Anonymous biometrics-based authentication with key agreement scheme for multi-server environment using ECC

Abstract

The rapidly evolving communication technology has now made it easy for people to enjoy kinds of online services over the insecure public internet. However, with convenience, ensuring data security as well as user privacy and authentication is particularly important and urgent. In view of this, this work presents a new biometrics-based three-factor authentication with key agreement scheme for multi-server environment using ECC. The formal authentication proof using BAN logic confirms that the new scheme can achieve mutual authentication and agree on a common session key; and the heuristic cryptanalysis shows that the new scheme provides perfect forward secrecy, preserves user anonymity and secures against various known security vulnerabilities. Furthermore, the performance evaluation demonstrates that our scheme is efficient.

1 Introduction

The advancement of network and communication technologies has brought more and more offline services online, and people are now enjoying high-efficiency online services such as e-health, e-commerce and e-government, etc. However, these online services are provided over the insecure public internet, where adversaries can easily perform some attacks, like privacy violating, impersonation attack, replay attack, man-in-the-middle attack, etc. To deal with these security challenges, authentication with session key agreement protocol is deployed to ensure that only certified users can enjoy services, only the legitimate service providers can be accessed, and the exchanged critical information is secured by encryption with the negotiated session key.

1.1 Related works

In recent years, numerous authentication schemes have been designed to maintain secure communications between the remote users and the servers over the internet. Many smart-card based two-factor authentication schemes [4, 8, 9, 12, 17, 20, 21, 23, 24] were proposed in which the elliptic curve cryptography (ECC) was applied to establish security since ECC can provide the same level of security with far less key size and faster computing speed. However, all these schemes are only applicable to single-server environment and many of them have been found vulnerable to various attacks. Compared with single-server environment, multi-server environment has the obvious advantage that it enables users to access various application servers with one account. To adapt to the security requirements of multi-server environment, several kinds of authentication schemes [1, 3, 5, 6, 10, 11, 13, 15, 16, 18, 19, 22, 25] with respect to multi-server environment have therefore been presented.

In 2013, Yoon and Yoo [25] presented a biometrics-based multi-server authentication scheme using ECC, while Kim et al. [15] proved that this scheme is prone to the offline password guessing attack, and an improvement for this scheme was presented. Later, Chuang et al. [6] came up with an anonymous biometrics-based authentication scheme with respect to multi-server environment, while Mishra et al. [18] soon proved that this scheme was prone to the server spoofing, smart-card stolen and impersonation attacks, and they put forward a new scheme. However, Lu et al. [16] soon proved that Mishra et al.’s new scheme was not to secure against the forgery and server masquerading attacks, and they redesigned an authentication scheme for multi-server environment using asymmetric cryptography. Nevertheless, Lu et al.’s new scheme was soon identified by Chaudhry et al. [5] to be vulnerable to the impersonation attack.

Afterwards, Odelu et al. [19] put forward a new biometrics-based multi-server authentication scheme on the basis of He and Wang’s scheme [10] with the aim to eliminate its security weaknesses. Later, Shen et al. [22] came up with a multi-server authentication scheme not preserving user anonymity. Later, Amin et al. [1] proposed an anonymity preserving authentication scheme for multi-server telemedicine information system using ECC, but very recently, their scheme was found by Irshad et al. [11] to be vulnerable to the offline password guessing and impersonation attacks. Recently, Chandrakar and Om [3] presented an anonymous three-factor authentication scheme for multi-server environment using ECC; and Jangirala et al. [13] presented a dynamic identity based multi-server authentication scheme. However, like the schemes [6, 18], Jangirala et al.’s scheme doesn’t employ asymmetric cryptographic primitives to ensure security either. Thus, it fails to provide the forward secrecy.

1.2 Motivation and contributions

By investigating the related existing schemes, it can be found that various weaknesses are still within many of them. To ensure that remote users can enjoy online services and exchange critical data securely, this work designs a new robust biometrics-based authentication scheme based on previous researches for multi-server environment. The proposed scheme preserves user’s biometrics template privacy by employing the fuzzy extractor [7], and the formal authentication proof by Burrows-Abadi-Needham (BAN) logic [2] shows that the new scheme can effectively realize mutual authentication and agree on a common session key. Besides, the heuristic security discussion in this paper demonstrates that our scheme can preserve user anonymity, provide perfect forward secrecy and protect users from various known security loopholes such as impersonation attack, replay attack, denial of service attack, and offline password guessing attack, etc. In addition, since our scheme has the advantage in network architecture design, i.e. the registration center in our scheme will no longer participate in the subsequent user-server session key negotiation processes after completing the user authentication, thus greatly reducing computation and communication costs in the authentication with key agreement phase. Hence, besides the security attributes, our new scheme has advantages over other relevant schemes in terms of computation and communication costs.

1.3 Organizations

The rest of this article is arranged as follows. Section 2 describes the necessary preliminaries. Section 3 introduces our new biometrics-based authentication with key agreement scheme for multi-server environment. The authentication proof by BAN logic is presented in Section 4; the security analysis of the proposed scheme is presented in Section 5; and the performance evaluation is presented in Section 6. Finally, conclusions are given in Section 7.

2 Preliminaries

This section briefly lists the notations used throughout this work, and introduces the essential notion and definitions of ECC and the fuzzy extractor.

2.1 Notation guide

The meaning of the frequently used notations in this paper is shown in Table 1.

Table 1 Notations & descriptions

2.2 Elliptic curve over a prime field F _p

Let the symbol E_p(a, b) denote an elliptic curve E over a prime finite field F_p, defined by the non-singular elliptic curve equation: y² = x³ + ax + b mod p, a, b ∈ F_p with the discriminant: ∆ = 4a³ + 27b²mod p ≠ 0. That is, .

The scalar multiplication over E_p(a, b) defined as tP = P + P + ⋯ + P (t times).

A point P has order n if $nP=\mathcal{O}$ for the smallest integer n > 0, where $\mathcal{O}$ is the extra point called infinity point.

Definition 1

Elliptic curve discrete logarithm problem (ECDLP) is defined as follows: Given P ∈ E_p(a, b) with order n and Q = kP ∈ E_p(a, b), it is infeasible to derive the integer k ∈ [1, n − 1].

Definition 2

Computational Diffie-Hellman problem (CDHP) is defined as follows: Given P, aP, bP ∈ E_p(a, b), it is intractable to compute abP ∈ E_p(a, b).

2.3 Fuzzy extractor

Fuzzy extractor [7] is used to extract a uniform random string σ_i from the inputted biometrics template B_i in an error-tolerant way, which means σ_i can be derived each time with a noisy biometrics template ${B}_i^{\ast }$ and an auxiliary string θ_i if ${B}_i^{\ast }$ is reasonably similar to the original B_i. A fuzzy extractor comprises two procedures, namely, the probabilistic generation procedure Gen and the deterministic reproduction procedure Rep. More concrete descriptions are as follows:

• (1) (σ_i, θ_i) = Gen(B_i) means when receiving the inputted biometrics B_i, Gen outputs a uniform random string σ_i and an auxiliary string θ_i.

• (2) ${\sigma}_i= Rep\left({B}_i^{\ast },{\theta}_i\right)$ means Rep can recover σ_i with the noisy biometrics ${B}_i^{\ast }$ and the corresponding random auxiliary string θ_i when $dis\left({B}_i^{\ast },{B}_i\right)<\Delta t$, where dis represents the distance function and ∆t is the error threshold.

3 Our proposed scheme

This section presents our new biometrics-based authentication with key agreement protocol for multi-server environment, which comprises the following four phases.

3.1 System initialization phase

The registration center RC first takes the following steps to initialize the system parameters.

• (1) RC selects an non-singular elliptic curve E_p(a, b) with a large prime order n, and a base point G with the order n over E_p(a, b).

• (2) RC selects two cryptographic hash functions: $H:{\left\{0,1\right\}}^{\ast}\to {Z}_p^{\ast }$, $h:{\left\{0,1\right\}}^{\ast}\to {Z}_p^{\ast }$.

• (3) RC generates its private key $x\in {Z}_n^{\ast }$ which should be kept secret strictly, and then computes its public key P_pub = x ∙ G.

• (4) RC publishes the system parameters {E_p(a, b), G, n, P_pub, H(∙), h(∙)}.

3.2 Registration phase

The registration phase of our scheme comprises the following two phases.

3.2.1 Server registration phase

To deploy a new server S_j to be a legal server, the following steps also shown in Fig. 1 need to be executed.

• (1) S_j selects its identity SID_j and transmits it to RC via a secure channel.

• (2) RC generates a random number r_j and computes the secret key k_j = h(SID_j‖x‖r_j), then stores {SID_j, r_j} into its security database and transmits k_j back to S_j via a secure channel, where x is the system private key.

• (3) Upon receiving k_j, S_j keeps it secretly.

Fig. 1

Server registration phase

3.2.2 User registration phase

To be a legal user, U_i needs to take the following steps also shown in Fig. 2, to register in RC.

• (1) U_i inputs his/her identity ID_i, pw_i and imprints B_i on a sensor.

• (2) U_i computes (σ_i, θ_i) = Gen(B_i), MP_i = h(pw_i‖σ_i) and transmits ID_i, MP_i to RC by a secure channel.

• (3) Upon receiving ID_i and MP_i, RC checks the validity of ID_i and whether h(ID_i) exists in RC’s user database. If not, RC stores h(ID_i) in its user database and computes r_i = h(ID_i‖x) k_i = r_i ⊕ MP_i, v_i = H(ID_i‖r_i‖MP_i), where x is the system private key, and then RC stores {k_i,v_i, H(∙),h(∙)} into a smart-card SC_i and returns it back to U_i; otherwise RC aborts the procedure.

• (4) After receiving SC_i, U_i stores θ_i into SC_i.

Fig. 2

User registration phase

3.3 Login and mutual authentication with key agreement phase

Assume that a remote user U_i wants to enjoy online services from S_j, then, he/she needs to perform the following steps to accomplish the mutual authentication processes and agree on a session key for encrypting the subsequent communications over the insecure public channel as shown in Fig. 3.

Fig. 3

Login and mutual authentication with key agreement phase

• (1) U_i inserts his/her smart-card SC_i into a card reader, then inputs ID_i, pw_i, and imprints B_i at a sensor.

• (2) SC_i computes σ_i = Rep(B_i, θ_i), ${MP}_i^{\prime }=h\left({pw}_i\Big\Vert {\sigma}_i\right)$, ${r}_i={k}_i\oplus {MP}_i^{\prime }$, and checks whether ${v}_i=H\left({ID}_i\left\Vert {r}_i\right\Vert {MP}_i^{\prime}\right)$ holds. If not, SC_i rejects U_i, otherwise, SC_i generates a random number α to compute X = α ∙ G, K = α ∙ P_pub, k = h(K), c₁ = E_k(SID_j‖ID_i‖H(r_i‖X‖t₁)), where t₁ is the current timestamp of U_i, and sends {c₁,X,t₁} to RC.

• (3) Upon receiving the message {c₁,X,t₁}, RC gets its current timestamp ${t}_1^{\prime }$ and checks whether ${t}_1^{\prime }-{t}_1<\Delta t$ holds. If not, RC aborts the procedure, otherwise, RC computes K^′ = x ∙ X, k^′ = h(K^′), ${SID}_j^{\prime}\left\Vert {ID}_i^{\prime}\right\Vert {H}^{\prime}\left({r}_i\left\Vert X\right\Vert {t}_1\right)={D}_{k^{\prime }}\left({c}_1\right)$, ${r}_i^{\prime }=H\left({ID}_i^{\prime}\Big\Vert x\right)$ and checks whether ${H}^{\prime}\left({r}_i\left\Vert X\right\Vert {t}_1\right)=H\left({r}_i^{\prime}\left\Vert X\right\Vert {t}_1\right)$ holds. If not, RC aborts the procedure; otherwise, RC retrieves the random number r_j by ${SID}_j^{\prime }$ and computes ${k}_j=h\left({SID}_j^{\prime}\left\Vert x\right\Vert {r}_j\right)$, $che=H\left({ID}_i^{\prime}\left\Vert H\left({r}_i^{\prime}\right)\right\Vert X\right)$, ${c}_2={E}_{k_j}\left({SID}_j^{\prime}\left\Vert {ID}_i^{\prime}\right\Vert H\left({r}_i^{\prime}\right)\left\Vert X\right\Vert che\Big\Vert {t}_2\right)$ and sends {c₂,t₂} to S_j.

• (4) Upon receiving the message {c₂,t₂}, S_j gets its current timestamp ${t}_2^{\prime }$ and checks whether ${t}_2^{\prime }-{t}_2<\Delta t$ holds. If not, S_j aborts the procedure, otherwise, computes ${SID}_j^{\prime}\left\Vert {ID}_i^{\prime}\right\Vert H\left({r}_i^{\prime}\right)\left\Vert X\right\Vert {che}^{\prime}\Big\Vert {t}_2^{\prime }={D}_{k_j}\left({c}_2\right)$ and checks whether ${t}_2^{\prime }={t}_2$ and ${che}^{\prime }=H\left({ID}_i^{\prime}\left\Vert H\left({r}_i^{\prime}\right)\right\Vert X\right)$ hold. If not, S_j aborts the procedure, otherwise, generates a random number β to compute Y = β ∙ G, Z = β ∙ X, ${SK}_s=h\left({ID}_i^{\prime}\left\Vert {SID}_j\right\Vert H\left({r}_i^{\prime}\right)\left\Vert X\right\Vert Y\Big\Vert Z\right)$, ${V}_j=H\left({SK}_s\left\Vert H\left({r}_i^{\prime}\right)\right\Vert X\left\Vert Y\right\Vert {t}_3\right)$ where t₃ is the current timestamp of S_j, and sends {V_j,Y,t₃} to U_i.

• (5) Upon receiving the message {V_j,Y,t₃}, U_i gets its current time stamp ${t}_3^{\prime }$ and checks whether ${t}_3^{\prime }-{t}_3<\Delta t$ holds. If not, U_i aborts the procedure, otherwise, computes Z = α ∙ Y, SK_i = h(ID_i‖SID_j‖H(r_i)‖X‖Y‖Z) and checks V_j ?  = H(SK_i‖H(r_i)‖X‖Y‖t₃); if not, U_i aborts the procedure, otherwise, accepts SK = h(ID_i‖SID_j‖H(r_i)‖X‖Y‖Z) as the session key, then, computes V_i = H(SK_i‖H(r_i)‖Y) and sends {V_i} to S_j.

• (6) Upon receiving the message {V_i}, S_j checks ${V}_i?=H\left({SK}_s\left\Vert H\left({r}_i^{\prime}\right)\right\Vert Y\right)$. If not, S_j aborts the procedure, otherwise, S_j accepts SK = h(ID_i‖SID_j‖H(r_i)‖X‖Y‖Z) as the session key for subsequent communications.

3.4 Password change phase

A legal user U_i may for security reasons need to change the old password pw_i, and then, he/she just needs take the following steps without connecting to RC or S_j.

• (1) U_i inserts his/her smart card SC_i into a card reader, then inputs ID_i, pw_i and imprints B_i at a sensor.

• (2) SC_i computes σ_i = Rep(B_i, θ_i), ${MP}_i^{\prime }=h\left({pw}_i\Big\Vert {\sigma}_i\right)$, ${r}_i={k}_i\oplus {MP}_i^{\prime }$, and checks whether ${v}_i=H\left({ID}_i\left\Vert {r}_i\right\Vert {MP}_i^{\prime}\right)$ holds. If not, SC_i rejects U_i; otherwise, SC_i asks U_i to input new password ${pw}_i^{\ast }$.

• (3) Upon receiving ${pw}_i^{\ast }$, SC_i computes ${MP}_i^{\ast }=h\left({pw}_i^{\ast}\Big\Vert {\sigma}_i\right)$, ${k}_i^{\ast }={k}_i\oplus {MP}_i\oplus {MP}_i^{\ast }$, ${v}_i^{\ast }=H\left({ID}_i\left\Vert {r}_i\right\Vert {MP}_i^{\ast}\right)$ and replaces k_i, v_i with ${k}_i^{\ast }$, ${v}_i^{\ast }$, respectively.

4 Authentication proof by BAN logic

This section formally proves that our new scheme can achieve mutual authentication with session key agreement by BAN logic [2]. Detailed proof is as follows.

• BAN logic notations:

• P ∣  ≡ X: The principal P believes X.

• #(X): The formula X is fresh.

• P ⇒ X: P has jurisdiction over X.

• P ∣ ~X: P once said the statement X.

• P ∣  ⊲ X: P sees the statement X.

• (X, Y): X or Y is one part of the (X, Y).

• {X}_K: X is encrypted with the key K.

• (X)_K: X is hashed with the key K.

• ⟨X⟩_K: X is combined with the key K.

• $P\overset{K\kern0.5em }{\leftrightarrow }Q:$P and Q use the shared session key K to communicate, and K will never be discovered by any principal except P and Q.

• BAN logic rules:

• Rule(1) :  Message-meaning rule: $\frac{P\mid \equiv P\overset{K\kern0.5em }{\leftrightarrow }Q,\kern0.75em P\mid \vartriangleleft {\left\{X\right\}}_K\ }{P\left|\equiv Q\right|\sim X}$

• Rule(2) :  Nonce-verification rule: $\frac{P\mid \equiv \#(X),\kern0.75em P\mid \equiv Q\mid \sim X\ }{P\mid \equiv Q\mid \equiv X}$

• Rule(3) :  Jurisdication rule: $\frac{P\mid \equiv Q\Rightarrow X,\kern0.75em P\mid \equiv Q\mid \equiv X\ }{P\mid \equiv X}$

• Rule(4) :  Freshness-conjuncatenation rule: $\frac{P\mid \equiv \#(X)\ }{P\mid \equiv \#\left(X,\kern0.75em Y\right)}$

• Establishment of security goals:

• Goal 1: ${S}_j\mid \equiv {U}_i\overset{H\left({r}_i\right)\ }{\leftrightarrow }{S}_j$.

• Goal 2: ${U}_i\left|\equiv {S}_j\right|\equiv {U}_i\overset{SK_s\ }{\leftrightarrow }{S}_j$.

• Goal 3: ${U}_i\mid \equiv {U}_i\overset{SK_s\ }{\leftrightarrow }{S}_j$.

• Goal 4: ${S}_j\left|\equiv {U}_i\right|\equiv {U}_i\overset{SK_i\ }{\leftrightarrow }{S}_j$.

• Goal 5: ${S}_j\mid \equiv {U}_i\overset{SK_i\ }{\leftrightarrow }{S}_j$.

• Idealized the proposed scheme

$$ {\displaystyle \begin{array}{l}{M}_1\ \left({U}_i\to RC\right):\kern0.5em \left\{{\left\{ SI{D}_j,I{D}_i,H\left({r}_i||X||{t}_1\right)\right\}}_k,X,{t}_1\right\}\\ {}{M}_2\ \left( RC\to {S}_j\right):\kern0.5em \left\{{\left\{ SI{D}_j^{\hbox{'}},I{D}_i^{\hbox{'}},{U}_i\overset{\kern0.5em H\left({r}_i\right)\ }{\leftrightarrow }{S}_j,X, che,{t}_2\right\}}_{k_j},{t}_2\right\}\\ {}{M}_3\ \left({S}_j\to {U}_i\right):\kern0.5em \left\{{\left({U}_i\overset{\kern0.5em S{K}_s\ }{\leftrightarrow }{S}_j,X,Y,{t}_3\right)}_{H\left({r}_i\right)},Y,{t}_3\right\}\\ {}{M}_4\ \left({U}_i\to {S}_j\right):\kern0.5em \left\{\ {\left({U}_i\overset{\kern0.5em S{K}_i\ }{\leftrightarrow }{S}_j,Y\right)}_{H\left({r}_i\right)}\right\}\end{array}} $$

• Hypotheses of the proposed scheme

$$ {\displaystyle \begin{array}{l}{H}_1:{U}_i\mid \equiv \#\left(X=\alpha \cdot G\right)\\ {}{H}_2:{S}_j\mid \equiv \#\left(Y=\beta \cdot G\right)\\ {}{H}_3:{S}_j\mid \equiv \#\left({t}_2\right)\\ {}{H}_4:{U}_i\mid \equiv {U}_i\overset{\kern0.50em H\left({r}_i\right)\ \ }{\leftrightarrow }{S}_j\\ {}{H}_5:{S}_j\mid \equiv {S}_j\overset{\kern0.50em {k}_j\ \ }{\leftrightarrow } RC\\ {}{H}_6:{S}_j\mid \equiv RC\Rightarrow {U}_i\overset{\kern0.50em H\left({r}_i\right)\ }{\leftrightarrow }{S}_j\\ {}{H}_7:{U}_i\mid \equiv {S}_j\Rightarrow {U}_i\overset{\kern0.50em S{K}_s\ \ }{\leftrightarrow }{S}_j\\ {}{H}_8:{S}_j\mid \equiv {U}_i\Rightarrow {U}_i\overset{\kern0.50em S{K}_i\ }{\leftrightarrow }{S}_j\end{array}} $$

• The proof of our proposed scheme

• According to M₂, we have

$$ {S}_1:{S}_j\vartriangleleft {\left\{{SID}_j^{\prime },{ID}_i^{\prime },{U}_i\overset{H\left({r}_i\right)\ }{\leftrightarrow }{S}_j,X, che,{t}_2\right\}}_{k_j} $$

• According to S₁, H₅ and Rule(1), we have

$$ {S}_2:{S}_j\left|\equiv RC\ \right|\sim \left\{{SID}_j^{\prime },{ID}_i^{\prime },{U}_i\overset{H\left({r}_i\right)\ }{\leftrightarrow }{S}_j,X, che,{t}_2\right\} $$

• According to S₂, H₃, Rule(4) and Rule(2), we have

$$ {S}_3:{S}_j\left|\equiv RC\right|\equiv \left\{{SID}_j^{\prime },{ID}_i^{\prime },{U}_i\overset{H\left({r}_i\right)\ }{\leftrightarrow }{S}_j,X, che,{t}_2\right\} $$

• According to S₃, we have

$$ {S}_4:{S}_j\left|\equiv RC\right|\equiv {U}_i\overset{H\left({r}_i\right)\kern0.5em }{\leftrightarrow }{S}_j $$

• According to S₄, H₆ and Rule(3), we have

$$ {S}_5:{S}_j\mid \equiv {U}_i\overset{H\left({r}_i\right)\ }{\leftrightarrow }{S}_j\kern1.5em \left(\mathbf{Goal}\ \mathbf{1}\right) $$

• According to M₃, we have

$$ {S}_6:{U}_i\vartriangleleft {\left({U}_i\overset{SK_s\kern0.5em }{\leftrightarrow }{S}_j,X,Y,{t}_3\right)}_{H\left({r}_i\right)} $$

• According to S₆, H₄ and Rule(1), we have

$$ {S}_7:{U}_i\left|\equiv {S}_j\right|\sim \left({U}_i\overset{SK_s\kern0.5em }{\leftrightarrow }{S}_j,X,Y,{t}_3\right) $$

• According to H₁, Rule(4), S₇ and Rule(2), we have

$$ {S}_8:{U}_i\left|\equiv {S}_j\right|\equiv \left({U}_i\overset{SK_s\ }{\leftrightarrow }{S}_j,X,Y,{t}_3\right) $$

• According to S₈, we have

$$ {\mathrm{S}}_9:{U}_i\left|\equiv {S}_j\right|\equiv {U}_i\overset{SK_s\kern0.5em }{\leftrightarrow }{S}_j\kern0.75em \left(\mathbf{Goal}\ \mathbf{2}\right) $$

• According to H₇, S₉ and Rule(3), we have

$$ {\mathrm{S}}_{10}:{U}_i\mid \equiv {U}_i\overset{SK_s\kern0.5em }{\leftrightarrow }{S}_j\kern0.75em \left(\mathbf{Goal}\ \mathbf{3}\right) $$

• According to M₄, we have

$$ {S}_{11}:{S}_j\vartriangleleft {\left({U}_i\overset{SK_i\ }{\leftrightarrow }{S}_j,Y\right)}_{H\left({r}_i\right)} $$

• According to S₅, S₁₁ and Rule(1), we have

$$ {S}_{12}:{S}_j\left|\equiv {U}_i\right|\sim \left({U}_i\overset{SK_i\ }{\leftrightarrow }{S}_j,Y\right) $$

• According to H₂, Rule(4), S₁₂ and Rule(2), we have

$$ {S}_{13}:{S}_j\left|\equiv {U}_i\right|\equiv \left({U}_i\overset{SK_i\kern0.5em }{\leftrightarrow }{S}_j,Y\right) $$

• According to S₁₃, we have

$$ {S}_{14}:{S}_j\left|\equiv {U}_i\right|\equiv {U}_i\overset{SK_i\ }{\leftrightarrow }{S}_j\kern0.5em \left(\mathbf{Goal}\ \mathbf{4}\right) $$

• According to H₈, S₁₄ and Rule(3), we have

$$ {S}_{15}:{S}_j\mid \equiv {U}_i\overset{SK_i\ }{\leftrightarrow }{S}_j\kern0.75em \left(\mathbf{Goal}\ \mathbf{5}\right) $$

5 Security analysis

This section demonstrates how our scheme accomplishes perfect security requirements and resists all well known attacks in the heuristic way. Detailed analysis is as follows.

5.1 Perfect forward secrecy

The negotiated session key is SK = h(ID_i‖SID_j‖H(r_i)‖X‖Y‖Z) in our scheme, where X = α ∙ G, Y = β ∙ G, Z = αβ ∙ G, α and β are randomly generated in every session by U_i and S_j respectively. If an adversary A tries to derive α and β by X = α ∙ G and Y = β ∙ G, then A has to resolve the ECDLP, which is well-known impossible. Meanwhile, the session key SK is obviously independent of the system private key x, so even if x is leaked to A, he/she cannot get any information about the former established session keys. Thus, our scheme provides perfect forward secrecy.

5.2 User anonymity

In our scheme, U_i’s original identity ID_i together with other parameters are first encrypted by k and transmitted to RC, where k = h(K) and K = α ∙ P_pub are dynamic for that α is randomly generated in every session. Then, the ID_i is encrypted by RC with the shared secret key k_j = h(SID_j‖x‖r_j) between RC and S_j, and the cipher text is transmitted to S_j. For an adversary A, if he/she wants to derive ID_i, then he/she has to get K or k_j, which further requires him/her to get the system private key x or solve the ECDLP (X = α ∙ G) to obtain α. Obviously, that is impossible. So, our scheme preserves user anonymity.

5.3 Impersonation attack

In our scheme, a patient U_i must be first authenticated by RC before accessing to S_j, so if an adversary A wants to impersonate U_i, he/she has to pass the verification test performed by RC. Thus, A must try to compute r_i = h(ID_i‖x), which requires A to obtain U_i’s ID_i and the system private key x at the same time. Obviously, that is impossible. Another way to deceive RC is to obtain U_i’s ID_i, pw_i, biometrics B_i, and smart-card SC_i simultaneously, which is also obviously impossible. Analogously, for an illegal S_j, without the secret k_j, it cannot get the parameter $H\left({r}_i^{\prime}\right)$, and thus it cannot forge the valid message ${V}_j=H\left({SK}_s\left\Vert H\left({r}_i^{\prime}\right)\right\Vert X\left\Vert Y\right\Vert {t}_3\right)$ to deceive U_i. So, the impersonation attack is infeasible in our scheme.

5.4 Replay attack

A legal user U_i’s previous login message {c₁,X,t₁} may be intercepted by an adversary A, then A may try to replay the old message to RC, but RC will reject A for ${\mathrm{t}}_1^{\prime }-{t}_1>\Delta t$ will hold. Further, A may modify the timestamp t₁ to satisfy the condition ${t}_1^{\prime }-{t}_1<\Delta t$, but RC will also reject A for the validation equation ${H}^{\prime}\left({r}_i\left\Vert X\right\Vert {t}_1\right)?=H\left({r}_i^{\prime}\left\Vert X\right\Vert {t}_1\right)$ embedded with the original timestamp t₁. If t₁ is modified, ${H}^{\prime}\left({r}_i\left\Vert X\right\Vert {t}_1\right)\ne H\left({r}_i^{\prime}\left\Vert X\right\Vert {t}_1\right)$ will hold, then RC will reject A. Analogously, A cannot replay the old messages exchanged between RC/U_i and S_j to deceive the participants. So, the replay attack is infeasible in our scheme.

5.5 Man-in-the-middle attack

For an adversary A to perform the man-in-the-middle attack, he/she needs to establish independent connections with the legal participants and replay messages between them, making them mistaken that they are talking directly to each other. Thus, A needs to successfully deceive U_i and S_j at the same time, which further requires A to obtain H(r_i) = H(h(ID_i‖x)) or k_j = h(SID_j‖x‖r_j), and then A has to get the system private key x, which is obviously impossible. So, the man-in-the-middle attack is infeasible in our scheme.

5.6 Stolen-verifier attack

In our scheme, RC just stores h(ID_i) which is useless to an adversary A, moreover, RC and S_j don’t store U_i’s pw_i and biometrics B_i at all. Thus, even if A breaks into RC or S_j, there are no useful authentication credentials for him/her to steal. So, the stolen-verifier attack is infeasible in our scheme.

5.7 Privileged insider attack

In our scheme, U_i’s password pw_i and biometrics B_i never leave the user side, and only in the registration phase does U_i send MP_i = h(pw_i‖σ_i) to RC, which is embedded with his/her password pw_i. It is obvious that the password pw_i is protected by one-way hash function with the random string σ_i derived by (σ_i, θ_i) = Gen(B_i). Thus, it is impossible for an insider to get U_i’s password pw_i and biometrics B_i throughout our scheme. So, the privileged insider attack is infeasible in our scheme.

5.8 Denial of service attack

In our scheme, before launching the login message, the legality of a user U_i is first verified by the smart-card SC_i by checking whether ${v}_i=H\left({ID}_i\left\Vert {r}_i\right\Vert {MP}_i^{\prime}\right)$ holds, where ${r}_i={k}_i\oplus {MP}_i^{\prime }$, ${MP}_i^{\prime }=h\left({pw}_i\Big\Vert {\sigma}_i\right)$, σ_i = Rep(B_i, θ_i). If not, SC_i will directly reject U_i. In other words, only when U_i is first authenticated by SC_i locally, the login message is sent to RC. Besides, there is no information needed to be synchronized for SC_i, S_j and RC in each session. So, the denial of service attack is infeasible in our scheme.

5.9 Offline password guessing attack

Suppose that an adversary A has got U_i’s smart-card SC_i by some means, and extracted the stored parameters k_i, v_i and θ_i from SC_i by side-channel attacks, then, to guess U_i’s password pw_i by the equation v_i = H(ID_i‖r_i‖MP_i), where MP_i = h(pw_i‖σ_i), A has to obtain U_i’s biometrics B_i to compute σ_i by σ_i = Rep(B_i, θ_i), which is almost impossible. So, the offline password guessing attack is infeasible in our scheme.

6 Performance evaluation

We’ve chosen the recent biometrics based authentication schemes [1, 10] for comparison since they have the same technology backgrounds with our scheme, i.e. all are biometrics based using ECC as the cryptographic foundation. Moreover both the schemes were designed for generic multi-server environments rather than a specific application environment, which are consistent with ours from the design goal. So, this section compares our proposed scheme with them in security, computation and communication costs aspects. Table 2 shows these schemes’ abilities to resist the identified attacks, which signifies the robustness of our proposed scheme over the others. To conveniently evaluate our scheme with other relevant schemes in the aspects of computation and communication costs, we assume that the length of identity, timestamp, hash digest and an elliptic curve point are 64, 64, 160 and 320 bits respectively, and use the following notations to depict time complexities of different operations:

• T_m: the time for executing elliptic curve scalar point multiplication

• T_s: the time for executing symmetric encryption/decryption operation

• T_h: the time for executing hash function

• T_G: the time for executing the fuzzy extractor operation Gen

Table 2 Security comparison

According to the experimental results of Kilinc and Yanik [14], T_m, T_s and T_h approximately take 2.226, 0.0046 and 0.0023 ms respectively. And we here assume that the time complexity of Gen(∙) is the same with the elliptic curve scalar point multiplication. Then, the detailed comparison of the computation and communication costs of registration phase and authentication with key agreement (AKA) phase between our scheme and the others are demonstrated in Tables 3 and 4. According to Table 3, we can see that the computation and communication costs of registration phase are almost the same in all schemes. According to Table 4, our proposed scheme consumes the lowest computation cost of 13.411 ms and communication cost of 1408 bits in the AKA phase, while the scheme [10] bears the average computation cost of 17.856 ms and communication cost of 3520 bits, and the scheme [1] bears the average computation cost of 24.546 ms and communication cost of 1792 bits. So, in the light of the fact demonstrated in Tables 2, 3 and 4, it can be concluded that our new scheme has advantages over the others, whether in terms of security and functionalities or computation and communication costs.

Table 3 Computation and communication costs comparison of the registration phase

Table 4 Computation and communication costs comparison of the AKA phase

7 Conclusions

This work presents our biometrics-based mutual authentication with session key agreement scheme for multi-server environment. The security analysis demonstrates that our scheme has perfect security features and can resist various known attacks. The performance evaluation shows that our new scheme is more efficient in the aspects of computation cost and communication cost, for the RC no longer participates in the subsequent user-server session key negotiation processes after it authenticates the user, and thus reducing the computation and communication costs. Hence, it can be said that our new scheme is a more suitable authentication key exchange protocol for multi-server environment.