Applying Semigroup Property of Enhanced Chebyshev Polynomials to Anonymous Authentication Protocol

Abstract

We apply semigroup property of enhanced Chebyshev polynomials to present an anonymous authentication protocol. This paper aims at improving security and reducing computational and storage overhead. The proposed scheme not only has much lower computational complexity and cost in the initialization phase but also allows the users to choose their passwords freely. Moreover, it can provide revocation of lost or stolen smart card, which can resist man-in-the-middle attack and off-line dictionary attack together with various known attacks.

1. Introduction

With rapid developments in limits and possibilities of communications and information transmissions, there is a growing demand of authentication protocol, which has greatly spurred research activities in authentication protocols' study. In general, the server authenticates the users by matching the user's identity and password after establishing a secure channel [1]. Since the server establishes a secure channel before asking identity/password information, an attacker can open a connection to a server thatdoes not respond when identity/password information is inquired by the server, which results in the consumption of the resources of the server. Moreover, the attacker can set up many connections and consume all the resources of the server. However, this method is vulnerable to denial of service (DoS) attack and cannot discriminate an impostor who fraudulently obtains access privileges (e.g., user's identity and password) from the real user. Later, Li and Hwang [2] proposed a biometrics-based remote user authentication scheme using smart cards. Soon, Li et al. [3, 4] improved Li and Hwang's scheme. There is no doubt that most existing authentication protocols only achieve “heuristic” security, that is, the underlying hardness assumptions of these protocols are not perfect. However, we discover the references [5–9], which contain the detection of the DDOS attacks by consuming all, or mostly, the resources of the server can be assured, providing a more hopeful line of investigation for us to future study.

Later, Bellovin and Merritt [10] firstly presented a two-party password authenticated key exchange (2PAKE) protocol which permits a user and a server to establish a session key over an insecure channel to address the problem mentioned above. In their protocol, each user just shares an easy-to-remember password with the trusted server. Regretfully, Patel [11] pointed out that it was easy for an adversary to guess the passwords used for authentication in Bellovin and Merritt's protocol. In order to avoid these attacks, many 2PAKE protocols with weak passwords for authentication have been presented by the researchers [12–18]. However, in these 2PAKE protocols, every user has to share a different password with his/her peer. It is usually rather inconvenient for applications in large-scale communication environments. To surmount this weakness, three-party PAKE (3PAKE) protocols have been proposed in [19–22]. Unlike 2PAKE protocols, 3PAKE protocol is a very practical mechanism to establish secure session key through authenticating each other with a trusted server's help. There are two common weaknesses in these schemes as follows. (1) They needs more communications rounds to reduce computational load. However, as early as in 1995, Gong pointed out that the number of rounds is a key standard for weighing against the performance of a protocol. (2) The sensitive table that stores the shared secret between the server and the designed users will be an attractive target leading to potential server compromise. In 2008, Chen et al. [23] proposed a round and computation-efficient three-party authenticated key exchange protocol, which addressed the above mentioned problems. However, we find that their scheme still exist following four drawbacks. (1) It has computational efficiency problems in initialization phase. (2) User has no choice in choosing his password. (3) It cannot protect user anonymity. (4) There is no provision for revocation of lost or stolen smart card, which is susceptible to man-in-the-middle attack.

Therefore, in this paper, password-based anonymous authentication protocol defined over enhanced Chebyshev polynomials is proposed. A number of outstanding mathematicians and numerical analysts have said that Chebyshev polynomials are everywhere dense in numerical analysis. There is scarcely any area of numerical analysis where Chebyshev polynomials do not drop in like surprise visitors, and indeed there are now a number of subjects in which these polynomials take a significant position in modern developments [24]. One is taken on a journey which leads into all areas of numerical analysis by studying Chebyshev polynomials. Moreover, due to the semigroup property of enhanced Chebyshev polynomials, the well-known discrete logarithm problem and the Diffie-Hellman problem are proved to hold in enhanced Chebyshev polynomials [25]. Thus, we apply semigroup property of enhanced Chebyshev polynomials to present an anonymous authentication protocol. Moreover, our proposed protocol has the following features.(1)It has much lower computational complexity and cost in the initialization phase.(2)It allows the users to choose their passwords freely.(3)It can provide revocation of lost or stolen smart card, which can resist man-in-the-middle attack.(4)There is no need to find primitive elements, large prime, and even large number.

The rest of this paper is organized as follows. Section 2 gives description of enhanced Chebyshev polynomials and some hard problems based on them. Section 3 briefly reviews Chen et al.'s protocol and describes its disadvantages. In Section 4, we apply semigroup property of enhanced Chebyshev polynomials to design an anonymous authentication protocol. We analyze the security of proposed scheme in Section 5, and computational efficiency analysis is made in Section 6. Finally, we conclude this paper in Section 7.

2. Preliminaries

In this section, we review some basic definitions concerning enhanced Chebyshev polynomials and some hard problems based on the enhanced Chebyshev polynomials [26].

Definition 2.1 (Chebyshev polynomials). The Chebyshev polynomials of degree 𝑛 are defined as 𝑇_𝑛(𝑥)=cos(𝑛×arccos(𝑥)),{𝑥∣−1≤𝑥≤1}, (2.1)
The recurrent formulas are 𝑇_𝑛(𝑥)=2𝑥𝑇_𝑛−1(𝑥)−𝑇_𝑛−2(𝑥), (2.2) where 𝑛≥2,𝑇₀(𝑥)=1, and 𝑇₁(𝑥)=𝑥.
The first few Chebyshev polynomials are 𝑇₂(𝑥)=2𝑥²𝑇−1,₃(𝑥)=4𝑥³𝑇−3𝑥,₄(𝑥)=8𝑥⁴−8𝑥²+1. (2.3)
It can be identified that Chebyshev polynomial has the following properties:(1)semigroup property as 𝑇_𝑟𝑇_𝑠(𝑥)=cos𝑟∗arccos(cos(𝑠∗arccos(𝑥)))=cos𝑟𝑠∗arccos(𝑥)=𝑇_𝑠𝑇_𝑟(𝑥)=𝑇_𝑟𝑠(𝑥), (2.4)(2)chaotic property,

When 𝑛>1, Chebyshev polynomials map 𝑇_𝑛(𝑥)∶[−1,1]→[−1,1] of degree 𝑛 is a chaotic map with its invariant density as 𝑓^∗(𝑥)=1𝜋√1−𝑥², (2.5) for Lyapunov exponent 𝜆=ln𝑛>0.

Definition 2.2 (enhanced Chebyshev polynomials). In order to enhance the property of the Chebyshev chaotic map, Zhang [27] proved that the semigroup property holds for Chebyshev polynomials defined on interval (−∞,+∞). This paper uses the following enhanced Chebyshev polynomials: 𝑇_𝑛(𝑥)=2𝑥𝑇_𝑛−1(𝑥)−𝑇_𝑛−2(𝑥)(mod𝑁), (2.6) where 𝑛≥2,𝑥∈(−∞,+∞), and 𝑁 is a large prime number. Obviously, 𝑇_𝑟𝑇_𝑠(𝑥)=𝑇_𝑠𝑇_𝑟(𝑥)=𝑇_𝑟𝑠(𝑥). (2.7)
So the semigroup property still holds and the enhanced Chebyshev polynomials also commute under composition.

Definition 2.3 (the discrete logarithm problem (DLP)). DLP is explained by the following. Given an element 𝛼, find the integer 𝑟, such that 𝑇_𝑟(𝑥)=𝛼.

Definition 2.4 (the Diffie-Hellman problem (DHP)). DHP is explained by the following. Given an element 𝑥, and the values of 𝑇_𝑟(𝑥), 𝑇_𝑠(𝑥), what is the value of 𝑇_𝑟𝑠(𝑥)?

3. Review of Chen et al.'s Protocol

This section reviews Chen et al.'s protocol (showed in Figure 1). Some of the notations used in this protocol are defined in Table 1.

Table 1 

Some of the notations used in Chen et al.'s protocol.

Figure 1 

Authenticated key exchange phase in Chen et al.'s protocol.

3.1. Initialization Phase

In this phase, 𝐴 and 𝐵 ought to register with 𝑆 to be legal participants, and 𝑆 should choose issue secret keys, which will be used in the subsequent phase. Through taking 𝐴 for an example, 𝑆 executes the following steps to authorize 𝐴.(1)Randomly choose 1≤𝛿_𝐴<𝑞 and calculate 𝑉_𝐴=ℎ(ID_𝐴,𝛿_𝐴).(2)Generate signature (𝑒_𝐴,𝑠_𝐴) as 𝐴's self-verified token, where  𝑟_𝐴=𝑔^𝛿𝐴mod𝑝, 𝑒_𝐴=ℎ(𝑟_𝐴,ID_𝐴), and 𝑠_𝐴=(𝛿_𝐴−𝑥𝑒_𝐴)mod𝑞.(3)Store the authentication information (𝑉_𝐴,(𝑒_𝐴,𝑠_𝐴)) into a smart card and then deliver it to 𝐴 in a secure way.

To test whether (𝑒_𝐴,𝑠_𝐴) is authorized by 𝑆, 𝐴 retrieves 𝑟^′_𝐴 as 𝑟^′_𝐴=𝑔^𝑠𝐴⋅𝑦^𝑒𝐴mod𝑝, and then verifies ℎ(𝑟^′_𝐴,ID_𝐴)=^?𝑒_𝐴.

Similarly, after 𝐵 obtains the authorization information (𝑉_𝐵,(𝑒_𝐵,𝑠_𝐵)) stored in the smart card from 𝑆, he can ensure that whether (𝑒_𝐵,𝑠_𝐵) is valid by using the method mentioned above.

3.2. Authentication key Exchange Phase

This phase aims to establish the session key 𝑆𝐾 with 𝑆's help. It just needs three rounds to achieve this goal.

Round 1:
𝐴→𝑆∶ID_𝐴,ID_𝐵,𝑊_𝐴,𝐴→𝐵∶ID_𝐴,𝑇_𝐴,𝑅_𝐴. (3.1)(1)Randomly choose an integer 𝑎 and compute 𝑅_𝐴=𝑔^𝑎mod   𝑝, 𝐶_𝐴𝑆=ℎ(ID_𝐴,ID_𝐵,𝑇_𝐴,𝑅_𝐴,𝑉_𝐴), then transmits ID_𝐴,ID_𝐵 and 𝑊_𝐴=(𝐶_𝐴𝑆,𝑇_𝐴,𝑅_𝐴,(𝑒_𝐴,𝑠_𝐴)) to 𝑆; where 𝑇_𝐴 is the time stamp obtained by 𝐴 from the local clock to ensure the freshness of the message.(2)  𝐴 transmits ID_𝐴,𝑇_𝐴 and 𝑅_𝐴 to 𝐵.

Round 2:
𝐵→𝑆∶ID_𝐵,ID_𝐴,𝑊_𝐵,𝐵→𝐴∶ID_𝐵,𝑇_𝐵,𝑅_𝐵,𝐶_𝐵𝐴. (3.2) After receiving the message from 𝐴, 𝐵 does the following steps.(1)Randomly choose an integer 𝑏 and compute 𝑅_𝐵=𝑔^𝑏mod𝑝, 𝐶_𝐵𝑆=ℎ(ID_𝐵,ID_𝐴,𝑇_𝐵,𝑅_𝐵,𝑉_𝐵), and send 𝑊_𝐵=(𝐶_𝐵𝑆,𝑇_𝐵,𝑅_𝐵,(𝑒_𝐵,𝑠_𝐵)) to 𝑆, where 𝑇_𝐵 is the time stamp obtained by 𝐵 from the local clock to ensure the freshness of the message.(2)Calculate the session key 𝑆𝐾=(𝑅_𝐴)^𝑏mod𝑝 and then transmit 𝐶_𝐵𝐴=ℎ(𝑇_𝐴,𝑅_𝐴,𝑅_𝐵,𝑆𝐾) to 𝐴.

Round 3:
𝑆→𝐴∶𝐶_𝑆𝐴,𝑆→𝐵∶𝐶_𝑆𝐵,𝐴→𝐵∶𝐶_𝐴𝐵. (3.3) In this round, 𝑆 does the following steps.(1)Verify whether 𝑇_𝐴 is fresher than the one received in the last request. If so, apply 𝑥 to computing 𝛿^′_𝐴=(𝑠_𝐴+𝑥𝑒_𝐴)mod𝑞 and 𝑉^′_𝐴=ℎ(ID_𝐴,𝛿^′_𝐴), and then compute 𝐶^′_𝑆𝐴=ℎ(ID_𝐴,ID_𝐵,𝑇_𝐴,𝑅_𝐴,𝑉^′_𝐴). In the following, test 𝐶^′?_𝐴𝑆=𝐶_𝐴𝑆 to authenticate the identity of 𝐴; if it holds, 𝑆 calculates 𝐶_𝑆𝐴=ℎ(𝐶_𝐴𝑆,𝑇_𝐵,𝑅_𝐵,𝑉^′_𝐴) and transmits it to 𝐴.(2)Test whether 𝑇_𝐵 is fresher than the one received in the last request. If so, 𝑆 calculates 𝑉^′_𝐵=ℎ(ID_𝐵,𝛿^′_𝐵) and computes 𝐶^′_𝐵𝑆=𝐻(ID_𝐴,ID_𝐵,𝑇_𝐵,𝑅_𝐵,𝑉^′_𝐵). Then, check 𝐶^′?_𝐵𝑆=𝐶_𝐵𝑆 to authenticate the identity of 𝐵; if it holds, 𝑆 calculates 𝐶_𝑆𝐵=ℎ(𝐶_𝐵𝑆,𝑇_𝐴,𝑅_𝐴,𝑉^′_𝐵) and transmits it to 𝐵.(3)Independently, 𝐴 tests whether (𝑇−𝑇_𝐴) is in a valid period, where 𝑇 is the time when the message transmitted from 𝐵 after Round 2 was received. If so, 𝐴 uses the received 𝑅_𝐵 to compute the session key 𝑆𝐾^′=(𝑅_𝐵)^𝑎mod𝑝. Then, it computes 𝐶^′_𝐵𝐴=ℎ(𝑇_𝐴,𝑅_𝐴,𝑅_𝐵,𝑆𝐾^′) and checks 𝐶^′?_𝐵𝐴=𝐶_𝐵𝐴 to authenticate 𝐵; if it holds, 𝐴 computes 𝐶_𝐴𝐵=ℎ(𝐶_𝐵𝐴,𝑇_𝐵,𝑆𝐾^′) and sends it to 𝐵.

After this round, 𝐴 tests whether (𝑇^′−𝑇_𝐴) is in a valid period, where 𝑇^′ is the time when 𝐶_𝑆𝐴 was received. If so, 𝐴 calculates 𝐶^′_𝑆𝐴=ℎ(𝐶_𝐴𝑆,𝑇_𝐵,𝑅_𝐵,𝑉_𝐴) and tests 𝐶^′?_𝑆𝐴=𝐶_𝑆𝐴 to verify the correctness of 𝐶_𝑆𝐴. If it holds, 𝐴 finishes this protocol.

Similarly, 𝐵 tests if (𝑇^′′−𝑇_𝐵) is in a valid period, where 𝑇^′′ is the time when 𝐶_𝑆𝐵 was received. If so, 𝐵 calculates 𝐶^′_𝑆𝐵=ℎ(𝐶_𝐵𝑆,𝑇_𝐴,𝑅_𝐴,𝑉_𝐵) and tests 𝐶^′?_𝑆𝐵=𝐶_𝑆𝐵 to verify the correctness of 𝐶_𝑆𝐵. If it holds, 𝐵 completes this protocol.

3.3. Disadvantages of Chen et al.'s Protocol

In this section, we argue that Chen et al.'s scheme still has four disadvantages. The detailed description of the weaknesses is as follows.

3.3.1. Computational Efficiency Problem

In the initialization phase of Chen et al.'s protocol, 𝑆 has to compute all the authenticated information (𝛿_𝐴,𝑟_𝐴,𝑒_𝐴,𝑠_𝐴) for 𝐴 and (𝛿_𝐵,𝑟_𝐵,𝑒_𝐵,𝑠_𝐵) for 𝐵. Server has to perform two modular exponentiation operations, which are more expensive than other operations in Chen et al.'s protocol. Hence, it has low efficiency in this phase.

3.3.2. Lack of User Friendliness

In Chen et al.'s scheme, the password is chosen by the server 𝑆 without the consent of 𝐴/𝐵, thus, 𝐴/𝐵 can only passively accept the password from 𝑆. It is not practical for real life applications, such as on-line banking and e-mail subscription. Moreover, 𝛿_𝐴/𝛿_𝐵∈[1,𝑞] chosen by the server could be long and random (e.g., 160 bits), which might be difficult for a registered user 𝐴/𝐵 to remember easily, and it is most likely that 𝐴/𝐵 may forget this long and random password if he is not frequently using the system. Hence, Chen et al.'s scheme has lack of user friendliness.

3.3.3. No Protecting User Anonymity

In authenticated key exchange phase of Chen et al.'s scheme, ID_𝐴,ID_𝐵 are sent to 𝑆 over insecure channel in the authentication message: (ID_𝐴,ID_𝐵,𝑊_𝐴), (ID_𝐵,ID_𝐴,𝑊_𝐵). In certain authentication scenarios, such as e-voting and secret online-order placement, it is fairly crucial to protect the privacy of a user. Once an attacker sniffs the communication parties involved in the authentication process, he can easily analyze the transaction being performed by users. Hence, Chen et al.'s scheme fails to provide the user anonymity in the authentication phase.

3.3.4. No Provision for Revocation of Lost or Stolen Smart Card

In case the smart card is lost or stolen, the attacker may impersonate the legal user using the lost or stolen smart card, so there should be a mechanism to ensure that the system can revoke the lost or stolen smart card to avoid the possible attacks. Providing for revocation is also one of the requirements of smart card-based authentication protocols. By keeping record of valid card identifier of every registered user, the authentication system can tell the valid card from the invalid one. Regretfully, Chen et al.'s scheme ignored this feature and there is no mechanism to revoke the lost smart card. Moreover, the drawback would become catastrophic if an attacker has got the lost smart card by accident and has revealed the authentication message of a legal user by any means to login into the system for performing secure transaction, such as on-line banking and e-commerce. Thus, Chen et al.'s scheme failed to provide the important feature of smart card-based authentication for revoking the lost smart cards without changing the user's identities.

3.3.5. Man-in-the-Middle Attack

Due to Section 3.3.4, unqualified users can easily launch a man-in-the-middle attack when the smart card is stolen. The steps of the attack is outlined in Figure 2 and explained as follows.

Figure 2 

Man-in-the-middle attack in Chen et al.'s protocol.

Suppose an adversary 𝑀 had stolen the smart card from the legal user, then he can obtain the authenticated values 𝑉_𝐴 and 𝑉_𝐵. Let 𝑅_𝑀=𝑔^𝑚mod𝑝 be 𝑀's ephemeral public key, and 𝑚∈𝑧^∗_𝑝 is chosen by 𝑀. Then, he replaces 𝐶_𝑆𝐴 and 𝐶_𝑆𝐵 with 𝐶^′_𝑆𝐴 and 𝐶^′_𝑆𝐵 in Round 3. The notation “⇢” denotes the transmitted message that is manipulated by 𝑀. The purpose of 𝑀 is to share a session key with 𝐴 by posing as 𝐵 and to share a session key with 𝐵 by posing as 𝐴. The specific process is as follows.

Round 1:
𝐴→𝑆∶ID_𝐴,ID_𝐵,𝑊_𝐴,𝐴⇢𝑀(𝐵)∶ID_𝐴,𝑇_𝐴,𝑅_𝐴,𝑀(𝐴)⇢𝐵∶ID_𝐴,𝑇_𝐴,𝑅_𝑀. (3.4)

Round 2:
𝐵→𝑆∶ID_𝐵,ID_𝐴,𝑊_𝐵,𝐵⇢𝑀(𝐴)∶ID_𝐵,𝑇_𝐵,𝑅_𝐵,𝐶_𝐵𝑀.𝑀(𝐵)⇢𝐴∶ID_𝐵,𝑇_𝐵,𝑅_𝑀,𝐶_𝑀𝐴. (3.5) When receiving the message from 𝑀(𝐴), 𝐵 calculates the session key with 𝑀(𝐴), as 𝑆𝐾_𝑀𝐵=𝑔^𝑏𝑚mod𝑝, 𝐶_𝐵𝑀=ℎ(𝑇_𝐴,𝑅_𝑀,𝑅_𝐵,𝑆𝐾_𝑀𝐵), then 𝑀 calculates the session key with 𝐴 as 𝑆𝐾_𝐴𝑀=𝑔^𝑎𝑚mod𝑝, 𝐶_𝐴𝑀=ℎ(𝑇_𝐴,𝑅_𝑀,𝑅_𝐵,𝑆𝐾_𝐴𝑀).

Round 3:
𝑆⇢𝑀(𝐴)∶𝐶_𝑆𝐴,𝑀(𝑆)⇢𝐴∶𝐶^′_𝑆𝐴,𝑆⇢𝑀(𝐵)∶𝐶_𝑆𝐵,𝑀(𝑆)⇢𝐵∶𝐶^′_𝑆𝐵,𝐴⇢𝑀(𝐵)∶𝐶_𝐴𝑀,𝑀(𝐴)⇢𝐵∶𝐶_𝑀𝐵. (3.6)
In this round, because 𝑀 obtains the value 𝑉_𝐴, he can compute 𝐶^′_𝑆𝐴=ℎ(𝐶_𝐴𝑆,𝑇_𝐵,𝑅_𝑀,𝑉_𝐴) for mutual authentication with 𝐴; similarly, 𝑀 can also use 𝑉_𝐵 to calculate 𝐶^′_𝑆𝐵=ℎ(𝐶_𝐵𝑆,𝑇_𝐴,𝑅_𝑀,𝑉_𝐵) for mutual authentication with 𝐵.
When receiving the values 𝐶^′_𝑆𝐴 and 𝐶^′_𝑆𝐵, 𝐴 and 𝐵 authenticate the server using their own parameters. Then 𝐴 computes 𝐶_𝑀𝐵=ℎ(𝐶_𝐵𝑀,𝑇_𝐵,𝑆𝐾_𝐴𝑀) for 𝑀(𝐵), it confirms if 𝐶_𝑀𝐵 is valid from its own knowledge. 𝑀 calculates 𝐶_𝑀𝐵=ℎ(𝐶_𝑀𝐴,𝑇_𝐵,𝑆𝐾_𝑀𝐵) and sends it to 𝐵 to achieve session key agreement.
Finally, 𝑀 has shared the session key 𝑆𝐾_𝐴𝑀=𝑔^𝑎𝑚mod𝑝 with 𝐴 and 𝑆𝐾_𝐵𝑀=𝑔^𝑏𝑚mod𝑝 with 𝐵. In this case, the authenticate mechanism of the Chen et al.'s protocol does not help.

4. An Anonymous Authentication Protocol Using Semiproperty of Enhanced Chebyshev Polynomials

To surmount serious latency security problems in the Chen et al.'s protocol, we apply semigroup property of enhanced Chebyshev polynomials to designing a new anonymous authentication protocol.

4.1. Notations

In the section, we describe some of the notations used in our protocol (Table 2).

Table 2 

Some of the notations used in our paper.

4.2. Initialization Phase

In this phase, the users and the server need some intercommunication for user's registration.

We take 𝐴 for an example. To register with 𝑆 to become a valid user 𝐴, 𝐴 and 𝑆 will do the following steps.(1) 𝐴→𝑆: (𝐷_𝐴,ID_𝐴) 𝐴 freely chooses an easy-to-remember password 𝑃_𝐴 and identity ID_𝐴, then computes 𝐷_𝐴=𝑇_𝑃𝐴(𝑥) and sends (𝐷_𝐴,ID_𝐴) to 𝑆.(2) When receiving 𝐷_𝐴 from 𝐴, 𝑆 first tests if 𝐷=_𝐴^?𝐷_𝐼. If 𝐷_𝐴=𝐷_𝐼, 𝑆 should ask 𝐴 to submit a different password.(3) 𝑆→𝐴: (Δ_𝐴,𝐻(⋅)) Then, 𝑆 computes Δ_𝐴=𝐸_𝑛(𝑇_𝑃𝐴(𝑥)‖ID_𝐴), for convenience, 𝑆 stores (Δ_𝐴,𝐻(⋅)) into a smart card and then delivers it to 𝐴 face to face.

Of course, 𝐵 registers with 𝑆 in the same way.

4.3. Authentication Key Exchange Phase

This phase aims to establish a session key 𝑆𝐾. To achieve this goal, 𝐴 and 𝐵 first compute 𝑉_𝐴=𝐻(𝑇_𝑃𝐴(𝑦)) and 𝑉_𝐵=𝐻(𝑇_𝑃𝐵(𝑦)) using their own passwords and the public key of 𝑆 as their authentication information respectively. Note that 𝑉_𝐴,𝑉_𝐵 can be precomputed. This phase also includes three rounds (shown phase in Figure 3) and the detailed descriptions are as follows.

Figure 3 

Authenticated key exchange phase in our proposed protocol.

Round 1:
𝐴→𝑆∶ID_𝐴,Δ_𝐴,𝑊_𝐴𝐴→𝐵∶Δ_𝐴,𝑇_𝐴,𝑅_𝐴. (4.1)(1)Calculates 𝐶_𝐴𝑆=𝐻(Δ_𝐴,𝑇_𝐴,𝑅_𝐴,𝑉_𝐴) and 𝑊_𝐴=(𝐶_𝐴𝑆,𝑇_𝐴,𝑅_𝐴,Δ_𝐴), then transmits Δ_𝐴 and 𝑊_𝐴 to S; where the meaning of 𝑇_𝐴 is the same as that in the Chen et al.'s protocol.(2)  A transmits Δ_𝐴,𝑇_𝐴 and 𝑅_𝐴 to 𝐵.

Round 2:
𝐵→𝑆∶ID_𝐵,Δ_𝐴,Δ_𝐵,𝑊_𝐵𝐵→𝐴∶Δ_𝐵,𝑇_𝐵,𝑅_𝐵,𝐶_𝐵𝐴. (4.2) On receiving the request transmitted from 𝐴, 𝐵 does the following steps.(1)𝐵calculates 𝐶_𝐵𝑆=𝐻(Δ_𝐵,𝑇_𝐵,𝑅_𝐵,𝑉_𝐵) and sends 𝑊_𝐵=(𝐶_𝐵𝑆,𝑇_𝐵,𝑅_𝐵,Δ_𝐵) to 𝑆; the meaning of 𝑇_𝐵 is the same as that in the Chen et al.'s protocol.(2)𝐵 calculates the session key 𝑆𝐾=𝑇_𝑏(𝑅_𝐴) and transmits 𝐶_𝐵𝐴=𝐻(𝑇_𝐴,𝑅_𝐴,𝑅_𝐵,𝑆𝐾) to 𝐴.

Round 3:
𝑆→𝐴∶𝐶_𝑆𝐴,𝑆→𝐵∶𝐶_𝑆𝐵,𝐴→𝐵∶𝐶_𝐴𝐵. (4.3) In this round, 𝑆 does the following steps.(1)Verify if 𝑇_𝐴 is in a valid time interval. If so, 𝑆 decrypts Δ_𝐴,Δ_𝐵 with his private key 𝑛 to reveal 𝑇_𝑃𝐴(𝑥)‖ID_𝐴 and 𝑇_𝑃𝐵(𝑥)‖ID_𝐵. Then, 𝑆 calculates 𝑉^′_𝐴=𝐻(𝑇_𝑥1(𝐷_𝐴)) and computes 𝐶^′_𝑆𝐴=𝐻(Δ_𝐴,𝑇_𝐴,𝑅_𝐴,𝑉^′_𝐴). Finally, test 𝐶^′?_𝐴𝑆=𝐶_𝐴𝑆, if it holds, 𝑆 calculates 𝐶_𝑆𝐴=𝐻(𝐶_𝐴𝑆,𝑇_𝐵,𝑅_𝐵,𝑉^′_𝐴) and transmits it to 𝐴.(2)Test whether 𝑇_𝐵 is in a valid time interval. If so, 𝑆 calculates 𝑉^′_𝐵=𝐻(𝑇_𝑥1(𝐷_𝐵)) and computes 𝐶^′_𝐵𝑆=𝐻(Δ_𝐵,𝑇_𝐵,𝑅_𝐵,𝑉^′_𝐵). Then, he tests 𝐶^′?_𝐵𝑆=𝐶_𝐵𝑆, if it holds, 𝑆 calculates 𝐶_𝑆𝐵=𝐻(𝐶_𝐵𝑆,𝑇_𝐴,𝑅_𝐴,𝑉^′_𝐵), and transmits it to 𝐵.(3)Independently, 𝐴 tests if (𝑇−𝑇_𝐴) is in a valid period, where 𝑇 is the time when 𝐵 received the message from 𝑆. If so, 𝐴 calculates 𝑆𝐾^′=𝑇_𝑎(𝑅_𝐵) and 𝐶^′_𝐵𝐴=𝐻(𝑇_𝐴,𝑅_𝐴,𝑅_𝐵,𝑆𝐾^′); then, tests 𝐶^′?_𝐵𝐴=𝐶_𝐵𝐴; if it holds, 𝐴 calculates 𝐶_𝐴𝐵=𝐻(𝐶_𝐵𝐴,𝑇_𝐵,𝑆𝐾^′) and sends it to 𝐵.
After this round, 𝐴 tests if (𝑇^′−𝑇_𝐴) is in a valid period, where 𝑇^′ is the time when 𝐶_𝑆𝐴 was received. If so, 𝐴 calculates 𝐶^′_𝑆𝐴=𝐻(𝐶_𝐴𝑆,𝑇_𝐵,𝑅_𝐵,𝑉_𝐴) and tests 𝐶^′?_𝑆𝐴=𝐶_𝑆𝐴 to verify the correctness of 𝐶_𝑆𝐴. If it holds, 𝐴 finishes this protocol.
Similarly, 𝐵 tests if (𝑇^′′−𝑇_𝐵) is in a valid period, where 𝑇^′′ is the time when 𝐶_𝑆𝐵 was received. If so, 𝐵 calculates 𝐶^′_𝑆𝐵=𝐻(𝐶_𝐵𝑆,𝑇_𝐴,𝑅_𝐴,𝑉_𝐵) and tests 𝐶^′?_𝑆𝐵=𝐶_𝑆𝐵 to verify the correctness of 𝐶_𝑆𝐵. If it holds, 𝐵 finishes this protocol.

5. Security Analysis

The enhanced scheme is a modified form of the Chen et al.'s scheme. Hence, we just discuss the enhanced and some important security features of the proposed scheme instead of discussing the security analysis that has been already shown in [23]. Before analyzing the security properties, we stress the following two facts to prove security that authenticated key agreement protocol should meet. (1) It is widely believed that there is no polynomial-time algorithm to solve DLP and DHP based on enhanced Chebyshev polynomials with nonnegligible probability. (2) The chaotic hash function has collision-free and irreversible properties.

5.1. Securely Chosen and Update Password

In our proposed scheme, 𝐴/𝐵 is able to freely choose and change his password without any hassle of contacting the server 𝑆. Any users except 𝐴/𝐵 cannot change or update the password without knowing the corresponding valid ID_𝐴/ID_𝐵 and 𝑃_𝐴/𝑃_𝐵 of the smart card holder.

5.2. Revocation of Smart Card

In our proposed scheme, if (𝐴/𝐵)'s smart card is stolen or lost, he can request the server 𝑆 to revoke his smart card for future use. 𝑆 can revoke the smart card directly. If an adversary who steals (𝐴/𝐵)'s smart card wants to derive 𝑃_𝐴 from Δ_𝐴=𝐸_𝑛(𝑇_𝑃𝐴(𝑥)‖ID_𝐴), this will be impossible, because just 𝑆 knows the secret key 𝑛, and he is faced with the discrete logarithm problem (DLP) too. Hence, the old smart card becomes useless for future use.

5.3. The Proposed Protocol Can Resist Man-in-the-Middle Attack

Due to 𝑉_𝐴=𝐻(𝑇_𝑃𝐴(𝑦))=𝐻(𝑇_𝑥1(𝐷_𝐴)), if the adversary attempts to login to 𝑆, it needs to derive 𝑥₁/𝑃_𝐴 from 𝑦/Δ_𝐴. However, it is widely believed that there is no polynomial-time algorithm to solve DLP based on enhanced Chebyshev polynomials with nonnegligible probability. Moreover, because just 𝑆 knows the secret key 𝑛, he even cannot obtain 𝐷_𝐴. So the adversary cannot compute 𝑉_𝐴. Due to the same reason, the adversary cannot calculate 𝑉_𝐵 either, that is, our protocol can resist man-in-the-middle attack.

5.4. Protection of User Anonymity

The anonymity feature of users is that the real identity of user should be protected from being revealed by any other entity except 𝑆. Our protocol can preserve the identity anonymity for any user which can be explained as follows.

ID_𝐴 is hidden in Δ_𝐴=𝐸_𝑛(𝑇_𝑃𝐴(𝑥)‖ID_𝐴). Because just 𝑆 knows the secret key 𝑛, even if adversary can obtain Δ_𝐴 from the stolen smart card, he still cannot decrypt Δ_𝐴.

5.5. The Proposed Protocol Can Provide Mutual Authentication

Similarly to Chen et al.'s scheme, we analyze this property from three aspects: authentications among 𝐴, 𝐵, and 𝑆.

Case 1. 𝐴 and 𝐵 To authenticate 𝐴, 𝑆 needs to suppose that they own the same session key. In this protocol, 𝑆 is responsible for confirming both the origin and integrity of the received message in step (2) to help them authenticate each other. 𝑆 ensures that the received messages 𝑇_𝐴,𝑅_𝐴,𝑉_𝐴 and 𝑇_𝐵,𝑅_𝐵,𝑉_𝐵 are truly sent from 𝐴 and 𝐵, respectively, and that no modification has occurred. Meanwhile, 𝑆 sends the respective evidence 𝐶_𝑆𝐴 and 𝐶_𝑆𝐵 for the origin and the integrity of (𝑇_𝐴,𝑅_𝐴) and (𝑇_𝐵,𝑅_𝐵). Based on the premise that 𝑆 is trustworthy, 𝐴/𝐵 is convinced that the origin of (𝑇_𝐵,𝑅_𝐵)/(𝑇_𝐴,𝑅_𝐴) is 𝐵/𝐴 when the validity of 𝐶_𝑆𝐴/𝐶_𝑆𝐵 is verified. As only 𝐴/𝐵 knows the secret 𝑎/𝑏 of 𝑅_𝐴/𝑅_𝐵, the common session key is generated by 𝐴/𝐵 as 𝑇_𝑎(𝑅_𝐵)/𝑇_𝑏(𝑅_𝐴). Because the session key is only known by 𝐴/𝐵, no one can forge a valid 𝐶_𝐵𝐴=𝐻(𝑇_𝐴,𝑅_𝐴,𝑅_𝐵,𝑆𝐾) or 𝐶_𝐴𝐵=𝐻(𝐶_𝐵𝐴,𝑇_𝐵,𝑆𝐾^′). Therefore, mutual authentication between 𝐴 and 𝐵 is achieved while the session key confirmation is guaranteed.

Case 2. 𝐴 and 𝑆 To achieve the mutual authentication between 𝐴 and 𝑆, on the one hand, 𝑆 has to verify the validity of the evidence 𝐶_𝐴𝑆=𝐻(Δ_𝐴,𝑇_𝐴,𝑅_𝐴,𝑉_𝐴). On the other hand, 𝐴 must test the validity of 𝐶_𝑆𝐴=𝐻(𝐶_𝐴𝑆,𝑇_𝐵,𝑅_𝐵,𝑉^′_𝐴) to authenticate 𝑆. These evidences are computed with the common secret key. Because only 𝐴 and 𝑆 know the common secret key 𝑉_𝐴, where 𝑉_𝐴 equals 𝑉^′_𝐴, no one can counterfeit the evidence. When validity of 𝐶_𝐴𝑆 and 𝐶_𝑆𝐴 is tested by 𝑆 and 𝐴, respectively, the integrity of the transmitted message from 𝑆 that contains 𝑇_𝐴,𝑅_𝐴 is confirmed by 𝑆 and the integrity of evidence 𝐶_𝑆𝐴 from 𝑆 is confirmed by 𝐴. Thus, mutual authentication between 𝐴 and 𝑆 is achieved.

Case 3. 𝐵 and 𝑆 The analysis of the mutual authentication between 𝐵 and 𝑆 is done likewise. Except 𝐵 and 𝑆, no one knows the secret key 𝑉_𝐵. Therefore, mutual authentication between 𝐵 and 𝑆 is achieved by verifying the validity of 𝐶_𝐵𝑆=𝐻(Δ_𝐵,𝑇_𝐵,𝑅_𝐵,𝑉_𝐵) and 𝐶_𝑆𝐵=𝐻(𝐶_𝐵𝑆,𝑇_𝐴,𝑅_𝐴,𝑉^′_𝐵), respectively.

5.6. The Proposed Protocol Can Resist Bergamo et al.'s Attack

In addition, because our protocol is based on semigroup property of enhanced Chebyshev polynomials, we should consider Bergamo et al.'s attack [20]. Bergamo et al.'s attack is based on the condition that an adversary can obtain the related elements 𝑥,𝑁,𝑇_𝑎(𝑥) and 𝑇_𝑏(𝑥). In the proposed protocol, an attacker could get 𝑥 and 𝑁 easily, but they cannot obtain 𝑇_𝑎(𝑥) and 𝑇_𝑏(𝑥), even though the attacker is a legal user. Besides, the proposed protocol utilizes the enhanced Chebyshev polynomials, in which the periodicity of the cosine function is avoided by extending the interval of 𝑥 from (−1,+1) to (−∞,+∞). Therefore, the attacker have no way to perform a successful attack using Bergamo et al.'s method.

5.7. The Proposed Protocol Can Resist Off-Line Dictionary Attack

In the off-line dictionary attack, the adversary can recode all transmitted messages in the initialization phase and attempt to guess using 𝐴′𝑠/𝐵′𝑠 identities ID_𝐴/ID_𝐵 and passwords 𝑃_𝐴/𝑃_𝐵 from the recorded massages. An attacker tries to obtain identity and password verification information from Δ_𝐴, he must guess 𝑛,𝑃_𝐴,ID_𝐴 correctly at the same time. However, the probability of guessing the three numbers correctly in the same attempt is nearly zero. Furthermore, even if the attacker guesses one parameter correctly, he or she cannot verify it with any password verifier information. Hence, the proposed protocol is secure against off-line dictionary attack.

According to the above analysis, we list the security properties' comparison of Chen et al.'s protocol and our protocol in Table 3.

Table 3 

Comparison of security properties.

6. Computational Efficiency Analysis

The proposed protocol is achieved through DLP and DHP problems based on enhanced Chebyshev polynomials. It enjoys the following advantages. (1) In the initial phase, we take 𝐴 for example, 𝑆 only needs to test 𝐷=_𝐴^?𝐷_𝐼, where 𝐷_𝐼 denotes the users' component of authentication information and computes Δ_𝐴. However, in Chen et al.'s protocol, 𝑆 has to compute (𝑉_𝐴,𝑟_𝐴,𝑒_𝐴,𝑠_𝐴). In a word, our protocol greatly reduces the computational complexity and computational cost. Hence, our scheme is more efficient and practical. (2)𝑉^′_𝐴,𝑉^′_𝐵 can be precomputed off-line in our protocol, which improves the computational efficiency and saves communication bandwidth. The detailed comparison is shown in Table 4.

Table 4 

Comparison of computation overhead in initialization phase.

7. Conclusion

In this paper, we have applied semigroup property of enhanced Chebyshev polynomials to present a novel authenticated key exchange protocol. To the best of our knowledge, it is the first time to realize three-party authenticated key exchange protocol preserving user anonymity with semigroup property of enhanced Chebyshev polynomials. First, we argued that Chen et al.'s protocol has computational efficiency problem in initialization phase and cannot protect user anonymity, user has no choice in choosing his password, and there is no provision for revocation of lost or stolen smart card leading to man-in-the-middle attack. To surmount these identified drawbacks, we have proposed an enhanced protocol to reduce computational complexity and computational cost in initialization phase and improve security. Hence, our proposed protocol is more efficient and practical. Furthermore, analysis shows that our protocol can resist various kinds of attacks.

Acknowledgments

The authors are grateful to the anonymous referees for their valuable comments and suggestions to improve the presentation of this paper. This work is supported by the National Basic Research Program of China (973 Program) (Grant no. 2010CB923200), the National Natural Science Foundation of China (Grant nos. 61003285, 61121061), the Foundation for the Author of National Excellent Doctoral Dissertation of PR China (Grant no. 200951), the Asia Foresight Program under NSFC Grant (Grant no. 61061040320), and the Specialized Research Fund for the Doctoral Program of Higher Education (Grant no. 20100005110002).