Abstract

Since the concept of ubiquitous computing is firstly proposed by Mark Weiser, its connotation has been extending and expanding by many scholars. In pervasive computing application environment, many kinds of small devices containing smart cart are used to communicate with others. In 2013, Yang et al. proposed an enhanced authentication scheme using smart card for digital rights management. They demonstrated that their scheme is secure enough. However, Mishra et al. pointed out that Yang et al.’s scheme suffers from the password guessing attack and the denial of service attack. Moreover, they also demonstrated that Yang et al.’s scheme is not efficient enough when the user inputs an incorrect password. In this paper, we analyze Yang et al.’s scheme again, and find that their scheme is vulnerable to the session key attack. And, there are some mistakes in their scheme. To surmount the weakness of Yang et al.’s scheme, we propose a more efficient and provable secure digital rights management authentication scheme using smart card based on elliptic curve cryptography.

1. Introduction

In 1991, ubiquitous computing was firstly proposed by Mark Weiser, who thought that ubiquitous computing technology could provide users service with a variety of equipment in environment which would be disappeared from the user’s consciousness [1]. Later, IBM Corporation scientists also raised the idea in 1999, and they forecasted that pervasive computing can be a way to compute everywhere, anytime, and anywhere [2, 3]. Since the computer and internet technology development, multimedia contents (image, document, music, movie, video, etc.) have been greatly enriched all the time, and all of them can be easily redistributed, copied, and downloaded on the internet without authorization. This drawback results in rampant piracy and causes huge revenue to lose to the electronic commerce [4]. As a result, in pervasive computing application environment, the protection of digital publication copyright becomes more and more important. Digital rights management (DRM) technology is developed to overcome the problem [5]. Normally, DRM is only software which usually restricts the usage of the content to protect copy and distributed contents [6–9]. The DRM system manages the procedure of the digital contents including protection, distribution, and authorization. Using DRM technology, intellectual property is respected and protected by data encryption, so it can only be accessed by authorised users without limitless distribution [10, 11].

In 2009, the first three-role based DRM implementation scenario authentication scheme using smart card was proposed by Zhang et al. [12]. Then, Yang et al. showed that Zhang et al.’s scheme was vulnerable to the insider attack and the stolen smart card attack [10]. Due to surmounting the weaknesses of Zhang et al.’s scheme, Yang et al. proposed an enhanced digital rights management authentication scheme based on smart card. They demonstrated that their scheme could preclude all the weaknesses existing in Zhang et al.’s scheme. Recently, Mishra and Mukhopadhyay cryptanalyzed Yang et al.’s scheme and found that their scheme cannot resist the password guessing attack and the denial of service attack. Moreover, they also pointed out that Yang et al.’s scheme is not efficient enough when the user inputs an incorrect password, and this drawback may cause a denial of service attack [13]. Except for the attacks mentioned by Mishra et al., we find out that Yang et al.’s scheme does not resist the session key attack. In addition to this, we also discover that there are some mistakes in their scheme.

We proposed a new efficient and provable secure digital rights management authentication scheme using smart card based on elliptic curve cryptography [14–16]. To demonstrate the scheme is provable secure, we introduce a security model AFP05 [17, 18] and analyze our scheme in this model. In the following, we will give the proof that our proposed scheme is secure in the AFP05 model. As known to all, one-way hash function is more efficient than the operation of scalar multiplication and pairings [19–21]. Moreover, the pairing operation costs much more than the scalar multiplication operation. The effort of evaluating one pairing operation is approximately three times the effort of evaluating one scalar multiplication operation. So, we cut down some pairings operation of point on elliptic curve and use hash function instead to increase the scheme’s efficiency.

The structure of this paper is arranged as follows. In Section 2, we introduce the notations and definitions used in this paper. Section 3 reviews Yang et al.’s scheme, and Section 4 discusses its weakness analysis. We show the scheme details we propose in Section 5. Section 6 shows a formal security proof of the scheme, while Section 7 demonstrates the security analysis of our proposed scheme. In Section 8, we compare our proposed scheme with Yang et al.’s and Zhang et al.’s scheme. Section 9 concludes the paper.

2. Notations and Definitions

Let be an additive group with an elliptic curve by the generator and a multiplicative cyclic group by the generator . And both of them have the prime order . Let denote a computable bilinear map satisfying the following three properties [10, 12]:(i)Computability. Given , there is an efficient algorithm to compute .(ii)Bilinear. , where and .(iii)Nondegenerate. Let be the generator of , .

Several commonly used notations and their descriptions are described after the Conclusions Section to facilitate the following references.

3. Review of Yang et al.’s Scheme

There are three phases in their scheme; they are, respectively, registration phase, mutual authentication and key agreement phase, and password update phase.

3.1. Registration Phase

3.1.1. User’s Registration Section

In this part, a user requests to be a legal user and the server conducts the next operations.

U1 (: ). The user generates his/her own identity and password freely. Then, chooses a nonce randomly and computes After that, sends to the server securely.

U2 (: ). After obtaining the message sent by , the server begins to computeThen, stores in the verification table. Afterward, the server issues a smart card containing and transmits it to through a secure channel.

U3. The is input into the smart card by the , which contains , finally.

3.1.2. Device’s Registration Section

In this section, the device requests to be authorized by the , and the following steps should be performed together with the server.

D1 (: ). The device transmits its identity to the server through a secure channel.

D2 (: ). After obtaining the message sent by , the begins to computeAnd it is sent to via a secure channel. Afterward, the device’s public key and secret key are and .

3.2. Mutual Authentication and Key Agreement Phase

M1 (: ). After the inserts his/her smart card into a smart card reader and inputs his/her identity and password , the smart card randomly chooses a secret number and a nonce . And it computesNext transmits the message to .

M2 (: ). Upon obtaining the message sent by , the chooses a number randomly and computesThen, transmits the message to .

M3 (: ). When the server receives the message, it computes and checks whether is equal to . If this holds, the will authenticate and update with . Otherwise, this authentication request is rejected. Then, computes and checks whetherIf this holds, the device is authenticated by . Otherwise, this authentication request is rejected. After that, the server generates two random strings , , and a random number . computesAt last, the replies with the message to .

The correctness of (8) is shown as follows:

 M4 (: ). After receiving the message from , computesand checks whether If this holds, the server is authenticated by the device . Otherwise, this authentication procedure fails. Then, generates a random string and computesFinally, sends the message to the user .

The correctness of (12) is shown as follows:

M5 (: ). The user computes and checks whether is equal to . If it holds, the is authenticated by the . Otherwise, this authentication procedure fails. Then, updates and with and , which are saved in the smart card. After that, generates a random string and computesFinally, generates the session key shared with by computing and sends the message back to the device .

M6. After obtaining the message sent by , the device computes The is the session key between and device .

3.3. Password Update Phase

When the user requests to change the password to a new one (), he/she should perform the next procedures.

P1 (: ). After the inserts the smart card into a smart card reader and inputs his/her identity , old password and new password . Then the smart card chooses a secret nonce randomly to compute the following results:Then, transmits to .

P2 (: ). Once obtaining the message sent by , the computesand checks whether is equal to . If it holds, the will accept the user’s request and update the verifier . Otherwise, this request procedure is rejected. Then, the server transmits the message back to the user .

P3. Once the user obtains the message sent by the server, he/she checks whether is equal to . If this holds, the user replaces and with and , where .

4. Cryptanalysis of Yang et al.’s Scheme

Recently, Mishra and Mukhopadhyay demonstrated Yang et al.’s scheme is vulnerable to the password guessing attack and the denial of service attack. Moreover, they also pointed that Yang et al.’ scheme does not present efficient login and password change phases such that smart card executes the session in case of incorrect input [13]. Based on the attacks and problems mentioned in Mishra et al.’s article, we analyze Yang et al.’s scheme and find out that the scheme does not resist the session key attack. In addition to this, we also discover that there are some mistakes in their scheme. We will introduce our new discoveries in the following.

4.1. Session Key Attack

If an attacker intercepted the message which was sent from the server to the device and modified some data in it, the user and the device may establish different session key. So the attacker can realize the session key attack as the following steps.

(1) The attacker can intercept and capture the message sent to device by the server. Next, generates a number randomly and computesThen, the message is sent to the device by the attacker .

(2) After receiving the message, computesand checks the equationObviously, they are equal. Then, generates a random string and computesFinally, sends the message to the user . In this step, the string is not equal to the random string generated by the server.

The correctness of (22) is shown as follows:(3) Because did not modify the message , is equal to . Then, updates and . After that, generates a random string and computesFinally, generates the session key shared with the device and sends the message back to the device . In this step, the string is equal to the random string generated by the server and not equal to the string computed by the device.

(4) Once obtaining the message sent by the user, the device computes is the session key shared between the user and the device . Obviously, the session key computed by the user is different from the session key computed by the device. So Yang et al.’s scheme suffers from the session key attack.

4.2. Some Mistakes

In mutual authentication and key agreement phase, the identity has not been sent to the device . But, when the device computes , it already knows the user’s identity. According to the common sense, if the user has not sent identity to the device, the device cannot obtain the user’s identity. So there is a mistake in this phase. What is more, this mistake also exists in the password update phase of Yang et al.’s scheme.

5. Our Proposed Scheme

Based on Yang et al.’s scheme, our protocol also contains four phases: the registration phase, the login phase, the key agreement phase, and the password update phase. Algorithm 1 describes our scheme’s registration phase. The login phase and the key agreement phase will be shown in Algorithm 2. At last, we show the password update phase in Algorithm 3. The detail is shown as the following.