Secure and Efficient Anonymous Authentication Scheme in Global Mobility Networks

Abstract

In 2012, Mun et al. pointed out that Wu et al.’s scheme failed to achieve user anonymity and perfect forward secrecy and disclosed the passwords of legitimate users. And they proposed a new enhancement for anonymous authentication scheme. However, their proposed scheme has vulnerabilities that are susceptible to replay attack and man-in-the-middle attack. It also incurs a high overhead in the database. In this paper, we examine the vulnerabilities in the existing schemes and the computational overhead incurred in the database. We then propose a secure and efficient anonymous authentication scheme for roaming service in global mobility network. Our proposed scheme is secure against various attacks, provides mutual authentication and session key establishment, and incurs less computational overhead in the database than Mun et al.'s scheme.

1. Introduction

Global mobility network (GLOMONET) provides global roaming services for mobile user between the home agent and the foreign agent. The GLOMONET must have a user authentication scheme in which the mobile user has secure access to the foreign agent. A strong user authentication scheme in GLOMONET should satisfy the following requirements: (1) user anonymity, (2) low communication cost and computation complexity, (3) single registration, (4) update session key periodically, (5) user friendly, (6) password/verifier table, (7) update password securely and freely, (8) prevention of fraud, (9) prevention of replay attack, (10) security, and (11) providing the authentication scheme when a user is located in the home network [1, 2].

Many user authentication schemes for use in GLOMONET have been proposed [1–18]. In 2004, Zhu and Ma [4] proposed a simple, efficient wireless authentication scheme that provides user anonymity for wireless environments. However, Lee et al. [5] subsequently pointed out that Zhu et al.’s scheme does not achieve mutual authentication and perfect backward secrecy, and therefore cannot protect against forgery attacks. They then proposed a slight modification of Zhu et al.’s scheme. Unfortunately, Wu et al. [6] demonstrated that Lee et al.’s proposed scheme still failed to provide anonymity and perfect backward secrecy. Consequently, they proposed an improvement to overcome the weakness identified in Lee et al.’s scheme. In 2009, Zeng et al. [7] showed that Wu et al.’s scheme also fails to provide anonymity. In 2012, Mun et al. [12] showed that Wu et al.’s scheme discloses the password of legitimate users and does not achieve perfect forward secrecy. They subsequently proposed a new enhancement for anonymous authentication to overcome these security weaknesses. However, their scheme is vulnerable to replay attack and man-in-the-middle attack, and incurs a high overhead in the database of the home agent.

Therefore, in this paper, we analyze the existing schemes [5, 6, 12] and show that it is vulnerable to security requirement. And we propose a secure and efficient anonymous authentication scheme that is resistant to replay attack and man-in-the-middle attack. Our proposed scheme also incurs less computational overhead in the database than Mun et al.’s scheme.

The remainder of this paper is organized as follows. In Section 2, we review the existing schemes, while in Section 3, we investigate the security vulnerabilities mentioned above. In Section 4, we present our proposed secure and efficient anonymous authentication scheme. This scheme is analyzed and compared with other schemes in Section 5. Finally, Section 6 presents our conclusions.

2. Review of the Previous Schemes

In this section, we examine variety of authentication schemes with anonymity proposed by Lee et al. [5], Wu et al. [6], and Mun et al. [12].

2.1. Lee et al.’s Scheme

Figure 1 shows the procedure of Lee et al.’s scheme. Their scheme comprises three phases: an initial phase, a first phase, and a second phase.

Figure 1 

Procedure of Lee et al.’s scheme.

2.1.1. Initial Phase

When a new mobile user MU wants to register with a home agent HA, he/she performs the following steps.

Step  1. Consider MU→HA∶{ID_MU}.

MU sends his/her identifier ID_MU to HA for registration.

Step  2. HA computes PW_MU=ℎ(𝑁‖ID_MU) and 𝑟=ℎ(𝑁‖ID_HA)⊕ℎ(𝑁‖ID_MU)⊕ID_HA⊕ID_MU, where 𝑁 is a long random number kept by HA.

Step  3. Consider HA→MU∶{PW_MU,smartcard[ID_HA,𝑟,ℎ(⋅)]}.

HA delivers PW_MU and a smart card containing [ID_HA,𝑟,ℎ(⋅)] to MU through a secure channel.

2.1.2. First Phase

In this phase, FA authenticates MU and issues a temporary certificate to MU, which will be used in the second phase when MU always communicates this FA within this area. MU performs the following steps.

Step  1. Consider MU→FA∶{𝑛,𝑐₁,ID_HA,𝑇_MU}.

MU computes 𝑛=𝑟⊕ℎ(𝑁‖ID_MU) and temporary key 𝐿=ℎ(𝑇_MU⊕PW_MU), and encrypts 𝑐₁=(ℎ(ID_MU)‖‖𝑥₀‖𝑥)_𝐿 using symmetric key 𝐿, where 𝑥₀ and 𝑥 are secret random numbers. And, MU sends 𝑛, 𝑐₁, ID_HA, and 𝑇_MU to FA.

Step  2. Consider FA→HA∶{𝑎,𝑛,𝑐₁,𝑇_MU,𝑐₂,Cert_FA,𝑇_FA}.

If timestamp is valid, FA generates a secret random number 𝑎 and computes signature 𝑐₂=𝐸_KRFA(ℎ(𝑎,𝑛,𝑐₁,𝑇_MU,Cert_FA)) using private key KR_FA. And, FA sends 𝑎, 𝑛, 𝑐₁, 𝑇_MU, 𝑐₂, Cert_FA, and 𝑇_FA to HA.

Step  3. Consider HA→FA∶{𝑏,𝑐₃,𝑐₄,Cert_HA,𝑇_HA}.

If certificate and timestamp are valid, HA computes 𝐿=ℎ(𝑇_MU⊕PW_MU) and 𝐻=ℎ(ID_HA), and decrypts (ℎ(ID_MU)‖𝑥₀‖𝑥)_𝐿 using symmetric key 𝐿. If ℎ(ID_HA) is identical to 𝐻, HA authenticates MU. And, HA encrypts 𝑐₃=𝐸_KUFA(ℎ(ID_MU)‖𝑥₀‖𝑥) using public key KU_FA and computes signature 𝑐₄=𝐸_KRHA(ℎ(𝑎,𝑏,𝑐₃,Cert_HA)) using private key KR_HA. HA then sends 𝑏, 𝑐₃, 𝑐₄, Cert_HA, and 𝑇_HA to FA.

Step  4. Consider FA→MU∶{𝑐₅}.

If certificate and timestamp are valid, FA issues the temporary certificate 𝑇Cert_MU and decrypts 𝐸_KUFA(ℎ(ID_MU)‖𝑥₀‖𝑥) using private key KR_FA. And, FA computes ℎ(𝑥₀‖𝑥) and session key 𝑘=ℎ(ID_MU‖𝑥)⊕𝑥₀ and encrypts 𝑐₅=(𝑇Cert_MU‖ℎ(𝑥₀‖𝑥))_𝑘 using symmetric key 𝑘. FA then sends 𝑐₅ to MU.

Step  5. MU computes 𝑀=ℎ(𝑥₀‖𝑥) and session key 𝑘=ℎ(ID_MU‖𝑥)⊕𝑥₀ and decrypts (𝑇Cert_MU‖ℎ(𝑥₀‖𝑥))_𝑘 using symmetric key 𝑘. If is identical to 𝑀, MU authenticates FA.

2.1.3. Second Phase

In this phase, MU visits FA at 𝑖th session when he/she is always within this FA. MU performs the following steps.

Step  1. Consider MU→FA∶{𝑇Cert_MU,𝑐₆}.

MU encrypts 𝑐₆=(𝑥_𝑖‖𝑇Cert_MU‖OtherInfomation)_𝑘𝑖 using symmetric key 𝑘_𝑖, where 𝑘_𝑖=ℎ(ID_MU‖𝑥)⊕𝑥_𝑖−1, for 𝑖=1,2,…,𝑛. And, MU sends 𝑇Cert_MU and 𝑐₆ to FA.

Step  2. If 𝑇Cert_MU is valid, FA decrypts (𝑥_𝑖‖𝑇Cert_MU‖OtherInfomation)_𝑘𝑖 using symmetric key 𝑘_𝑖. If received 𝑇Cert_MU if identical to obtained 𝑇Cert_MU, FA authenticates MU.

2.2. Wu et al.’s Scheme

Figure 2 shows the first and second phase of Wu et al.’s scheme. Their scheme comprises three phases: an initial phase, a first phase, and a second phase. The initial phase is the same as the initial phase of Lee et al.’s scheme.

Figure 2 

First and second phase of Wu et al.’s scheme.

2.2.1. First Phase

In this phase, FA authenticates MU and issues a temporary certificate to MU, which will be used in the second phase when MU always communicates this FA within this area. MU performs the following steps.

Step  1. Consider MU→FA∶{𝑛,𝑐₁,ID_HA,𝑇_MU}.

MU computes 𝑛=𝑟⊕ℎ(𝑁‖ID_MU) and temporary key 𝐿=ℎ(𝑇_MU⊕PW_MU), and encrypts 𝑐₁=(ℎ(ID_MU)‖‖𝑥₀‖𝑥)_𝐿 using symmetric key 𝐿, where 𝑥₀ and 𝑥 are secret random numbers. And, MU sends 𝑛, 𝑐₁, ID_HA, and 𝑇_MU to FA.

Step  2. Consider FA→HA∶{𝑎,𝑛,𝑐₁,𝑇_MU,𝑐₂,Cert_FA,𝑇_FA}.

If timestamp is valid, FA generates a secret random number 𝑎 and computes signature 𝑐₂=𝐸_KRFA(ℎ(𝑎,𝑛,𝑐₁,𝑇_MU,Cert_FA)) using private key KR_FA. And, FA sends 𝑎, 𝑛, 𝑐₁, 𝑇_MU, 𝑐₂, Cert_FA, and 𝑇_FA to HA.

Step  3. Consider HA→FA∶{𝑏,𝑐₃,𝑐₄,Cert_HA,𝑇_HA}.

If certificate and timestamp are valid, HA computes 𝐿=ℎ(𝑇_MU⊕PW_MU) and 𝐻=ℎ(ID_HA), and decrypts (ℎ(ID_MU)‖𝑥₀‖𝑥)_𝐿 using symmetric key 𝐿. If ℎ(ID_HA) is identical to 𝐻, HA authenticates MU. And, HA encrypts 𝑐₃=𝐸_KUFA(ℎ(ℎ(𝑁‖ID_MU))‖𝑥₀‖𝑥) using public key KU_FA and computes signature 𝑐₄=𝐸_KRHA(ℎ(𝑎,𝑏,𝑐₃,Cert_HA)) using private key KR_HA. HA then sends 𝑏, 𝑐₃, 𝑐₄, Cert_HA, and 𝑇_HA to FA.

Step  4. Consider FA→MU∶{𝑐₅}.

If certificate and timestamp are valid, FA issues the temporary certificate 𝑇Cert_MU and decrypts 𝐸_KUFA(ℎ(ℎ(𝑁‖ID_MU))‖𝑥₀‖𝑥) using private key KR_FA. And, FA computes ℎ(𝑥₀‖𝑥) and session key 𝑘=ℎ(ℎ(ℎ(𝑁‖ID_MU))‖𝑥‖𝑥₀) and encrypts 𝑐₅=(𝑇Cert_MU‖ℎ(𝑥₀‖𝑥))_𝑘 using symmetric key 𝑘. FA then sends 𝑐₅ to MU.

Step  5. MU computes 𝑀=ℎ(𝑥₀‖𝑥) and session key 𝑘=ℎ(ℎ(ℎ(𝑁‖ID_MU))‖𝑥‖𝑥₀) and decrypts (𝑇Cert_MU‖ℎ(𝑥₀‖𝑥))_𝑘 using symmetric key 𝑘. If ℎ(𝑥₀‖𝑥) is identical to 𝑀, MU authenticates FA.

2.2.2. Second Phase

In this phase, MU visits FA at 𝑖th session when he/she is always within this FA. MU performs the following steps.

Step  1. Consider MU→FA∶{𝑇Cert_MU,𝑐₆}.

MU encrypts 𝑐₆=(𝑥_𝑖‖𝑇Cert_MU‖OtherInfomation)_𝑘𝑖 using symmetric key 𝑘_𝑖, where 𝑘_𝑖=ℎ(ℎ(ℎ(𝑁‖ID_MU))‖𝑥‖𝑥_𝑖−1), for 𝑖=1,2,…,𝑛. And, MU sends 𝑇Cert_MU and 𝑐₆ to FA.

Step  2. If 𝑐₆ is valid, FA decrypts (𝑥_𝑖‖𝑇Cert_MU‖OtherInfomation)_𝑘𝑖 using symmetric key 𝑘_𝑖. If received 𝑇Cert_MU if identical to obtained 𝑇Cert_MU, FA authenticates MU.

2.3. Mun et al.’s Scheme

Their scheme comprises three phases: a registration phase, an authentication phase, and an update phase.

2.3.1. First Phase

Figure 3 shows the procedure of the first phase. When a new MU, wants to register with HA, he/she performs the following steps.

Figure 3 

First phase of Mun et al.’s scheme.

Step  1. Consider MU→HA∶{ID_MU,𝑁_MU}.

MU sends his/her identifier ID_MU and nonce 𝑁_MU to HA for registration.

Step  2. HA generates nonce 𝑁_HA and computes PW_MU=ℎ(𝑁_MU‖𝑁_HA) and 𝑟_MU=ℎ(ID_MU‖PW_MU)⊕ID_HA.

Step  3. Consider HA→MU∶{𝑟_MU,ID_HA,𝑁_HA,PW_MU,ℎ(⋅)}.

HA sends 𝑟_MU, ID_HA, 𝑁_HA, PW_MU, and ℎ(⋅) to MU through a secure channel.

2.3.2. Second Phase

Figure 4 shows the procedure of the second phase. In this phase, for mutual authentication between MU and HA and between MU and a foreign agent FA, the following steps are performed.

Figure 4 

Second phase of Mun et al.’s scheme.

Step  1. Consider MU→FA∶{ID_HA,𝑁_HA,𝑟_MU}.

MU accesses the new FA and sends ID_HA, 𝑁_HA, and 𝑟_MU to it.

Step  2. Consider FA→HA∶{ID_FA,𝑁_FA,𝑟_MU}.

FA stores the message received from MU for further communication and generates nonce 𝑁_FA. FA then sends ID_FA, 𝑁_FA, and 𝑟_MU to HA.

Step  3. Consider HA→FA∶{𝑆_HA,𝑃_HA}.

HA computes 𝑟^′_MU=ℎ(ID_MU‖PW_MU)⊕ID_HA and checks whether 𝑟^′_MU is identical to the received 𝑟_MU. If they are identical, HA authenticates MU. Next, HA computes 𝑃_HA=ℎ(PW_MU‖𝑁_FA) and 𝑆_HA=ℎ(ID_FA‖𝑁_FA)⊕𝑟_MU⊕𝑃_HA, and sends the computed 𝑆_HA and 𝑃_HA to FA.

Step  4. Consider FA→MU∶{𝑆_FA,𝑎𝑃,𝑃_FA}.

FA computes 𝑆^′_HA=ℎ(ID_FA‖𝑁_FA)⊕𝑟_MU⊕𝑃_HA and checks whether 𝑆^′_HA is identical to the received 𝑆_HA. FA then computes 𝑆_FA=ℎ(𝑆_HA‖𝑁_FA‖𝑁_HA), selects a random number 𝑎, and then computes 𝑎𝑃 on 𝐸 using the elliptic curve Diffie-Hellman (ECDH) protocol. Next, FA sends 𝑆_FA, 𝑎𝑃, and 𝑃_FA=(𝑆_HA‖ID_FA‖𝑁_FA) to MU.

Step  5. Consider MU→FA∶{𝑏𝑃,𝑆_MF}.

MU computes 𝑆^′_HA=ℎ(ID_FA‖𝑁_FA)⊕𝑟_MU⊕ℎ(PW_MU‖𝑁_FA) and 𝑆^′_FA=ℎ(𝑆^′_HA‖𝑁_FA‖𝑁_HA), and checks whether 𝑆^′_FA is identical to the received 𝑆_FA. If they are identical, MU authenticates HA and FA. After checking 𝑆_FA, MU selects a random number 𝑏 and computes 𝑏𝑃, a session key 𝐾_MF=ℎ(𝑎𝑏𝑃) using the received 𝑎𝑃 and the computed 𝑏𝑃, and 𝑆_MF=𝑓_𝐾MF(𝑁_FA‖𝑏𝑃). Next, MU sends the computed 𝑏𝑃 and 𝑆_MF to FA.

Step  6. FA computes 𝐾_MF=ℎ(𝑎𝑏𝑃) using private and public values, and 𝑆^′_MF=𝑓_𝐾MF(𝑁_FA‖𝑏𝑃). FA then checks whether 𝑆^′_MF is identical to the received 𝑆_MF. If they are identical, FA authenticates MU.

2.3.3. Third Phase

The procedure followed in the third phase is depicted in Figure 5. The steps are as follows.

Figure 5 

Third phase of Mun et al.’s scheme.

Step  1. Consider MU→FA∶{𝑏_𝑖𝑃}.

MU selects a new random number 𝑏_𝑖 and computes 𝑏_𝑖𝑃(𝑖=1,2,…,𝑛). MU then sends 𝑏_𝑖 and 𝑏_𝑖𝑃 to FA.

Step  2. Consider FA→MU∶{𝑎_𝑖𝑃,𝑆_MF𝑖}.

FA selects a new random number 𝑎_𝑖 and computes 𝑎_𝑖𝑃(𝑖=1,2,…,𝑛). It then computes a new session key 𝐾_MF𝑖=ℎ(𝑎_𝑖𝑏_𝑖𝑃) and 𝑆_MF𝑖=𝑓_𝐾MF𝑖(𝑎_𝑖𝑏_𝑖𝑃‖𝑎_𝑖−1𝑏_𝑖−1𝑃). Next, it sends 𝑎_𝑖𝑃 and 𝑆_MF𝑖 to MU.

Step  3. MU computes a session key 𝐾_MF𝑖=ℎ(𝑎_𝑖𝑏_𝑖𝑃), using the received 𝑎_𝑖𝑃, the computed 𝑏_𝑖𝑃, and 𝑆^′_MF𝑖=𝑓_𝐾MF𝑖(𝑎_𝑖𝑏_𝑖𝑃‖𝑎_𝑖−1𝑏_𝑖−1𝑃). MU then checks whether 𝑆^′_𝑀𝐹𝑖 is identical to the received 𝑆_MF𝑖. If they are identical, MU and FA use the new session key 𝐾_MF𝑖.

3. Vulnerabilities in the Previous Schemes

3.1. Vulnerability of Lee et al.’s and Wu et al.’s Scheme

Lee et al.’s and Wu et al.’s scheme are almost the same. Therefore, their schemes are also the same vulnerabilities. Their scheme is vulnerable replay attack, is disclosed password, and cannot achieve anonymity and perfect forward secrecy.

3.1.1. Anonymity

An adversary 𝐴 can eavesdrop on and record the message {𝑛,𝑐_1,ID_HA,𝑇_MU} transmitted from MU to FA, and can obtain MU’s ID_MU as follows.

Step  1. 𝐴 register as legitimate user to HA and obtain own PW_𝐴 and 𝑟. And, 𝐴 compute ℎ(𝑁‖ID_HA) using PW_𝐴, 𝑟, ID_HA, and ID_𝐴.

Step  2. 𝐴 eavesdrops on and records messages {𝑛,𝑐₁,ID_HA,𝑇_MU} transmitted from FA to MU.

Step  3. 𝐴 compute ID_MU using 𝑛, ℎ(𝑁‖ID_HA), and ID_HA.

Therefore, Lee et al.’s and Wu et al.’s scheme cannot achieve anonymity [7].

3.1.2. Replay Attack

Legitimate FA_𝑖 can record the message {𝑛,𝑐₁,ID_HA,𝑇_MU} transmitted from MU, and can then impersonate MU by using the recorded message {𝑛,𝑐_1,ID_HA,𝑇_MU} to another FA_𝑗 as follows.

Step  1. FA_𝑖 accesses another FA_𝑗 and sends recorded message {𝑛,𝑐₁,ID_HA,𝑇_MU} to this FA_𝑗. FA_𝑖 can replay this message within the lifetime of 𝑇_MU. After receiving this message, FA_𝑗 sends the message {𝑎,𝑛,𝑐₁,𝑇_MU,𝑐₂,Cert_FA,𝑇_FA} to HA.

Step  2. HA compute ℎ(ID_MU) and checks whether the computed ℎ(ID_MU) is identical to the received ℎ(ID_MU). If they are identical, HA authenticate FA_𝑖, then sends the message {𝑏,𝑐₃,𝑐₄,Cert_HA,𝑇_HA} to FA_𝑗.

Step  3. FA_𝑗 computes session key 𝑘 and sends the message {𝑐₅} to FA_𝑖. FA_𝑖 computes the session key 𝑘 between FA_𝑖 and MU, which is the same as the session key between FA_𝑖 and FA_𝑗. And, FA_𝑖 decrypts 𝑐₅ and authenticates FA_𝑗.

Therefore, Lee et al.’s and Wu et al.’s scheme is vulnerable to replay attack [11].

3.1.3. Disclosure Password

If an adversary 𝐴 can steel MU’s smart card, 𝐴 can obtain MU’s password PW_MU as follows.

Step  1. 𝐴 can record the message {𝑛,𝑐₁,ID_HA,𝑇_MU} transmitted from MU to FA. And, as described in Section 3.1.1, 𝐴 can obtain the message {ℎ(𝑁‖ID_HA),ID_HA,ID_MU}.

Step  2. 𝐴 stole MU’s smart card, inserts MU’ smart card into the device, and enters the fake password PW^∗=0. The smart card computes 𝑛^∗=𝑟⊕PW^∗=ℎ(𝑁‖ID_HA)⊕ℎ(𝑁‖ID_MU)⊕ID_HA⊕ID_MU and 𝐴 obtains 𝑛^∗ by eavesdropping.

Step  3. 𝐴 computes PW_MU using 𝑛^∗, ℎ(𝑁‖ID_HA), ID_HA, and ID_MU.

Therefore, Lee et al.’s and Wu et al.’s scheme are disclosed password [11].

3.1.4. Perfect Forward Secrecy

Assume that an adversary 𝐴 obtain MU’s password PW_MU. Failing to provide perfect forward secrecy is as follows.

Step  1. 𝐴 computes 𝐿 using 𝑇_MU and PW_MU and decrypts (ℎ(ID_MU)‖𝑥₀‖𝑥)_𝐿 using 𝐿. Thus, 𝐴 obtains 𝑥₀, 𝑥, and ℎ(ID_MU).

Step  2. 𝐴 computes session key 𝑘₁ using 𝑥₀, 𝑥, and PW_MU and decrypts (𝑥₁‖𝑇Cert_MU‖OtherInformation)_𝑘1 using 𝑘₁. Thus, 𝐴 obtains 𝑥₁.

Step  3. 𝐴 computes session key 𝑘₂ using 𝑥₁, 𝑥, and PW_MU.

Therefore, Lee et al.’s and Wu et al.’s scheme cannot achieve perfect forward secrecy [11].

3.2. Vulnerability of Mun et al.’s Scheme

Mun et al. claimed that their scheme can thwart a variety of known attacks. Unfortunately, we found that their scheme is vulnerable to replay attack and man-in-the-middle attack. In addition, their scheme incurs a high overhead in the database of the home agent.

3.2.1. Replay Attack

In Mun et al.’s scheme, an adversary 𝐴 can eavesdrop on and record the message {ID_HA,𝑁_HA,𝑟_MU} transmitted from MU to FA; and can then impersonate MU by using the recorded message {ID_HA,𝑁_HA,𝑟_MU} as follows.

Step  1. 𝐴 accesses a new FA and sends the recorded message {ID_HA,𝑁_HA,𝑟_MU} to this FA. After receiving this message, the FA sends the message {ID_FA,𝑁_FA,𝑟_MU} to HA.

Step  2. HA computes 𝑟^′_MU and checks whether 𝑟^′_MU is identical to the received 𝑟_MU. If they are identical, HA authenticates 𝐴, then computes 𝑃_HA and 𝑆_HA, and sends the message {𝑆_HA,𝑃_HA} to FA. On receiving this message, FA computes 𝑆^′_HA and checks whether 𝑆^′_HA is identical to the received 𝑆_HA. Next, FA sends the message {𝑆_FA,𝑎𝑃,𝑃_FA} to 𝐴.

Step  3. 𝐴 computes 𝑆^′_FA and checks whether 𝑆^′_FA is identical to the received 𝑆_FA. If they are identical, 𝐴 authenticates HA and FA, then computes 𝑏𝑃 and S_MF, and sends the message {𝑏𝑃,𝑆_MF} to FA. On receiving this message, FA computes 𝑆^′_MF and checks whether 𝑆^′_MF is identical to the received 𝑆_MF. If they are identical, FA authenticates 𝐴.

Therefore, Mun et al.’s scheme is vulnerable to replay attack [18].

3.2.2. Man-in-the-Middle Attack

In Mun et al.’s scheme, an adversary 𝐴 can eavesdrop on messages transmitted between 𝐹𝐴 and MU. Consequently, 𝐴 can also successfully mount a man-in-the-middle attack as follows.

Step  1. 𝐴 blocks and copies the message {𝑆_FA,𝑎𝑃,𝑃_FA} transmitted from FA to MU. It then selects a new random number 𝑎^′, computes 𝑎^′𝑃, replaces message {𝑆_FA,𝑎𝑃,𝑃_FA} with {𝑆_FA,𝑎^′𝑃,𝑃_FA}, and sends this to MU.

Step  2. MU computes 𝑆^′_HA and 𝑆^′_FA, and checks whether 𝑆^′_FA is identical to the received 𝑆_FA. After checking 𝑆_FA, MU selects a random number 𝑏 and computes 𝑏𝑃, a session key 𝐾_MF=ℎ(𝑎^′𝑏𝑃) using the received 𝑎^′𝑃, the computed 𝑏𝑃, and 𝑆_MF=𝑓_𝐾MF(𝑁_FA‖𝑏𝑃). Next, MU sends the message {𝑏𝑃,𝑆_MF} to FA.

Step  3. 𝐴 blocks and copies the message {𝑏𝑃,𝑆_𝑀𝐹} transmitted from MU to FA. It then selects a new random number 𝑏^′ and computes 𝑏^′𝑃, a session key 𝐾_MF=ℎ(𝑎𝑏^′𝑃) using the copied 𝑎𝑃 and the computed 𝑏^′𝑃, and 𝑆^′_MF=𝑓_𝐾MF(𝑁_FA‖𝑏^′𝑃). Next, 𝐴 replaces message {𝑏𝑃,𝑆_MF} with {𝑏^′𝑃,𝑆^′_MF} and sends this to FA.

Step  4. FA computes 𝐾_MF=ℎ(𝑎𝑏^′𝑃) using private and public values and 𝑆^′′_MF=𝑓_𝐾MF(𝑁_FA‖𝑏^′𝑃). It then checks whether 𝑆^′′_MF is identical to the value received for 𝑆^′_MF. If they are identical, FA authenticates MU. However, the session key between FA and MU is different.

Therefore, Mun et al.’s scheme is vulnerable to man-in-the-middle attack [18].

3.2.3. High Overhead

For authentication, MU sends message {ID_HA,𝑁_HA,𝑟_MU} to FA. After receiving this message, FA sends message {ID_FA,𝑁_FA,𝑟_MU} to HA. In order to authenticate MU, HA computes 𝑟^′_MU=ℎ(ID_MU‖PW_MU)⊕ID_HA. To compute 𝑟_MU for MU, HA must find ID_MU and PW_MU in its own database to compute the authentication message. However, HA incurs a high overhead because of the difficulty of finding ID_MU and PW_MU in the authentication message. In addition, HA incurs computational cost because of the one-way hash function and exclusive OR operation used to compute the authentication message. In other words, HA computes the authentication message using ID_MU and PW_MU in its own database, and incurs a high overhead because it has to compare it with the received authentication message.

4. Our Proposed Scheme

In this section, we propose a secure and efficient anonymous authentication scheme for roaming services in GLOMONETs. This scheme consists of three phases: a registration phase, an authentication and key establishment phase, and an update session key phase.

4.1. Notation

Table 1 shows the notation used to describe our proposed scheme.

Table 1 

Notation used in our proposed scheme.

4.2. Registration Phase

Figure 6 illustrates the procedure of the registration phase. When a new MU wants to register with HA, he/she performs the following steps.

Figure 6 

Registration phase of our proposed scheme.

Step  R1. Consider MU→HA∶{ID_MU,𝑁_MU}.

MU selects the identity ID_MU and a random nonce 𝑁_MU, and sends ID_MU and 𝑁_MU to HA for registration.

Step  R2. Consider HA→MU∶{Smartcard[ID_MU,ID_HA,𝐾,𝑁,ℎ(𝑥),ℎ(⋅)]}.

After receiving the registration message from MU, HA selects a random nonce 𝑁_HA and computes the following: A=ℎ𝑥‖𝑦⊕ℎ𝑥‖ID_MU,𝐵=ℎℎ𝑥‖ID_MU‖ℎ𝑥‖𝑦,PW_MU=ℎ𝐵‖𝑁_HA,𝐾=ℎ𝑥‖ID_MU⊕ℎPW_MU‖𝑁_MU. (1)

HA then issues a smart card containing [ID_MU,ID_HA,𝐴,𝐾,𝑁_MU,ℎ(⋅)] and delivers it to MU through a secure channel.

4.3. Authentication and Key Establishment Phase

The procedure followed in the authentication and key establishment phase is illustrated in Figure 7. In this phase, to attain mutual authentication between MU and HA, and between MU and FA, the following actions are performed.

Figure 7 

Authentication and key establishment phase of our proposed scheme.

Step  A1. Consider MU→FA∶{ID_HA,𝐴,𝑐₁,𝑐₂,𝑎𝑃,𝑁_MU}.

For authentication, MU selects a random nonce 𝑁^′_MU and a random number 𝑎, and computes 𝑎𝑃 value on 𝐸 using ECDH. MU then computes the following: 𝑐₁=𝐾⊕ℎPW_MU‖𝑁^′_MU,𝑐₂=ℎ𝑎𝑃‖ℎPW_MU‖𝑁^′_MU‖ℎPW_MU‖𝑁_MU. (2)

Next, MU sends ID_HA, 𝐴, 𝑐₁, 𝑐₂, 𝑎𝑃, and 𝑁_MU to FA.

Step  A2. Consider FA→HA∶{ID_FA,𝐴,𝑐₁,𝑐₂,𝑎𝑃,𝑏𝑃,𝑁_MU}.

FA stores the ID_HA and 𝑎𝑃 received from MU for further communication, selects a random number 𝑏, and computes the 𝑏𝑃 value on 𝐸 using ECDH. FA then sends ID_FA, 𝐴, 𝑐₁, 𝑐₂, 𝑎𝑃, 𝑏𝑃, and 𝑁^′_MU to HA.

Step  A3. Consider HA→FA∶{ID_HA,ID_FA,𝑐₃,𝑎𝑃,𝑏𝑃}.

On receiving the authentication message from FA, HA computes the following: ℎ𝑥‖ID_MU,𝐵=A⊕ℎ𝑥‖𝑦_′=ℎℎ𝑥‖ID_MU‖ℎ𝑥‖𝑦,PW_MU=ℎ𝐵^′‖𝑁_HA,𝐾=ℎ𝑥‖ID_MU⊕ℎPW_MU‖𝑁_MU,ℎPW_MU‖𝑁^′_MU=𝑐₁𝑐⊕𝐾,_′2=ℎ𝑎𝑃ℎPW_MU‖𝑁^′_MUℎPW_MU‖𝑁_MU. (3)

HA then checks whether 𝑐^′₂ is identical to 𝑐₂. If they are identical, HA authenticates MU. HA then computes 𝑐₃=ℎ(ID_FA‖𝑎𝑃‖𝑏𝑃‖𝐾‖ℎ(PW_MU‖𝑁^′_MU)‖ℎ(PW_MU‖𝑁_MU)) and sends ID_HA, ID_FA, 𝑐₃, 𝑎𝑃, and 𝑏𝑃 to FA.

Step  A4.  FA→MU∶{ID_HA,ID_FA,𝑐₃,𝑎𝑃,𝑏𝑃}.

FA checks ID_HA, ID_FA, and 𝑎𝑃, and sends ID_HA, ID_FA, 𝑐₃, 𝑎𝑃, and 𝑏𝑃 to MU.

Step  A5. MU→FA∶{𝑆_MF}.

MU checks ID_HA and 𝑎𝑃, and computes 𝑐^′₃=ℎ(ID_FA‖𝑎𝑃‖𝑏𝑃‖𝐾‖ℎ(PW_MU‖𝑁^′_MU)‖ℎ(PW_MU‖𝑁_MU)). MU checks whether 𝑐^′₃ is identical to 𝑐₃. If they are identical, MU authenticates HA and FA. MU then computes 𝐾_MF=ℎ(𝑎𝑏𝑃) using private and public keys and 𝑆_MF=𝑓_𝐾MF(ID_FA‖𝑎𝑃‖𝑏𝑃). Next, MU sends 𝑆_MF to FA.

Step  A6. FA computes 𝐾_MF=ℎ(𝑎𝑏𝑃) using private and public keys and 𝑆^′_MF=𝑓_𝐾MF(ID_FA‖𝑎𝑃‖𝑏𝑃). FA then checks whether 𝑆^′_MF is identical to 𝑆_MF. If they are identical, FA authenticates MU. Otherwise, the procedure is terminated.

4.4. Update Session Key Phase

The update session key phase is the same as the third phase of Mun et al.’s scheme, as shown in Figure 5.

5. Analyses

5.1. Security Analysis

Table 2 compares the security of existing schemes with that of our proposed scheme. Our scheme has the following security properties.

Table 2 

Security analysis of the compared schemes.

Anonymity. Assume that an adversary 𝐴 intercepts the message {𝑐₁,𝑐₂,𝑐₃,𝐴} over a public network. An adversary cannot derive the identifier ID_MU of the mobile user from 𝑐₁, 𝑐₂, 𝑐₃, and 𝐴. This is because an adversary does not know 𝑥, 𝑦, and PW_MU.

Perfect Forward Secrecy. The authentication and key establishment and update session key phases of our scheme use ECDH to provide perfect forward secrecy. To establish a session key, MU and FA use different 𝑎_𝑖𝑃 and 𝑏_𝑖𝑃 for each session, and thus they are not related to previous values 𝑎_𝑖−1𝑃 and 𝑏_𝑖−1𝑃. Thus, if the previous session key 𝐾_MF𝑖−1=ℎ(𝑎_𝑖−1𝑏_𝑖−1𝑃), is disclosed, an adversary 𝐴 cannot guess 𝐾_MF𝑖=ℎ(𝑎_𝑖𝑏_𝑖𝑃). In other words, guessing 𝐾_MF𝑖 is a computationally difficult problem.

Mutual Authentication. HA can authenticate MU by checking 𝑐₂ in Step A3 of the authentication and key establishment phase, and MU can authenticate HA and FA by checking 𝑐₃ in Step A5 of the authentication and key establishment phase. And, FA can authenticate MU by checking 𝑆_MF in Step A6 of the authentication and key establishment phase.

Impersonation Attack. An adversary A cannot compute the authentication message {ID_HA,𝐴,𝑐₁,𝑐₂,𝑎𝑃,𝑁^′_MU} because he/she cannot know ID_MU, 𝑥, 𝑦, PW_MU, and 𝑁_HA. Even if 𝐴 is a legitimate user of HA, he/she cannot compute the authentication message {ID_HA,𝐴,𝑐₁,𝑐₂,𝑎𝑃,𝑁^′_MU}.

Disclosure of Password. We assume that an adversary 𝐴 eavesdrops on MU’s authentication message {ID_HA,𝐴,𝑐₁,𝑐₂,𝑎𝑃,𝑁^′_MU} in the authentication and key establishment phase. However, 𝐴 cannot know MU’s PW_MU from the authentication message {ID_HA,𝐴,𝑐₁,𝑐₂,𝑎𝑃,𝑁^′_MU} by the nature of a one-way hash function.

Replay Attacks. MU uses a random nonce 𝑁_MU and checks 𝑐₂ to resist replay attacks in each authentication session. If an adversary 𝐴 is replaying the previous authentication message, but he/she cannot authenticate from HA because 𝑐₂ fail to check.

Man-in-the-Middle Attacks. Man-in-the-middle attacks are thwarted because of the authentication between MU and HA. Similarly, man-in-the-middle attacks can be thwarted by the establishment of a session key between MU and FA.

5.2. Performance Analysis

Table 3 compares the performance of existing schemes with that of our proposed scheme. Our scheme incurs less communication cost than conventional schemes [4–6]. Although our scheme incurs a little more communication cost than Mun et al.’s scheme, it incurs less computational overhead in the database than Mun et al.’s scheme [12].

Table 3 

Performance analysis of the compared schemes.

No Need for Time Synchronization. Conventional schemes use timestamps to resist replay attacks. Thus, time synchronization takes place when each entity is located in a different time zone. However, our scheme does not use timestamps, so there is no need to synchronize time between different entities.

Use of ECDH. Conventional schemes use certificates. However, mobile devices have power limitations; low-level computation based on certificates incurs a significant overhead. Our scheme uses ECDH instead of a public key cryptosystem with certificates in order to reduce the communication overhead. ECDH provides the same security properties and uses fewer resources than a public key cryptosystem with certificates. The performance advantage of ECDH is improved further as security needs increase.

Overhead Analysis. Our proposed authentication scheme can be compared with Mun et al.’s scheme in terms of the database overhead incurred by HA as the number of devices increase. In order to compare the overhead, the following terms are defined: the number of devices is 𝑑(𝑑=1,10,20,…,100), the identifier stored in the database of the home agent is 𝑖, the computational cost for a one-way hash function and exclusive OR operation is 𝑐 (it is assumed that the computational cost for a one-way hash function and exclusive OR operation is 2, thus, 𝑐=2), and, finally, the overhead in the database of the home agent is 𝑂. Thus, the overhead can be expressed as 𝑂=𝑑×𝑖×𝑐, that is, 𝑂=10×10×2=200. Mun et al.’s scheme must obtain identifier and password information from its own database in order to compute the authentication message. However, their scheme compares the authentication message to compute the identifier and password of all the mobile users stored in its own database because of the difficulty of finding identifier and password information in the authentication message. For example, in Mun et al.’s scheme, if the number of devices to be authenticated by HA is 30, the number of identifiers stored in the database of the home agent is also 30, the computational cost for a one-way hash function and exclusive OR operation is 2 (according to Mun et al.’s scheme, 𝑐=2 because of the computational cost incurred); therefore, the overhead incurred in the database of HA is 𝑂=30×30×2=1800. Our proposed scheme can compute the authentication message in its own database because the identifier information can be found in the authentication message. For example, in our proposed scheme, if the number of devices to be authenticated by the home agent is 30, the number of identifiers stored in the database of the home agent is also 30, the computational cost for a one-way hash function and exclusive OR operation is 1 (our proposed scheme does not incur computational cost; thus, 𝑐=1), and thus, the overhead incurred in the database of HA is 𝑂=30×30×1=900. Just like our proposed scheme, Lee et al.’s and Wu et al.’s scheme are the same overhead analysis. Compared to the existing scheme, our proposed scheme incurs less computational overhead in the database (Figure 8).

Figure 8 

Analysis of overhead incurred versus number of devices.

6. Conclusion

In this paper, we examined the previous schemes and security vulnerabilities of the previous schemes. Lee et al.’s and Wu et al.’s scheme was vulnerable to replay attack, cannot achieved perfect forward secrecy, cannot provided anonymity. And Mun et al.’s scheme was vulnerable to replay attack and man-in-the-middle attack, and incurred a high overhead in the database. Therefore, we proposed a secure and efficient anonymous authentication scheme for roaming service in GLOMONET. Our scheme was developed using ECDH instead of the authentication mechanism used by Mun et al.’s scheme. Consequently, unlike Mun et al.’s scheme, our scheme achieves anonymity, provides perfect forward secrecy and mutual authentication, and is resistant to replay attack and man-in-the-middle attack. And our scheme incurs less overhead in the database than Mun et al.’s scheme does. In addition, our scheme does not use timestamps, and as a result, it does not need to synchronize time between different entities.

Acknowledgments

This research was funded by the MSIP (Ministry of Science, ICT & Future Planning), Korea in the ICT R&D Program 2013. This work was supported by the Soonchunhyang University Research Fund. The authors declare that there is no conflict of interests regarding the publication of this article.