]	Chaudhry et al. [32]	Proposed scheme
SR1	O	O	$\mathsf{X}$	O	O	$\mathsf{X}$	O
SR2	O	O	O	O	O	O	O
SR3	O	$\mathsf{X}$	$\mathsf{X}$	$\mathsf{X}$	O	$\mathsf{X}$	O
SR4	O	$\mathsf{X}$	$\mathsf{X}$	O	O	O	O
SR5	O	O	O	O	O	O	O
SR6	O	O	$\mathsf{X}$	O	O	$\mathsf{X}$	O
SR7	$\mathsf{X}$	$\mathsf{X}$	$\mathsf{X}$	O	O	O	O
SR8	$\mathsf{X}$	O	$\mathsf{X}$	O	$\mathsf{X}$	$\mathsf{X}$	O
SR9	$\mathsf{X}$	$\mathsf{X}$	O	O	O	O	O
SR10	O	O	O	O	O	O	O
SR11	O	O	$\mathsf{X}$	O	O	$\mathsf{X}$	O
SR12	O	$\mathsf{X}$	$\mathsf{X}$	$\mathsf{X}$	O	O	O
SR13	O	O	O	O	O	O	O
SR14	$\mathsf{X}$	$\mathsf{X}$	$\mathsf{X}$	$\mathsf{X}$	O	$\mathsf{X}$	O
SR15	$\mathsf{X}$	$\mathsf{X}$	$\mathsf{X}$	$\mathsf{X}$	$\mathsf{X}$	$\mathsf{X}$	O

SR₁: user anonymity; SR₂: untraceability; SR₃: resistance to stolen-mobile device or smart card attack; SR₄: mutual authentication; SR₅: session key agreement; SR₆: resistance to impersonation attack; SR₇: resistance to replay attack; SR₈: local user verification process; SR₉: resistance to stolen-verifier attack; SR₁₀: resistance to privileged-insider attack; SR₁₁: user-friendly password change; SR₁₂: forward secrecy; SR₁₃: resistance to foreign bypass attack; SR₁₄: does not need time synchronization; SR₁₅: provision of the revocation phase;

User anonymity

In the proposed scheme, the pseudo-identity PID_mi = E_h(KH)(ID_mi||r_D) that varies each session by r_D is used. After MN_i is authenticated by HA_k in Eq (41), HA_k replaces the existing PID_mi with a new $PI{D}_{mi}^{new}$ using a new $r_D^{new}$. Then, $PI{D}_{mi}^{new}$ is transmitted to MN_i that has been encrypted with HA_k’s private key K_H in Eq (42). Therefore, even if $\mathcal{A}$ obtains PID_mi by eavesdropping the public messages or extracting the secret parameters stored in the mobile device, the proposed scheme guarantees the user anonymity because it is not possible for $\mathcal{A}$ to know the real identity ID_mi of MN_i.

User untraceability

In the login and authentication phase, MN_i sends PID_mi, MV₂ and MV₃ via a public channel. They contain n_mi and r_D, which are changed for each session. That is, $\mathcal{A}$ cannot trace MN_i’s actions in the proposed scheme because these parameters are computed each time with a different value. Therefore, the proposed scheme ensures the user untraceability.

Stolen-mobile device attack

With the proposed scheme, $\mathcal{A}$ needs to know K_H to guess ID_mi and PW_mi; however, K_H is not stored in the mobile device directly, nor it is transmitted via the public channel as plaintext. Also, even if $\mathcal{A}$ finds this value somehow, he/she still cannot guess PW_mi without H(BIO_mi) that is unique to only MN_i. Therefore, the proposed scheme withstands the stolen-mobile device attack.

Mutual authentication

In the proposed scheme, MN_i and FA_j authenticate each other with the assistance of HA_k. Only a legitimate MN_i can compute MV₁ that $\mathcal{A}$ cannot compute because of PWB_mi. Accordingly, HA_k authenticates only the legitimate MN_i using Eq (41). Also, only the legitimate HA_k is authenticated by MN_i through the verification of $F{V}_4^{*}\stackrel{?}{=}F{V}_2$, as shown in Eq (51). Only FA_j and HA_k that share K_F,H can verify each other using the same key to compute valid messages, and only they can compute and obtain a valid session key, SK. Therefore, the adversary or invalid participants cannot carry out the login and authentication phase. Furthermore, FA_j authenticates HA_k by performing Eq (47). After it receives M₄, MN_i can verify that $F{V}_4^{*}\stackrel{?}{=}F{V}_4$ using Eq (51) to authenticate FA_j and to establish the session key, SK. Therefore, the proposed scheme achieves the mutual authentication.

Session key agreement

After the login and authentication process, FA_j receives HV₁ and obtains the session key SK_fj from HA_k, and MN_i generates the session key SK_mi. As a result, only the legitimate MN_i and FA_j establish the same session key SK_mi = h(MV₁||ID_mi||ID_fj||n_mi) = SK_fj. Therefore, the proposed scheme provides a secure session key agreement.

User impersonation attack

With the proposed scheme, the user impersonation attack is prevented by the mutual authentication, local user-verification process, and prevention of the stolen-mobile-device attack. Furthermore, the proposed scheme provides a secure session key agreement. Therefore, the proposed scheme ensures the prevention of the user impersonation attack.

Replay attack

$\mathcal{A}$ might replay an old login request message M₁ to FA_j and receive the message M₄ from FA_j. However, $\mathcal{A}$ still cannot compute the correct session key SK as he/she is not capable of computing ID_mi and n_mi without K_H. Furthermore, $\mathcal{A}$ cannot derive the session key, SK, without K_F,H. Therefore, the proposed scheme is secure against the replay attack.

Local user verification process

With the proposed scheme, mobile devices verify the legality of the user. Only a user who enters the correct ID_mi, PW_mi, and BIO_mi can pass the user-verification process, as given by Eq (28). In addition, since BIO_mi of each individual user is unique, $\mathcal{A}$ cannot attempt an illegal access.

Stolen-verifier attack

In the login and authentication phase of the proposed scheme, HA_k does not store and receive any of the credentials of MN_i such as PW_mi and H(BIO_mi). Furthermore, HA_k retains RID_mi in the database; however, $\mathcal{A}$ cannot know the real identity of MN_i even if $\mathcal{A}$ steals the user registration information from HA_k’s database. Therefore, the proposed scheme withstands the stolen-verifier attack.

Privileged-insider attack

In the registration phase of the proposed scheme, MN_i sends ID_mi and PWB_mi to HA_k. Here, PWB_mi contains H(BIO_mi). The insider of HA_k cannot derive MN_i’s password PW_mi. Therefore, he/she cannot try to impersonate MN_i to access FA_j. Furthermore, MN_i can change his/her password, PWB_mi, without the assistance of HA_k in the password change phase. Since it is not possible for the insider to know the MN_i’s password, PW_mi, the proposed scheme resists the privileged-insider attack.

User-friendly password change

Generally, it is recommended that the performance of the password change process is without any server involvement, thereby providing a user-friendliness and an improvement of the computational efficiency. In the password change phase of the proposed scheme, the existing user password is self-verified in the user’s mobile device, and it is replaced by the new password only if it passes the verification process. Therefore, the proposed scheme supports an efficient password change phase.

Forward secrecy

In the proposed scheme, even though the generated session key between all of the participants can be compromised by $\mathcal{A}$, he/she cannot recover any earlier session keys because the session key SK_mi = h(MV₁||ID_mi||ID_fj||n_mi) = SK_fj is different each time. Consequently, a significant correlation was not found between the past, current, and future session keys. Therefore, the proposed scheme ensures the forward secrecy.

Foreign bypass attack

During the authentication phase of the proposed scheme, $\mathcal{A}$ may try to construct the messages M₁ and M₂ using the parameters that are stored in a stolen mobile device and transmitted over a public channel to impersonate a legitimate FA_j. However, $\mathcal{A}\text{r}$ cannot compute FV₁, because K_F,H is not public information. Thus, $\mathcal{A}$ cannot construct a sufficient message to cheat HA_k. Eventually, $\mathcal{A}$ is unable to impersonate a valid FA_j.

Does not need time synchronization

In many authentication schemes, timestamps are used to resist the replay attack. However, by using the timestamp in the authentication scheme, the clocks of MN_i and HA_k must be synchronized beforehand. In the synchronization process, there is the possibility that time synchronization error occurs; therefore, to prevent this problem, the proposed scheme only uses random-number-based authentication mechanism instead of timestamps.

Provision of the revocation phase

In the proposed scheme, if MN_i’s mobile device is stolen/lost or a secret parameter/authentication factor is revealed, HA_k can issues new secret parameters to MN_i for the purpose of recovery. HA_k retains RID_mi that is encrypted with the real identity of MN_i, in the database. When HA_k receives a revocation request with ID_m i from MN_i, HA_k computes $RI{D}_{mi}^{old}=E_{K_H}\left(I{D}_{mi}\right)$ and compares it with the existing RID_mi that is stored in the database to verify that MN_i is registered and legitimate. Therefore, the proposed scheme can cope with unexpected problems by supporting the revocation phase.

Performance analysis

In this section, we perform the comparisons of the computational and communication cost of the proposed scheme with the related schemes [27–32].

Comparisons of the computational costs

We consider four cryptographic operations: hash function T_h, the symmetric en/decryption T_s, the ECC-based asymmetric en/decryption T_e, and the modular exponent operation T_m were considered. The authors [66] measured the approximate execution time of each cryptographic operation on the following central processing unit (CPU): Intel(R) Core(TM)2T6570 2.1GHz, 4G memory, OS:Win7 32-bit, and Visual C++ 2008 software using the MIRACL C/C++ library. The authors considered the 1024-bit Rivest–Shamir–Adleman (RSA) algorithm, the 320-bit ECC algorithm, the 128-bit Advanced Encryption Standard (AES) algorithm, and the 160-bit Secure Hash Algorithm 1 (SHA-1) hash function, and the experiment the results are T_m ≈ 1.8269ms, T_e ≈ 1.6003ms, T_s ≈ 0.1303ms, and T_h ≈ 0.0004ms, respectively. The registration and password change phases were excluded from the comparison because the registration phase of the mobile node occurs only once and the password change phase can be executed only within MN. Therefore, only the login and authentication phase was considered in the comparison, because this phase frequently occurs during the intercommunication between participants when the mobile node accesses the ubiquitous networks and the roaming occurs.

Table 3 shows the comparative summary in terms of the computational costs of MN, FA, and HA, as well as the total cost of the different participants. The result of the proposed scheme is 0.2614ms, while the results of the schemes of Jiang et al., Wen et al., Farash et al., Gope and Hwang, Wu et al., and Chaudhry et al. are 3.6543ms, 7.3081ms, 0.5217ms, 3.6543ms, 6.9232ms, and 0.6519ms, respectively. The Table 3 highlights that the computational cost of the proposed scheme is lowest in comparison with the related schemes.

Table 3. Comparative summary: Computational cost.

	Jiang et al. [27]	Wen et al. [28]	Farash et al. [29]	Gope and Hwang [30]	Wu et al. [31]	Chaudhry et al. [32]	Proposed scheme
MN	3Th + 1Tm	4Th + 1Tm	6Th	4Th + 1Tm	8Th + 2Te	5Th	7Th
FA	4Th	4Th + 1Tm	1Th + 2Ts	4Th	4Th + 1Ts + 2Te	1Th + 2Ts	4Th
HA	5Th + 1Tm	5Th + 2Tm	5Th + 2Ts	4Th + 1Tm	8Th + 3Ts	4Th + 3Ts	9Th + 2Ts
Total	12Th + 2Tm	13Th + 4Tm	12Th + 4Ts	12Th + 2Tm	20Th + 4Ts + 4Te	10Th + 5Ts	20Th + 2Ts
Time(ms)	3.6543	7.3081	0.5217	3.6543	6.9232	0.6519	0.2614

Comparisons of the communication costs

For the communication costs, a comparison of the login and authentication phases that referred to [67, 68] was performed, and it is assumed that the lengths of the identity, random number, and timestamp are 128 bits, 64 bits, and 32 bits, respectively. The hash function and the symmetric-key encryption produce 160 bits and 256 bits, respectively. For the asymmetric-key encryption, the modular prime operation and the scalar multiplication operation on the elliptic curve produces 1024 bits and 320bits, respectively.

Table 4 provides the data of the comparisons of the communication costs of the login and authentication phases of the proposed scheme with the other existing schemes. The total communication cost of proposed scheme is 2976 bits, while the schemes of Jiang et al., Wen et al., Farash et al., Gope and Hwang, Wu et al., and Chaudhry et al. are 3200 bits, 3072 bits, 1696 bits, 3072 bits, 3936 bits, and 1824 bits, respectively. Although the total communication costs of the scheme of Farash et al. and Chaudhry et al. are less than that of the proposed scheme, their schemes are insecure, as previously mentioned. Therefore, the proposed scheme is a more practical option for the ubiquitous network environment.

Table 4. Comparative summary: Communication cost.

Mssage	Jiang et al. [27]	Wen et al. [28]	Farash et al. [29]	Gope and Hwang [30]	Wu et al. [31]	Chaudhry et al. [32]	Proposed scheme
M1	1152	1152	608	1152	864	736	704
M2	1504	1440	384	1440	1280	384	1152
M3	320	320	256	320	736	256	576
M4	224	160	448	160	1056	448	544
Total (bits)	3200	3072	1696	3072	3936	1824	2976

Conclusion

In this paper, Chaudhry et al.’s authentication scheme for roaming in ubiquitous networks is reviewed, and the scheme’s ongoing vulnerability to several attacks is proven; furthermore, the improved proposed scheme resolves the security issues of Chaudhry et al.’s scheme. To demonstrate the security of the proposed scheme, informal and formal analyses were performed using the random oracle model and the automated verification tool, ProVerif. Also, the performance evaluation that was conducted with related works shows that the proposed scheme is suitable for resource-constrained ubiquitous environments.

Data Availability

All relevant data are within the paper.

Funding Statement

This research was supported by Basic Science Research Program through the National Research Foundation of Korea (NRF) funded by the Ministry of Education (NRF-2010-0020210), http://www.nrf.re.kr/index.