An Authentication Framework for Roaming Service in Global Mobility Networks

(1)

129 Information Technology and Control 2019/1/48

An Authentication Framework for

Roaming Service in Global Mobility

Networks

ITC 1/48

Journal of Information Technology and Control

Vol. 48 / No. 1 / 2019 pp. 129-145

DOI 10.5755/j01.itc.48.1.17270

An Authentication Framework for Roaming Service in Global Mobility Networks

Received 2016/12/15 Accepted after revision 2018/10/09

http://dx.doi.org/10.5755/j01.itc.48.1.17270

Corresponding author: [email protected]

Jangirala Srinivas

Jindal Global Business School, O. P. Jindal Global University, Haryana 131 001, India

Dheerendra Mishra

Department of Mathematics, The LNM Institute of Information Technology, Jaipur, India; e-mail: [email protected]

Sourav Mukhopadhyay

Department of Mathematics, Indian Institute of Technology, Kharagpur 721 302, India

Saru Kumari

Department of Mathematics, Ch. Charan Singh University, Meerut, India

Vandana Guleria

Department of Mathematics, Birla Institute of Technology, Mesra, Ranchi, India

In global mobility networks (GLOMONET), to provide secure and privacy-preserving communication among authorized mobile users in roaming services is not an easy task. To achieve authorized communication, mutual authentication is performed among legal users in GLOMONET. Therefore, security as well as privacy should be addressed in designing the security protocols for GLOMONET. In recent years, most of the research work is focused on one-way authentication and does not have desirable security attributes. In this paper, we discuss the development of authentication protocol for GLOMONET. To address security and privacy issues in autho-rized communication, we proposed a provably secure authentication protocol for GLOMONET. To identify the resistance against known attacks, we have analyzed the scheme against all known attacks. The comparative study on the security and performance with the related results manifests that the proposed scheme addresses the security and privacy challenges and avails comparable performance.

(2)

Information Technology and Control 2019/1/48 130

1. Introduction

Global Mobility Networks (GLOMONET) provide the roaming services for the mobile users, which en-able them to use the extended services in their home agent whenever they enter into a foreign agent zone irrespective of their locations [2]. When a mobile user (MU) enters a foreign agent zone, there should be some mechanism of communication between a mo-bile user, home agent (HA), and foreign agent (FA). A conventional frame for roaming service is shown in Figure 1. To communicate with FA, firstly, a session is developed with the home agent by MU. Then, MU

communicates with FA with the help of HA. A regis-tered MU gets the services only when he/she is suc-cessfully authenticated by FA. Meanwhile, in prac-tice, two major concerns (privacy and security) are identified in roaming services. Thus, in attaining the roaming services, the mutual authentication mecha-nism is designed to address the issues of authorized communication. The secure communication is being achieved using key agreement [1, 21, 27]. As the com-munication technologies are developing rapidly, the entire world is reciprocally more connected. Due to this privacy risks are at stake. Privacy concerns have increasingly got attention from governments, cor-porations, and individuals. It is desirable to control sensitive information. However, in the environment of Internet where information sharing is very easy, this problem (controlling sensitive information) does not have an easy solution. Thus, a balanced approach is required between information sharing and privacy. For roaming services in GLOMONET, the first au-thentication scheme was introduced by Zhu and Ma

[36]. Since then, there were many proposals for a secure design with low computation cost [6, 10-11, 18-19, 29, 31]. It is observed that most of the existing similar schemes failed to provide the user anonymity along with untraceability.

In 2011, two new authentication schemes were pro-posed by Chen et al. [4-5]. However, Xie et al. [33] enlightened the security shortcomings of both the schemes. For roaming services, Mun et al. [22] gave an anonymous authentication scheme in 2012. However, Mun et al.’s scheme is shown failure by Kim and Kwak [15] due to the design flaws in their scheme.

Based on quadratic residue, Jiang et al. [13] gave an au-thentication scheme. But, Wen et al. [30] and He et al.

[12] both pointed out that service attack, replay attack and impersonation attack are not addressed in Jiang

et al.’s scheme. To overcome the security flaws, Wen

et al. [30] and He et al. [12] independently presented improved schemes. Using the modular exponentiation operations, Shin et al. [26] gave an efficient authenti-cation scheme. Unfortunately, Farash et al. [9] pointed out that both [30] and [26] failed to resist user trace-ability, impersonation attack and session key disclo-sure attack. Due to these failures, a lightweight authen-tication scheme has been presented by them.

Recently (2015), Zhang et al. [34] designed an authenti-cation scheme by adopting symmetric key and rational points multiplication in elliptic curve to preserve the privacy in GLOMONET. As a part of our case study, we figured out that their scheme fails to ensure the securi-ty goals. We came across some securisecuri-ty shortcomings

Figure 1

(3)

131 Information Technology and Control 2019/1/48

in Zhang et al.’s scheme, such as (a) password guessing attack; (b) user anonymity and traceability; (c) replay attack; and (d) user impersonation attack. In a thor-ough study, we observed that Zhang et al.’s scheme can be enhanced such that improved design can collective-ly address all the security attributes.

1.1. Security Goals

In providing secure roaming services, an efficient and anonymous authentication scheme should possess the following attributes:

Mobile user’s privacy: Roaming authentication has issues with two types of privacy: (i) MU’s real identity; and (ii) MU’s roaming line. Both types should be re-quired to provide privacy when running the roaming services.

Untraceability: No tracking of MU by looking at the connections, i.e., the third party must not be able to iden-tify MU by looking at his interactions with different FAs. User’s validation checking: The registration of MU

with HA should be correctly identified by the foreign agent.

Prohibit impersonation attack: Only the legitimate mobile user and the network agent (home or foreign) should be able to authenticate.

Ensure a private session key: The parties should agree upon a fresh session key. The session key can be established among the authorized participants. Prohibit replaying attack: Interception of the mes-sages by attacker should not reveal any sensitive in-formation of the participants even by replaying the previous messages.

1.2. Our Contributions

The contributions are as follows:

_ In a thorough study of the recently proposed Zhang et al.’s [34] scheme, we concluded that their scheme suffers from several attacks such as (a) password guessing attack; (b) user anonymity and traceability; (c) replay attack; and (d) user impersonation attack.

_ To overcome the shortcomings of Zhang et al.’s scheme, we present an improved scheme which inherits Zhang et al.’s scheme and successfully withstands the possible known attacks.

_ Moreover, the proposed scheme is proved secure assuming the hardness of ECDH assumption.

The scheme is presented with a valid proof which preserves all the security attributes.

_ Furthermore, the proposed scheme is

computa-tionally efficient in comparison to Zhang et al.’s scheme and performs better in comparison to oth-er existing similar schemes.

1.3. Cryptographic Preliminaries

1.3.1. Elliptic Curve

An elliptic curve E over a finite field FP consists of

points satisfying the equation y2₌_x3₊_ax₊_{b mod p}

along with the point at infinity, where a, b∈ Fpand

4a3_{+ 27}_b2_mod_p_≠_{0. We omit mod}_p_{and draw out the}

following assumptions [17]. Assumption1:

Ellipticcurvediscretelogarithmproblem(ECDLP): Suppose P, Q∈G with Q = αP, it is computationally hard to compute the integer α, where G is the group of rational points on the elliptic curve E(Fp).

Assumption2:

EllipticcurveDiffie–Hellmanproblem(ECDHP): If αP, βP ∈ G and α, β are positive integers, it is hard to compute αβP.

1.3.2. Biohashing

Biometric systems are applicable for human au-thentication in validating the security task to enable the authorized access, however, these systems face specific security challenges such as noisy data input which causes denial of service attack. It has impact on the usability of the system by failing to identify authorized consumers [23]. To overcome these prob-lems, BioHashing technique is introduced [28]. It has substantial functional advantages such as clean sep-aration of the genuine, zero error rate and imposter populations [14]. It has the following functions:

_ Extraction of biometric parameter represented in

a vector form _{Γ ∈}_n_{, where}_n_{is the feature length.}

_ Input token is used to generate m pseudo-random

vector { M | = 1,2, }

i

r∈ i m .

_ The Gram-Schmidt process is employed for

{ M | = 1,2, }

i

r∈ i m and orthonormal

pseudorandam vectors are obtained

{_{r i}_{⊥ ∈}_n| = 1,2,_i __m}_,_{n m}_≥ _.

_ Calculate { |〈Γ r i i⊥ 〉| = 1,2,m}, where 〈 〉.|.

(4)

_ Compute m –bit BioHash template, b =

= { | = = 1,2,i }

b b i i m using a threshold

κ

obtained

from

enable the authorized access, however, these systems face specific security challenges such as noisy data

input which causes denial of service attack. It has impact on the usability of the system by failing to

identify authorized consumers [23]. To overcome these problems, BioHashing technique is introduced

[28]. It has substantial functional advantages such as clean separation of the genuine, zero error rate and

imposter populations [14]. It has the following functions:

• Extraction of biometric parameter represented in a vector form

_{Γ ∈}

_

n

_{, where}

_n

_{is the}

feature length.

• Input token is used to generate

m

pseudo-random vector

{

M

| = 1,2,

}

i

r

∈



i

_

m

.

• The Gram-Schmidt process is employed for

{

M

| = 1,2,

}

i

r

∈



i

_

m

and orthonormal

pseudorandam vectors are obtained

{

_{r i}

_{⊥ ∈}

_

n

| = 1,2,

_i

_

_m

}

_,

_{n m}

_≥

_.

• Calculate

{ |

〈Γ

r i i

⊥ 〉

| = 1,2,

_

m

}

, where

〈 〉

.|.

indicates inner product.

• Compute

m

−

bit BioHash template,

b

= { | = = 1,2,

b i i

i



m

}

using a threshold

κ

obtained from

1, if |

,

=

0, if |

> .

i

r i

b

r i

κ

〈Γ

⊥ 〉 ≤





_〈Γ

_{⊥ 〉}



(1)

1.4 Road Map of the Paper

The details are as follows. In Section 2, we present the review of Zhang

et al.

’s scheme. Security

weaknesses of Zhang

et al.

’s scheme are shown in Section 3. The proposed authentication scheme is

provided in Section 4. Further, in Section 5, we present our provably secure scheme in formal model.

The informal security analysis and discussion of the proposed scheme is done in Section 6. In

Section 7, the performance of our scheme with the other existing similar schemes is compared. Finally,

the paper is concluded in Section 8.

2 Review of Zhang

et al.

’s Scheme

2.1 Registration Phase

MU

registers with the home agent

HA

if he/she wishes to get services from Global Mobility

Network [34]. In this phase, the communication with the participants is done through secure

communication channel.

R1.

MU

selects his/her identity

ID

_MU

and password

PW

_MU

. After computing

= (

MU

)

V h PW



m

,

MU

sends the message

{

ID V

MU

, }

to home agent

HA

where

m Z

∈

*p

is a random

number.

R2.

HA

receives the message {

ID V

MU

, }

and a random number

n

is generated to undergo

computations using

HA

’s master key

K

,

MID Enc ID

=

K

(

MU

, )

n

,

C V h ID

=

⊕

(

MU



K

)

. Further

HA

sends

{

MID C ID

, ,

HA

}

to

MU

.

R3.

MU

stores

{

ID

MU

,

ID C MID m

HA

, ,

, }

into

SC

.

2.2 Authentication and Key Establishment Phase

(1)

1.4. Road Map of the Paper

The details are as follows. In Section 2, we present the review of Zhang et al.’s scheme. Security weaknesses of Zhang et al.’s scheme are shown in Section 3. The proposed authentication scheme is provided in Sec-tion 4. Further, in SecSec-tion 5, we present our provably secure scheme in formal model.

The informal security analysis and discussion of the proposed scheme is done in Section 6. In Section 7, the performance of our scheme with the other exist-ing similar schemes is compared. Finally, the paper is concluded in Section 8.

2. Review of Zhang et al.’s Scheme

2.1. Registration Phase

MU registers with the home agent HA if he/she wishes to get services from Global Mobility Network [34]. In this phase, the communication with the participants is done through secure communication channel. R1.MU selects his/her identity ID ID_MU and pass-word PW_MU. After computing

enable the authorized access, however, these systems face specific security challenges such as noisy data input which causes denial of service attack. It has impact on the usability of the system by failing to identify authorized consumers [23]. To overcome these problems, BioHashing technique is introduced [28]. It has substantial functional advantages such as clean separation of the genuine, zero error rate and imposter populations [14]. It has the following functions:

• Extraction of biometric parameter represented in a vector form _{Γ ∈}_n_{, where}_n_{is the} feature length.

• Input token is used to generate m pseudo-random vector { M | = 1,2, }

i

r∈ i _m . • The Gram-Schmidt process is employed for { M| = 1,2, }

i

r∈ i m and orthonormal pseudorandam vectors are obtained {_{r i}_{⊥ ∈}_n| = 1,2,_i __m}_,_{n m}_≥ _.

• Calculate { |〈Γ r i i⊥ 〉| = 1,2,m}, where .|.〈 〉 indicates inner product.

• Compute m−bit BioHash template, b= { | = = 1,2,b i ii m} using a threshold κ obtained from

1, if | , =

0, if | > . i r i b r i κ κ 〈Γ ⊥ 〉 ≤   _〈Γ _{⊥ 〉}  (1)

1.4 Road Map of the Paper

The details are as follows. In Section 2, we present the review of Zhang et al.’s scheme. Security weaknesses of Zhang et al.’s scheme are shown in Section 3. The proposed authentication scheme is provided in Section 4. Further, in Section 5, we present our provably secure scheme in formal model.

The informal security analysis and discussion of the proposed scheme is done in Section 6. In Section 7, the performance of our scheme with the other existing similar schemes is compared. Finally, the paper is concluded in Section 8.

2 Review of Zhang

et al.’s Scheme

2.1 Registration Phase

MU registers with the home agent HA if he/she wishes to get services from Global Mobility Network [34]. In this phase, the communication with the participants is done through secure communication channel.

R1. MU selects his/her identity IDMU and password PWMU . After computing = ( MU )

V h PW m , MU sends the message {ID VMU, } to home agent HA where m Z∈ *p is a random number.

R2. HA receives the message {ID VMU, } and a random number n is generated to undergo computations using HA’s master key K, MID Enc ID= K( MU, )n , C V h ID= ⊕ ( MUK). Further HA sends {MID C ID, , HA} to MU.

R3. MU stores {IDMU,ID C MID mHA, , , } into SC.

2.2 Authentication and Key Establishment Phase

, MU

sends the message {ID VMU, } to home agent HA where *

p

m Z∈ is a random number.

R2.HA receives the message {ID VMU, } and a ran-dom number n is generated to undergo computa-tions using HA’s master key K, MID Enc ID= K( MU, )n , enable the authorized access, however, these systems face specific security challenges such as noisy data

input which causes denial of service attack. It has impact on the usability of the system by failing to identify authorized consumers [23]. To overcome these problems, BioHashing technique is introduced [28]. It has substantial functional advantages such as clean separation of the genuine, zero error rate and imposter populations [14]. It has the following functions:

• Extraction of biometric parameter represented in a vector form _{Γ ∈}_n_{, where}_n_{is the}

feature length.

• Input token is used to generate m pseudo-random vector { M| = 1,2, }

i

r∈ i m .

• The Gram-Schmidt process is employed for { M| = 1,2, } i

r∈ i _m and orthonormal pseudorandam vectors are obtained {_{r i}_{⊥ ∈}_n| = 1,2,_i __m}_,_{n m}_≥ _.

• Calculate { |〈Γ r i i⊥ 〉| = 1,2,_m}, where .|.〈 〉 indicates inner product.

• Compute m−bit BioHash template, b= { | = = 1,2,b i ii m} using a threshold κ obtained from

1, if | , =

0, if | > .

i r i b r i κ κ 〈Γ ⊥ 〉 ≤   _〈Γ _{⊥ 〉}  (1)

1.4 Road Map of the Paper

The details are as follows. In Section 2, we present the review of Zhang et al.’s scheme. Security weaknesses of Zhang et al.’s scheme are shown in Section 3. The proposed authentication scheme is provided in Section 4. Further, in Section 5, we present our provably secure scheme in formal model.

The informal security analysis and discussion of the proposed scheme is done in Section 6. In Section 7, the performance of our scheme with the other existing similar schemes is compared. Finally, the paper is concluded in Section 8.

2 Review of Zhang

et al.’s Scheme

2.1 Registration Phase

MU registers with the home agent HA if he/she wishes to get services from Global Mobility Network [34]. In this phase, the communication with the participants is done through secure communication channel.

R1. MU selects his/her identity IDMU and password PWMU . After computing

= ( MU )

V h PW m , MU sends the message {ID VMU, } to home agent HA where m Z∈ *p is a random

number.

R2. HA receives the message {ID VMU, } and a random number n is generated to undergo computations using HA’s master key K, MID Enc ID= K( MU, )n , C V h ID= ⊕ ( MUK) HA

sends {MID C ID, , HA} to MU.

R3. MU stores {IDMU,ID C MID mHA, , , } into SC.

2.2 Authentication and Key Establishment Phase

. Further HA sends {MID C ID, , HA} to MU.

R3.MU stores {IDMU,ID C MID mHA, , , } into SC.

2.2. Authentication and Key Establishment Phase

The registered MU opts services from FA. Before this, both the parties agree upon a common session key. Moreover, the communication between FA and HA

is done through the secure channel. The details are shown as follows:

A1.MU inputs his/her login credentials into the smart-card to compute

The registered MU opts services from FA. Before this, both the parties agree upon a common session key. Moreover, the communication between FA and HA is done through the secure channel. The details are shown as follows:

A1. MU inputs his/her login credentials into the smartcard to compute V h PW= ( MUm) and

= .

V′ C V⊕ Further, MU chooses a random number *

p

a Z∈ and computes aP and

= ( , )

MU V MU

Auth Enc ID′ aP . MU sends the message m1= {ID MID AuthHA, , MU} to the foreign agent FA.

A2. FA receives the message m₁, and selects a random number *

p

b Z∈ , computes bP and

= ( , , )

FA K_FH FA FA

D Enc ID bP T , where TFA is FA’s chosen timestamp, and KFH is a pre-shared secret

known to FA and HA. The message m₂= {ID MID Auth T DFA, , MU, ,FA FA} is sent to HA.

A3. HA receives the message m₂, decrypts MID and DFA to obtain IDMU, TFA. HA verifies

the correctness of IDMU and TFA. If the verification doesn’t hold, HA rejects the process. Else, HA

calculates V′= (h IDMUK) using HA’s master key and decrypts AuthMU to fetch aP. A random

number n′ is generated by HA to compute MID Enc ID′= K( MU, ),n′

= ( , , , )

HA K_FH HA MU

D Enc ID ID aP bP and AuthHA=Enc MID aP bPV′( ′, , ), where THA is a timestamp of

HA. Finally, the message m3= {DHA, AuthHA} is sent to FA.

A4. FA receives the message m3 and decrypts DHA and looks for the correctness of bP and

.

HA

T If the correctness holds, FA computes AuthFA= (h abP ID MUIDFA),

= ( )

MF MU FA

SK h aP bP abP ID   ID . The message m4= {Auth AuthFA, HA} is sent to MU.

A5. To obtain aP, bP and MID′, MU decrypts AuthHA. MU verifies whether the decrypted

aP is same as that of the value in step A1. If the verification holds with the chosen secret value a, then

MU needs to verify the correctness of AuthFA to compute the session key

= ( )

MF MU FA

SK h aP bP abP ID   ID . The smartcard updates MID with MID′ in its memory.

2.3 Update Session Key

Interested readers can refer to [34].

3 Security Pitfalls of Zhang

et al.

’s Scheme

3.1 Adversary Model

The security of Zhang et al.’s scheme is analyzed under the following security model [7-8, 16, 20]:

1. Over the public channel, Adversary/Attacker () has the ability to eavesdrop all the communications between the parties.

2.  attains the potential to delete, modify, resend or to redirect the eavesdropped transmitted messages.

3. By analyzing the method of power analysis and consumption or from the leaked

and V′=C V⊕ . Further, MU chooses a random number *

p

a Z∈ and computes aP and AuthMU =Enc IDV′( MU, )aP . MU sends the message m₁= {ID MID AuthHA, , MU} to the foreign agent FA.

A2. FA receives the message m1, and selects

a random number * p

= ( , , )

FA K_FH FA FA

D Enc ID bP T , where T_FA is FA’s

chosen timestamp, and K_FH is a pre-shared secret known to FA and HA. The message

2 = { FA, , MU, FA, FA}

m ID MID Auth T D is sent to HA.

A3. HA receives the message

m

₂, decrypts MID

and D_FA to obtain ID_MU, T_FA. HA verifies the cor-rectness of ID_MU and T_FA. If the verification doesn’t hold, HA rejects the process. Else, HA calculates

= .

p

= ( , )

MU V MU

A2. FA receives the message m1, and selects a random number b Z∈ *p, computes bP and

= ( , , )

FA K_FH FA FA

known to FA and HA. The message m2= {ID MID Auth T DFA, , MU, ,FA FA} is sent to HA.

= ( , , , )

HA K_FH HA MU

HA. Finally, the message m₃= {DHA, AuthHA} is sent to FA.

A4. FA receives the message m₃ and decrypts DHA and looks for the correctness of bP and

.

HA

T If the correctness holds, FA computes Auth_FA= (h abP ID _MUID_FA),

= ( )

MF MU FA

= ( )

MF MU FA

2.3 Update Session Key

3 Security Pitfalls of Zhang et al.’s Scheme

3.1 Adversary Model

3. By analyzing the method of power analysis and consumption or from the leaked using HA’s master key and

de-crypts Auth_MU to fetch aP. A random number

n

′

is generated by HA to compute MID Enc ID′= K( MU, ),n′

= ( , , , )

HA K_FH HA MU

D Enc ID ID aP bP and AuthHA=Enc MID aP bPV′( ′, , )

= ( , , )

HA V

Auth Enc MID aP bP′ ′ , where THA is a timestamp of HA.

Finally, the message m3= {DHA, AuthHA} is sent to FA.

A4. FA receives the message m₃ and decrypts D_HA and looks for the correctness of bP and THA. If the correct-ness holds, FA computes Auth h abP IDFA= (  MUIDFA)

{ , }

m Auth Auth

= .

p

= ( , )

MU V MU

p

= ( , , )

FA K_FH FA FA

number n′ _{is generated by}_HA _{to compute}_{MID Enc ID}′₌ _K₍ _MU_{, ),}_n′

= ( , , , )

HA K_FH HA MU

HA. Finally, the message m3= {DHA, AuthHA} is sent to FA.

A4. FA receives the message m3 and decrypts DHA and looks for the correctness of bP and

.

HA

= ( )

MF MU FA

= ( )

MF MU FA

2.3 Update Session Key

3 Security Pitfalls of Zhang et al.’s Scheme

3.1 Adversary Model

3. By analyzing the method of power analysis and consumption or from the leaked . The message

4 = { FA, HA}

m Auth Auth is sent to MU.

A5. To obtain aP, bP and MID′, MU decrypts Auth_HA.

MU verifies whether the decrypted aP is same as that of the value in step A1. If the verification holds with the chosen secret value a, then MU needs to verify the correctness of Auth_FA to compute the session key

= .

p

= ( , )

MU V MU

p

= ( , , )

FA K_FH FA FA

= ( , , , )

HA K_FH HA MU

D Enc ID ID aP bP and AuthHA =Enc MID aP bPV′( ′, , ), where THA is a timestamp of

HA. Finally, the message m₃= {DHA, AuthHA} is sent to FA.

A4. FA receives the message m₃ and decrypts DHA and looks for the correctness of bP and

.

HA

= ( )

MF MU FA

SK h aP bP abP ID   ID . The message m₄= {Auth AuthFA, HA} is sent to MU.

= ( )

MF MU FA

2.3 Update Session Key

3 Security Pitfalls of Zhang et al.’s Scheme

3.1 Adversary Model

3. By analyzing the method of power analysis and consumption or from the leaked . The

smart-card updates MID with

MID

′

in its memory.

2.3. Update Session Key

3. Security Pitfalls of Zhang et al.’s

Scheme

3.1. Adversary Model

The security of Zhang et al.’s scheme is analyzed un-der the following security model [7-8, 16, 20]:

(5)

communica-133 Information Technology and Control 2019/1/48

tions between the parties.

2  attains the potential to delete, modify, resend or

to redirect the eavesdropped transmitted messages.

3 By analyzing the method of power analysis and

consumption or from the leaked information, the information from the smart card can be extracted by .

4  can be an insider of the system.

3.2. Disadvantages:

1 No verification mechanism for user’s login

creden-tials to check the legitimacy of the user.

2 The communication message m1 is transmitted to

FA even if illegal credentials (Wrong credentials) are being used by a user/adversary.

3 Incorrect login credentials induce huge

communi-cation and computational wastage.

3.3. Stolen Smartcard Attack

Suppose that the smartcard of MU is lost or stolen for a deliberate amount of time and replaced. The ad-versary  can get control over the smartcard as dis-cussed in Section 3.1. Using this captured smartcard parameters and the transmitted messages on the in-secure channel,  can perform the following attacks: 3.3.1. Password Guessing Attack

1 Initially,  guesses the PW_MU and computes

information, the information from the smart card can be extracted by . 4.  can be an insider of the system.

3.2 Disadvantages:

1. No verification mechanism for user’s login credentials to check the legitimacy of the user. 2. The communication message m1 is transmitted to FA even if illegal credentials (Wrong credentials) are being used by a user/adversary.

3. Incorrect login credentials induce huge communication and computational wastage.

3.3 Stolen Smartcard Attack

Suppose that the smartcard of MU is lost or stolen for a deliberate amount of time and replaced. The adversary  can get control over the smartcard as discussed in Section 3.1. Using this captured smartcard parameters and the transmitted messages on the insecure channel,  can perform the following attacks:

3.3.1 Password Guessing Attack

1. Initially,  guesses the PWMU and computes V = (h PWMU m), V V′= ⊕C. 2.  decrypts AuthMU and AuthHA using the computed V′.

3.  verifies the parametric value of aP in both AuthMU and AuthHA from the above

decryption. If the value is the same in both the decryption computations,  guesses the password of the

MU successfully.

4. Otherwise,  repeats the above steps until the password PWMU is guessed correctly.

Therefore,  will be able to guess the MU’s password.

3.3.2 User Anonymity and Traceability

According to Subsection 3.3.1, adversary guesses the password of MU and computes V′. Further  decrypts AuthMU using V′. It is evident that the decryption of AuthMU discloses the

identity IDMU of the MU. Thus, IDMU allows  to differentiate the users in every different login

sessions which may breach the privacy of the user. Therefore, we claim that privacy of the user was not taken proper care as refered in [34].

3.4 User Impersonation Attack

We have seen that  is able to compute V′_(i.e.,V′= (h IDMUK) ) successfully. Using the adversary capabilities described in Section 3.1 and V′,  modifies AuthMU using his selected random

number (say * P

Z

α∈ ). The details are as follows:

1.  computes aP and Auth =Enc IDV′( MU,αP) and transmits the message 1= { HA, ,

m ID MID Auth} to FA.

, V V′= ⊕C_.

2  decrypts AuthMU and AuthHA using the computed V′.

3  verifies the parametric value of aP in both AuthMU

and Auth_HA from the above decryption. If the value is the same in both the decryption computations,

 guesses the password of the MU successfully.

4 Otherwise,  repeats the above steps until the password PW_MU is guessed correctly.

Therefore,  will be able to guess the MU’s password. 3.3.2. User Anonymity and Traceability

According to Subsection 3.3.1, adversary guesses the password of MU and computes V′. Further  de-crypts Auth_MU using V′. It is evident that the decryp-tion of Auth_MU discloses the identity ID_MU of the MU. Thus, ID_MU allows  to differentiate the users in ev-ery different login sessions which may breach the pri-vacy of the user. Therefore, we claim that pripri-vacy of the user was not taken proper care as refered in [34].

3.4. User Impersonation Attack

We have seen that  is able to compute V′ (i.e., information, the information from the smart card can be extracted by .

4.  can be an insider of the system.

3.2 Disadvantages:

1. No verification mechanism for user’s login credentials to check the legitimacy of the user. 2. The communication message m₁ is transmitted to FA even if illegal credentials (Wrong credentials) are being used by a user/adversary.

3. Incorrect login credentials induce huge communication and computational wastage.

3.3 Stolen Smartcard Attack

Suppose that the smartcard of MU is lost or stolen for a deliberate amount of time and replaced. The adversary  can get control over the smartcard as discussed in Section 3.1. Using this captured smartcard parameters and the transmitted messages on the insecure channel,  can perform the following attacks:

3.3.1 Password Guessing Attack

1. Initially,  guesses the PW_MU _{and computes} _{= (} ₎

MU

V h PW _m _,_{V V}_′₌ _⊕_C_. 2.  decrypts AuthMU and AuthHA using the computed V′.

3.  verifies the parametric value of aP in both AuthMU and AuthHA from the above

decryption. If the value is the same in both the decryption computations,  guesses the password of the

MU successfully.

4. Otherwise,  repeats the above steps until the password PWMU is guessed correctly.

Therefore,  will be able to guess the MU’s password.

3.3.2 User Anonymity and Traceability

According to Subsection 3.3.1, adversary guesses the password of MU and computes V′. Further  decrypts AuthMU using V′. It is evident that the decryption of AuthMU discloses the

identity IDMU of the MU. Thus, IDMU allows  to differentiate the users in every different login

sessions which may breach the privacy of the user. Therefore, we claim that privacy of the user was not taken proper care as refered in [34].

3.4 User Impersonation Attack

We have seen that  is able to compute V′ (i.e., V′= (h IDMUK) ) successfully. Using the

adversary capabilities described in Section 3.1 and V′,  modifies AuthMU using his selected random

number (say *

P

Z

α∈ ). The details are as follows:

1.  computes aP and Auth =Enc IDV′( MU,αP) and transmits the message

1= { HA, ,

m ID MID Auth_} to FA.

) successfully. Using the adversary capabilities described in Section 3.1 and V′,  modi-fies

Auth

_MU using his selected random number (say

* P

Z

α ∈ ). The details are as follows:

1  computes aP and Auth =Enc IDV′( MU,αP) and

transmits the message m₁= {ID MIDHA, , Auth} to FA.

2 FA receives the message m₁ and selects a ran-dom number *

p

b Z∈ computes bP and DFA=EncK_FH(ID bP TFA, , FA)

= ( , , )

FA K_FH FA FA

D Enc ID bP T . The message _m₂ _{= {}_{ID MID Auth T D}_FA_, _, __, _FA_, _FA_} 2= { FA, , , FA, FA}

m ID MID Auth T D is sent to HA.

3 On receiving m₂, HA decrypts MID and D_FA to obtain ID_MU and T_FA. HA verifies the correct-ness of ID_MU and T_FA. If verification fails, HA re-jects the process. Else,  makes use of HA’s master key K, computes

2. FA receives the message m₁ and selects a random number *

p

b Z∈ computes bP and

= ( , , )

FA K_FH FA FA

D Enc ID bP T . The message m₂= {ID MID Auth T DFA, , , ,FA FA} is sent to HA.

3. On receiving m₂, HA decrypts MID and DFA to obtain IDMU and TFA. HA verifies the

correctness of IDMU and TFA. If verification fails, HA rejects the process. Else,  makes use of HA’s

master key K, computes V′= (h IDMUK) and decrypts Auth to fetch αP T, 1. Then a random number n′ is chosen from *

p

Z to compute DHA=EncK_FH(ID IDHA, MU,αP bP T T, , ,1 HA) and

1

= ( , , , )

HA V

Auth Enc MID P T bP′ ′α . Finally, the message m₃= {DHA, AuthHA} is sent to FA.

4. FA receives the message m₃ and decrypts DHA and looks for the correctness of bP and

.

HA

T If the correctness holds, FA computes AuthFA= (h bP IDα  MUIDFA),

= ( )

MF MU FA

SK h P bPα  αbP ID ID . The message m₄= {Auth AuthFA, HA} is sent to MU.

5.  captures the message m₄.

The above procedure indicates that the adversary can successfully impersonate MU by making both FA and HA believe that they are communicating with MU.

3.5 Replay Attack

The adversary  can capture the previously communicated messages as described in Section 3.1.  uses the communicated messages and replays the same message (say m₁) to FA and the same is transmitted to HA via FA as there is no fresh verification of the messages sent by MU at HA. Therefore, Zhang et al.’s scheme does not prevent  from sending the replay messages.

3.6 Absence of Unauthorized Login Detection

A user may sometime fail to correctly map different password to his/ her different accounts. Thus, login credential verification should be supported at initial stage. However, Zhang et al.’s scheme lacks user credential verification mechanism in login phase. Lack of efficient login phase makes the scheme inefficient.

4 The Proposed Scheme

In proposed scheme, *

H p

K ∈Z is the secret key of HA and *

F p

K ∈Z is the secret key of FA. FA

and HA also share a common secret key KFH. Furthermore, FA and HA also compute their public keys

H

K P and K PF , respectively.

4.1 Registration Phase

This phase utilizes the secure channel to communicate with the participants. MU registers with

HA, if he/she wishes to get services from Global Mobility Network.

1. MU selects his/her identity IDMU, password PWMU, computes Y h PWi= ( MUm) and

and decrypts Auth to fetch αP T, 1. Then a ran-dom number n′ is chosen from *

p

Z to compute 1

= ( , , , , , )

HA K_FH HA MU HA

D Enc ID ID αP bP T T and

1

= ( , , , )

HA V

Auth Enc MID P T bP′ ′α . Finally, the

mes-sage m₃= {DHA, AuthHA} is sent to FA.

4 FA receives the message m3 and decrypts

DHA and looks for the correctness of bP

and THA._{If the correctness holds,}FA com-

putes

2. FA receives the message m1 and selects a random number b Z∈ *p computes bP and

= ( , , )

FA K_FH FA FA

D Enc ID bP T . The message m2= {ID MID Auth T DFA, , , ,FA FA} is sent to HA.

3. On receiving m2, HA decrypts MID and DFA to obtain IDMU and TFA. HA verifies the

master key K, computes V′= (h ID_MU_K)_{and decrypts}_Auth_ _{to fetch}

α

P T, ₁. Then a random

number n′ is chosen from *

p

Z to compute DHA=EncK_FH(ID IDHA, MU,

α

P bP T T, , ,₁ HA) and

1

= ( , , , )

HA V

Auth Enc MID P T bP′ ′

α

. Finally, the message m3= {DHA, AuthHA} is sent to FA.

4. FA receives the message m3 and decrypts DHA and looks for the correctness of bP and

.

HA

T If the correctness holds, FA computes AuthFA= (h bP ID

α

 MUIDFA),

= ( )

MF MU FA

SK h P bP

α

 

α

bP ID ID . The message m4= {Auth AuthFA, HA} is sent to MU.

5.  captures the message m4.

3.5 Replay Attack

The adversary  can capture the previously communicated messages as described in Section

3.1.  uses the communicated messages and replays the same message (say m1) to FA and the same

is transmitted to HA via FA as there is no fresh verification of the messages sent by MU at HA.

Therefore, Zhang et al.’s scheme does not prevent  from sending the replay messages.

3.6 Absence of Unauthorized Login Detection

A user may sometime fail to correctly map different password to his/ her different accounts. Thus, login credential verification should be supported at initial stage. However, Zhang et al.’s scheme lacks user credential verification mechanism in login phase. Lack of efficient login phase makes the scheme inefficient.

4 The Proposed Scheme

H p

F p

H

4.1 Registration Phase

This phase utilizes the secure channel to communicate with the participants. MU registers with HA, if he/she wishes to get services from Global Mobility Network.

1. MU selects his/her identity IDMU, password PWMU , computes Y h PWi= ( MUm) and

,

2. FA receives the message m1 and selects a random number b Z∈ *p computes bP and

= ( , , )

FA K_FH FA FA

3. On receiving m2, HA decrypts MID and DFA to obtain IDMU and TFA. HA verifies the

master key K, computes V′= (h ID_MU_K)_{and decrypts}_Auth_ _{to fetch}αP T, ₁. Then a random number n′ _{is chosen from} *

p

1

= ( , , , )

HA V

Auth Enc MID P T bP′ ′α . Finally, the message m3= {DHA, AuthHA} is sent to FA.

.

HA

= ( )

MF MU FA

SK h P bPα _ _αbP ID_ _ID . The message m4= {Auth AuthFA, HA} is sent to MU.

3.5 Replay Attack

The adversary  can capture the previously communicated messages as described in Section 3.1.  uses the communicated messages and replays the same message (say m1) to FA and the same is transmitted to HA via FA as there is no fresh verification of the messages sent by MU at HA. Therefore, Zhang et al.’s scheme does not prevent  from sending the replay messages.

3.6 Absence of Unauthorized Login Detection

4 The Proposed Scheme

H p

F p

H

4.1 Registration Phase

1. MU selects his/her identity IDMU, password PWMU, computes Y h PWi= ( MUm) and

= ( , , )

FA K_FH FA FA

D Enc ID bP T . The message m2 = {ID MID Auth T DFA, , , ,FA FA} is sent to HA.

master key K, computes V′= (h IDMUK) and decrypts Auth to fetch αP T, 1. Then a random number n′ _{is chosen from} *

p

1

= ( , , , )

HA V

Auth Enc MID P T bP′ ′α . Finally, the message m3 = {DHA, AuthHA} is sent to FA.

.

HA

= ( )

MF MU FA

SK h P bPα _ _αbP ID_ _ID . The message m4 = {Auth AuthFA, HA} is sent to MU.

3.5 Replay Attack

3.6 Absence of Unauthorized Login Detection

4 The Proposed Scheme

H p

F p

H

4.1 Registration Phase

1. MU selects his/her identity IDMU, password PWMU, computes Y h PWi = ( MUm) and

. The message 4 = { FA, HA}

m Auth Auth is sent to MU.

5  captures the message m4.

The above procedure indicates that the adversary can successfully impersonate MU by making both FA and

HA believe that they are communicating with MU.

3.5. Replay Attack

The adversary  can capture the previously communi-cated messages as described in Section 3.1.  uses the communicated messages and replays the same mes-sage (say m1) to FA and the same is transmitted to HA

via FA as there is no fresh verification of the messag-es sent by MU at HA. Therefore, Zhang et al.’s scheme does not prevent  from sending the replay messages.

3.6. Absence of Unauthorized Login Detection

(6)

stage. However, Zhang et al.’s scheme lacks user cre-dential verification mechanism in login phase. Lack of efficient login phase makes the scheme inefficient.

4. The Proposed Scheme

H p

K ∈Z is the secret key of HA

and * F p

K ∈Z is the secret key of FA. FA and HA also share a common secret key K_FH. Furthermore, FA and

HA also compute their public keys _{K P}_H and _{K P}_F , re-spectively.

4.1. Registration Phase

This phase utilizes the secure channel to communi-cate with the participants. MU registers with HA, if he/she wishes to get services from Global Mobility Network.

1 MU selects his/her identity ID_MU, password PWMU,

computes

= ( , , )

FA K_FH FA FA