A Provably Secure Anonymous Two-Factor Authenticated Key Exchange Protocol for Cloud Computing

• Autorzy: Wei F. , Zhang R. , Ma C

Identyfikatory

DOI

10.3233/FI-2018-1626

• Języki publikacji: EN

Abstrakty

EN

Two-factor authenticated key exchange (TFAKE) protocols are critical tools for ensuring identity authentication and secure data transmission for cloud computing. Until now, numerous TFAKE protocols based on smart cards and passwords are proposed under this circumstance. Unfortunately, most of them are found insecure against various attacks. Researchers focus on cryptanalysis of these protocols and then fixing the loopholes. Little attention has been paid to design rationales and formal security models of these protocols. In this paper, we summarize the security requirements and put forward a formal security model for TFAKE protocols for cloud computing. We then present an efficient TFAKE protocol without using expensive asymmetric cryptology mechanisms to achieve high efficiency. Our protocol can be proven secure in the random oracle model and achieves user anonymity. Compared with other TFAKE protocols, our protocol is more efficient and enjoys provable security.

Słowa kluczowe

EN

cloud computing; password; provable security; smart card; two-factor authenticated key exchange

• Wydawca: IOS Press
• Czasopismo: Fundamenta Informaticae
• Rocznik: 2018
• Tom: Vol. 157, nr 1/2
• Strony: 201--220
• Opis fizyczny: Bibliogr. 36 poz., rys., tab.

Twórcy

autor

Wei F.

• State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou, China

autor

Zhang R.

• State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou, China

autor

Ma C

• Department of Basic Courses, Army Aviation Institute, Beijing, China

Bibliografia

• [1] Shen J, Liu D, Shen J, Liu Q, Sun X. A secure cloud-assisted urban data sharing framework for ubiquitouscities, Pervasive and Mobile Computing, 2017. DOI: 10.1016/j.pmcj.2017.03.013.
• [2] Shen J, Shen J, Chen X, Huang X, Susilo W. An efficient public auditing protocol with novel dynamic structure for cloud data, IEEE Transactions on Information Forensics and Security, 2017. DOI:10.1109/TIFS.2017.2705620.
• [3] Fu Z, Wu X, Guan C, Sun X, Ren K. Toward efficient multi-keyword fuzzy search over encrypted outsourced data with accuracy improvement, IEEE Transactions on Information Forensics and Security, 2016;11(12):2706-2716. DOI: 10.1109/TIFS.2016.2596138.
• [4] Fu Z, Huang F, Ren K, Weng J, Wang C. Privacy-preserving smart semantic search based on conceptual graphs over encrypted outsourced data, IEEE Transactions on Information Forensics and Security, 2017;12(8):1874-1884. DOI: 10.1109/TIFS.2017.2692728.
• [5] Xia Z, Wang X, Sun X, Wang Q. A secure and dynamic multi-keyword ranked search scheme over encrypted cloud data, IEEE Transactions on Parallel and Distributed Systems, 2016;27(2):340-352. DOI:10.1109/TPDS.2015.2401003.
• [6] Liu Q, Cai W, Shen J, Fu Z, Liu X, Linge N. A speculative approach to spatial-temporal efficiency with multi-objective optimization in a heterogeneous cloud environment, Security and Communication Networks, 2016;9(17):4002-4012. DOI: 10.1002/sec.1582.
• [7] Liu Y, Cheng C, Cao J, Jiang T. An improved authenticated group key transfer protocol based on secret sharing, IEEE Transactions on computers, 2016;62(11):2335-2336. DOI: 10.1109/TC.2012.216.
• [8] He, D., & Wang, D.: Robust biometrics-based authentication scheme for multiserver environment, IEEE Systems Journal, 2015;9(3):816-823. DOI: 10.1109/JSYST.2014.2301517.
• [9] Liu, Y., Cheng, C., Gu, T., Jiang, T., Li, X.: A lightweight authenticated communication scheme for smart grid, IEEE Sensors Journal, 16(3), 2016, 836-842. DOI: 10.1109/JSEN.2015.2489258.
• [10] He D, Kumar N, and Chilamkurti N. A secure temporal-credential-based mutual authentication and key agreement scheme with pseudo identity for wireless sensor networks, Information Sciences, 2015;321:263-277. DOI: 10.1016/j.ins.2015.02.010.
• [11] Liu Y, Zhong Q, Chang L, Xia Z, He D, Cheng C. A secure data backup scheme using multi-factor authentication, IET Information Security, 2017;11(5):250-255. DOI: 10.1049/iet-ifs.2016.0103. Online ISSN 1751-8717.
• [12] Jiang Q, Wei F, Fu S, Ma J, Li G, Alelaiwi A. Robust extended chaotic maps-based three-factor authentication scheme preserving biometric template privacy, Nonlinear Dynamics, 2016;83(4):2085-2101. URL https://doi.org/10.1007/s11071-015-2467-5.
• [13] Jiang Q, Khan MK, Lu X, Ma J, He D. A privacy preserving three-factor authentication protocol for e-Health clouds, The Journal of Supercomputing, 2016;72(10):3826-3849. URL https://doi.org/10.1007/s11227-015-1610-x.
• [14] Shen J, Tan HW, Wang J, Wang JW, Lee SY. A novel routing protocol providing good transmission reliability in underwater sensor networks, Journal of Internet Technology, 2015;16(1):171-178. DOI:10.6138/JIT.2014.16.1.20131203e.
• [15] Jiang Q, Ma J, Wei F. On the security of a privacy-aware authentication scheme for distributed mobile cloud computing services, IEEE Systems Journal, 2016;99:1-4. DOI: 10.1109/JSYST.2016.2574719.
• [16] He D, Kumar N, Wang H, Wang L, Choo KKR, Vinel A. A provably-secure cross-domain handshake scheme with symptoms-matching for mobile healthcare social network, IEEE Transactions on Dependable and Secure Computing, 2016;PP(99). DOI: 10.1109/TDSC.2016.2596286.
• [17] Das ML. Two-factor user authentication in wireless sensor networks, IEEE Transactions on Wireless Communications, 2009;8(3):1086-1090. DOI: 10.1109/TWC.2008.080128.
• [18] Nyang D, Lee MK. Improvement of Das’s two-factor authentication protocol in wireless sensor networks. IACR Cryptology ePrint Archive, 2009, 631. URL http://eprint.iacr.org/2009/631.pdf.
• [19] Chen TH, Shih WK. A robust mutual authentication protocol for wireless sensor networks, ETRI journal, 2010;32(5):704-712. URL http://dx.doi.org/10.4218/etrij.10.1510.0134.
• [20] He D, Gao Y, Chan S, Chen C, Bu J. An enhanced two-factor user authentication scheme in wireless sensor networks, Ad hoc & sensor wireless networks, 2010;10(4):361-371.
• [21] Khan MK, Alghathbar K. Cryptanalysis and security improvements of two-factor user authentication in wireless sensor networks, Sensors, 2010;10(3):2450-2459. DOI: 10.3390/s100302450.
• [22] Sun DZ, Li JX, Feng ZY, Cao ZF, Xu GQ. On the security and improvement of a two-factor user authentication scheme in wireless sensor networks, Personal and ubiquitous computing, 2013;17(5):895-905. URL https://doi.org/10.1007/s00779-012-0540-3.
• [23] Bellare M, Rogaway P. Entity authentication and key distribution. In Crypto 1993, LNCS 773, pp. 232-249.
• [24] Ma, T., Zhang, Y., Cao, J., Shen, J., Tang, M., Tian, Y., Al-Rodhaan, M. K.: A k-degree anonymity with Vertex and Edge Modification algorithm, Computing, 70, 2015, 1336-1344. DOI: 10.1007/s00607-015-0453-x.
• [25] Yuan JJ. An enhanced two-factor user authentication in wireless sensor networks, Telecommunication Systems, 2014;55(1):105-113. URL https://doi.org/10.1007/s11235-013-9755-5.
• [26] Gong L, Needham R, Yahalom R. Reasoning about belief in cryptographic protocols. IEEE Computer Society Symposium on Research in Security and Privacy, 1990, pp. 234-248. DOI:10.1109/RISP.1990.63854.
• [27] Wei F, Ma J, Jiang Q, Shen J, Ma C. Cryptanalysis and improvement of an enhanced two-factor user authentication scheme in wireless sensor networks, Information Technology And Control, 2016;45(1)62-70. URL http://dx.doi.org/10.5755/j01.itc.45.1.11949.
• [28] Shen J, Chang S, Shen J, Liu Q, Sun X. A lightweight multi-layer authentication protocol for wireless body area networks, Future Generation Computer Systems, 2018;78(3):956-963. DOI:10.1016/j.future.2016.11.033.
• [29] Yuan C, Sun X, Lv R. Fingerprint liveness detection based on multi-scale LPQ and PCA, China Communications, 2016;13(7):60-65. DOI: 10.1109/CC.2016.7559076.
• [30] Nam J, Kim M, Paik J, Lee Y, Won D. A provably-secure ECC-based authentication scheme for wireless sensor networks, Sensors, 2014;14(11):21023-21044. DOI: 10.3390/s141121023.
• [31] Pointcheval D, and Zimmer S. Multi-factor authenticated key exchange. Lecture Notes in Computer Science, 5037, 2008, pp. 277-295.
• [32] Bellare M, Pointcheval D, Rogaway P. Authenticated key exchange secure against dictionary attacks, In Advances in Cryptology EUROCRYPT, LNCS 1807, 2000, pp. 139-155. URL https://doi.org/10.1007/3-540-45539-6_11.
• [33] Alsaleh M, Mannan M, and van Oorschot PC. Revisiting defenses against large-scale online password guessing attacks, IEEE Transactions on dependable and secure computing, 2012;9(1):128-141. DOI:10.1109/TDSC.2011.24.
• [34] Wang D, He D, Wang P, and Chu CH. Anonymous two-factor authentication in distributed systems: certain goals are beyond attainment, IEEE Transactions on Dependable and Secure Computing, 2015;12(4):428-442. DOI: 10.1109/TDSC.2014.2355850.
• [35] Wang D, Wang P. On the implications of Zipf’s law in passwords, In European Symposium on Research in Computer Security, ESORICS 2016, LNCS 9878, 2016, pp. 111-131. URL https://doi.org/10.1007/978-3-319-45744-4_6.
• [36] Hoang VT, Krovetz T, Rogaway P. Robust authenticated-encryption AEZ and the problem that it solves, In Annual International Conference on the Theory and Applications of Cryptographic Techniques, EUROCRYPT 2015, LNCS 9056, 2015, pp. 15-44. URL https://doi.org/10.1007/978-3-662-46800-5_2.

Uwagi

Opracowanie rekordu w ramach umowy 509/P-DUN/2018 ze środków MNiSW przeznaczonych na działalność upowszechniającą naukę (2018).