Applying LU Decomposition of Matrices to Design Anonymity Bilateral Remote User Authentication Scheme

Abstract

We apply LU decomposition of matrices to present an anonymous bilateral authentication scheme. This paper aims at improving security and providing more excellent performances for remote user authentication scheme. The proposed scheme can provide bilateral authentication and session key agreement, can quickly check the validity of the input password, and can really protect the user anonymity. The security of the proposed scheme is based on the discrete logarithm problem (DLP), Diffie-Hellman problem (DHP), and the one-way hash function. It can resist various attacks such as insider attack, impersonation attack, server spoofing attack, and stolen smart card attack. Moreover, the presented scheme is computationally efficient for real-life implementation.

1. Introduction

The remote user authentication scheme allows the user and the remote server to mutually authenticate each other over public network environments, and then the authorized user can access the services and resources which are provided by the remote server. Generally, the password-based authentication scheme provides an efficient and secure way for mutual authentication and allows the user and the server to establish a shared session key for future secret communication after the mutual authentication process. In 1981, Lamport [1] first proposed a password-based remote user authentication scheme for the insecure communication. Since then, the researchers have proposed many password-based remote user authentication schemes [2–7] to ensure the secure communication through the public network, and also many studies [8–18] have been presented to enhance the security or improve the computation and communication costs of the remote user authentication scheme.

In the public network environments, it is important to ensure user anonymity such that the user’s real identity can only be revealed by authorized entities. In 2000, Lee and Chang [19] proposed a user identification scheme with key distribution preserving user anonymity for the distributed computer network. However, Wu and Hsu [20] pointed out that Lee and Chang’s scheme cannot protect user anonymity as they claimed, and they proposed an enhanced scheme. Later, Yang et al. [21] showed that Wu and Hsu’s scheme cannot resist impersonation attack and proposed an improved scheme which is more secure and efficient. Unfortunately, Mangipudi and Katti [22] presented that Yang et al.’s protocol is vulnerable to a Denial-of-Service (DoS) attack and proposed a secure identification and key agreement protocol with user anonymity. Recently, Wang et al. [23] presented a secure and efficient identification and key agreement protocol with user anonymity based on the difficulty of computing the elliptic curve Diffie-Hellman. Their scheme’s computation cost is lower and is suitable for applications in low power computing environments.

In 2004, Choi and Youn [24] proposed a novel data encryption and distribution approach using LU decomposition of matrices. Then, Pathan et al. [25, 26] proposed two efficient bilateral remote user authentication schemes based on LU decomposition of matrices. Nevertheless, these schemes have several weaknesses, such as they cannot resist replay attacks, they cannot preserve the user anonymity, the server and users cannot agree on a session key, and so forth. To address these issues, Tseng et al. [27] proposed a user authentication scheme based on LU decomposition of matrices. They claimed that their scheme can resist replay attack, forgery attack, and insider attack and provide user anonymity. Whereas, after careful analysis, we find that Tseng et al.’s scheme is still vulnerable to insider attack, stolen smart card attack and inefficient for wrong password login and does not provide user anonymity. To overcome these existed weaknesses of Tseng et al.’s scheme, we propose a novel bilateral authentication scheme with user anonymity using LU decomposition of matrices. Analysis shows that our scheme not only can provide better security properties but also is more efficient than the other authentication schemes.

The rest of this paper is organized as follows: Section 2 introduces the necessary preliminaries of this paper. The brief review of Tseng et al.’s scheme is provided in Section 3. Section 4 describes a cryptanalysis of Tseng et al.’s scheme. The proposed scheme and the corresponding analysis are presented in Sections 5 and 6, respectively. Finally, we conclude this paper in Section 7.

2. Preliminaries

In this section, we introduce some basic information about the LU decomposition of matrices and Discrete logarithm problem, and they are the mathematical basis of our proposed bilateral remote user authentication protocol with user anonymity.

2.1. LU Decomposition of Matrices

From the matrix theory, LU decomposition factorizes a matrix as the product of a lower triangular matrix and an upper triangular matrix. Let 𝐴 be a square matrix; an LU decomposition of matrix 𝐴 is the form 𝐴=𝐿𝑈, where 𝐿 is a lower triangular matrix and 𝑈 is an upper triangular matrix. This means that 𝐿 has only zeros above the diagonal and 𝑈 has only zeros below the diagonal. For example, for a 4×4 matrix 𝐴, its LU decomposition looks like 𝑎𝐴=¹¹𝑎₁₂𝑎₁₃𝑎₁₄𝑎₂₁𝑎₂₂𝑎₂₃𝑎₂₄𝑎₃₁𝑎₃₂𝑎₃₃𝑎₃₄𝑎₄₁𝑎₄₂𝑎₄₃𝑎₄₄=𝑙₁₁𝑙000₂₁𝑙₂₂𝑙00₃₁𝑙₃₂𝑙₃₃0𝑙₄₁𝑙₄₂𝑙₄₃𝑙₄₄𝑢₁₁𝑢₁₂𝑢₁₃𝑢₁₄0𝑢₂₂𝑢₂₃𝑢₂₄00𝑢₃₃𝑢₃₄000𝑢₄₄. (1)

If 𝐴 is a singular matrix of rank 𝑘, it admits an LU decomposition if all the 𝑘-leading principal minors are nonzero.

In the identity authentication system, we assume that 𝑛 is the number of users the system can support. We can introduce the LU decomposition into the user authentication system to ensure the security of the system. In the system initialization phase, the remote server generates a symmetric matrix 𝐴_𝑛×𝑛 as his/her master secret key. With the LU decomposition, the server can separate the symmetric key matrix 𝐴_𝑛×𝑛 to the product of a lower triangular matrix 𝐿_𝑛×𝑛 and an upper triangular matrix 𝑈_𝑛×𝑛, that is, 𝐴_𝑛×𝑛=𝐿_𝑛×𝑛𝑈_𝑛×𝑛, and stores these matrices in other servers.

Since 𝐴 is a symmetric matrix, we have that 𝑎_𝑖𝑗=𝑎_𝑗𝑖, for 1≤𝑖≤𝑛 and 1≤𝑗≤𝑛, and the product of the 𝑥th row of matrix 𝐿_𝑛×𝑛 and the 𝑦th column of matrix 𝑈_𝑛×𝑛 is equal to the product of the 𝑦th row of matrix 𝐿_𝑛×𝑛 and the 𝑥th column of matrix 𝑈_𝑛×𝑛. For example, suppose 𝐴 is a 4×4 symmetric matrix with LU decomposition as follows: 𝐴=12342587381194796. (2) We can perform elementary row operations to get the lower matrix 𝐿 and upper matrix 𝑈 as follows: 1𝐿=1000210032104−121,𝑈=1234012−100−2−1000−212. (3) Given 𝑖=3 and 𝑗=4, we can compute 𝑎₃₄ and 𝑎₄₃ as follows: 𝑎₃₄=𝐿_𝑅(3)×𝑈_𝐶(4)=3210×4−1−1−212^𝑇𝑎=9,₄₃=𝐿_𝑅(4)×𝑈_𝐶(3)=14−121×32−20^𝑇=9, (4) where 𝐿_𝑅(3) denotes the 3rd row of the matrix 𝐿 and 𝑈_𝐶(4) denotes the 4th column of the matrix 𝑈, and we have that 𝑎₃₄=𝑎₄₃.

2.2. Discrete Logarithm Problem

The detailed information about discrete logarithm problem can be found in the literature [28], and we briefly introduce the discrete logarithm problem as follow. In a multiplicative group ⟨𝑔⟩ of order 𝑞, where 𝑝=2𝑞+1 is the modulus for the group, both 𝑝 and 𝑞 are public large prime numbers. This implies(1)⟨𝑔⟩={𝑋∣𝑋=𝑔^𝑥mod𝑝, for 𝑥=1,2,3} is a finite set of size 𝑞, where 2≤𝑔≤𝑝−1 and 𝑔^𝑞mod𝑝=1.(2)Given 𝑥 and 𝑔, computing the modular exponentiation 𝑋=𝑔^𝑥mod𝑝 is relatively easy. However, given 𝑋 and 𝑔, it is computationally infeasible to find 𝑥 such that 𝑋=𝑔^𝑥mod𝑝; namely, in ⟨𝑔⟩, the discrete logarithm problem is intractable [28].(3)Moreover, given 𝑔, 𝑝, 𝑋=𝑔^𝑥mod𝑝??and 𝑌=𝑔^𝑦mod𝑝, computing 𝐾=𝑔^𝑥𝑦?mod?𝑝, which is known as the Diffie-Hellman problem, is also intractable [28].

3. Review of Tseng et al.’s Scheme

In this section, we briefly review Tseng et al.’s scheme, and more details can be found in [27]. Tseng et al.’s scheme contains four phases, that is, the registration phase, the login phase, the authentication phase, and the password change phase. The notations used throughout this paper are listed in Table 1.

Table 1 

Notations used in this paper.

3.1. Registration Phase

Suppose a new user 𝑈_𝑖 with the identity ID_𝑖 wants to register himself/herself with the server for access the remote services. 𝑈_𝑖 randomly chooses his/her password PW_𝑖 and sends ID_𝑖,ℎ(PW_𝑖) to the server through a secure channel. Upon receiving the registration request message, the server takes the following steps:(1) generates two random numbers 𝑥_𝑖,𝑦_𝑖 between 1 and 𝑛. Then selects the 𝑥_𝑖th row from the matrix 𝐿 (denoted as 𝐿_𝑅(𝑥_𝑖)), the 𝑥_𝑖th column from matrix 𝑈 (denoted as 𝑈_𝐶(𝑥_𝑖)), and the 𝑦_𝑖th column from the matrix 𝑈 (denoted as 𝑈_𝐶(𝑦_𝑖));(2) computes (𝐾_{𝑥𝑖𝑦𝑖},𝜃_𝑖,𝑣_𝑖) as follows:??𝐾_{𝑥𝑖𝑦𝑖}=𝐿_𝑅(𝑥_𝑖)×𝑈_𝐶(𝑦_𝑖),??𝜃_𝑖=ℎ(ID_𝑖⊕𝐾_{𝑥𝑖𝑦𝑖})⊕ℎ(PW_𝑖)⊕ℎ(𝐾_𝑆),??and 𝑣_𝑖=ℎ(𝐾_𝑆)⊕𝑦_𝑖;(3) stores (𝐾_{𝑥𝑖𝑦𝑖},𝜃_𝑖,𝑈_𝐶(𝑥_𝑖),𝑣_𝑖,ℎ(⋅),𝑔,𝑝) into a smart card and submits the smart card to 𝑈_𝑖 via a secure channel.

3.2. Login Phase

When 𝑈_𝑖 wants to login into the system, 𝑈_𝑖 first inserts the smart card to the card reader and inputs his/her password PW^∗_𝑖. The smart card performs the following steps to generate the login request message:(1)Generates a random number 𝑟;(2)computes 𝐻_𝑖=𝐾_{𝑥𝑖𝑦𝑖}⊕ℎ(𝑟⊕𝑇) and 𝑆_𝑖=𝜃_𝑖⊕ℎ(PW^∗_𝑖)⊕𝑟, where 𝑇 is the current timestamp;(3)generates a random number 𝑎 and then computes 𝑟_𝑖=𝑔^𝑎mod𝑝 and 𝑅_𝑖=ℎ(𝜃_𝑖⊕𝑟_𝑖);(4)encrypts (ID_𝑖,𝑟_𝑖,𝑈_𝐶(𝑥_𝑖),𝑣_𝑖,𝑇) with 𝑅_𝑖 and computes 𝐶_𝑖=𝜃_𝑖⊕ℎ(ID_𝑖⊕𝐾_{𝑥𝑖𝑦𝑖})⊕ℎ(PW^∗_𝑖)⊕𝑅_𝑖=ℎ(𝐾_𝑆)⊕𝑅_𝑖;(5)sends the login request message 𝑀_𝑖=(𝐶_𝑖,𝐸_𝑅𝑖(ID_𝑖,𝑟_𝑖,𝑈_𝐶(𝑥_𝑖),𝑣_𝑖,𝑇),𝐻_𝑖,𝑆_𝑖,𝑇) to the server.

3.3. Authentication Phase

Upon receiving the login request message 𝑀_𝑖, the server and the user 𝑈_𝑖 perform the following operations for mutual authentication.(1)The server computes 𝑅_𝑖=𝐶_𝑖⊕ℎ(𝐾_𝑆) and decrypts 𝐸_𝑅𝑖(ID_𝑖,𝑟_𝑖,𝑈_𝐶(𝑥_𝑖),𝑣_𝑖,𝑇) with 𝑅_𝑖.(2)The server checks the validity of ID_𝑖. If ID_𝑖 is invalid, the server rejects the login request.(3)The server verifies whether the time interval (𝑇^′−𝑇)≤Δ𝑇, where 𝑇^′ is the current timestamp when the server received the message. If (𝑇^′−𝑇)≥Δ𝑇, the login request is considered out of date and is rejected.(4)The server computes 𝑦_𝑖=𝑣_𝑖⊕ℎ(𝐾_𝑆).(5)The server computes 𝐾_{𝑦𝑖𝑥𝑖}=𝐿_𝑅(𝑦_𝑖)×𝑈_𝐶(𝑥_𝑖), 𝑡=ℎ(ID_𝑖⊕𝐾_{𝑦𝑖𝑥𝑖}), and???𝑟^′=𝑆_𝑖⊕𝑇⊕ℎ(𝐾_𝑆)⊕𝑡.(6)The server verifies whether 𝐾_{𝑥𝑖𝑦𝑖} equals 𝐻_𝑖⊕ℎ(𝑟^′). If not, the server rejects the login request. Otherwise, it proceeds to the next steps.(7)The server generates a random number 𝑏 and computes 𝑟_𝑠=𝑔^𝑏mod𝑝.(8)The server computes the authenticated session key AK_𝑖=𝑟^𝑏_𝑖=𝑔^𝑎𝑏mod𝑝.(9)At last, the server sends 𝐸_𝑅𝑖(𝐾_{𝑦𝑖𝑥𝑖}⊕𝑟_𝑠,𝑟_𝑖+1,𝑇^′′) to 𝑈_𝑖, where 𝑇^′′ is the current timestamp.(10)When receiving the message 𝐸_𝑅𝑖(𝐾_{𝑦𝑖𝑥𝑖}⊕𝑟_𝑠,𝑟_𝑖+1,𝑇^′′), 𝑈_𝑖 decrypts the message, gets 𝐾_{𝑦𝑖𝑥𝑖}⊕𝑟_𝑠, and verifies whether (𝑇^′′′−𝑇^′′)≤Δ𝑇, where 𝑇^′′′ is the current timestamp. If so, 𝑈_𝑖 proceeds to the next steps.(11)𝑈_𝑖 checks whether decrypted data contain the value 𝑟_𝑖+1. If so, 𝑈_𝑖 uses 𝐾_{𝑦𝑖𝑥𝑖} to compute 𝑟_𝑠=(𝐾_{𝑦𝑖𝑥𝑖}⊕𝑟_𝑠)⊕𝐾_{𝑦𝑖𝑥𝑖}.(12)𝑈_𝑖 generates the authenticated session key AK_𝑖 as AK_𝑖=𝑟^𝑎_𝑠=(𝑔^𝑏)^𝑎=𝑔^𝑎𝑏mod𝑝. Then 𝑈_𝑖 can communicate with the server secretly by using AK_𝑖.

3.4. Password Change Phase

When 𝑈_𝑖 wants to change his password PW_𝑖 to PW^′_𝑖, he sends (ID_𝑖,ℎ(PW_𝑖),ℎ(PW^′_𝑖)) to the server. Upon receiving the password-changing message, the server takes the following steps:(1)computes 𝜃^′_𝑖=𝜃_𝑖⊕ℎ(PW_𝑖)⊕ℎ(PW^′_𝑖)=ℎ(ID_𝑖⊕𝐾_{𝑥𝑖𝑦𝑖})⊕ℎ(PW^′_𝑖)⊕ℎ(𝐾_𝑆);(2)replaces 𝜃_𝑖 with 𝜃^′_𝑖 in the smart card.

4. Cryptanalysis of Tseng et al.’s Scheme

Tseng et al. claimed that their scheme can protect user anonymity and can resist various known attacks. However, after careful analysis, we find that their scheme cannot really protect the user anonymity and is vulnerable to insider attack, server spoofing attack. Besides, their scheme is inefficient for wrong password login. We analyze the security weaknesses of Tseng et al.’s scheme as below.

4.1. Attacks against the User Anonymity

In order to prevent the attacker from tracking the user’s movements, it is important to ensure user anonymity such that the user’s real identity can only be recognized by the server.

Kocher et al. [29] and Messerges et al. [30] have pointed out that the confidential information stored on the smart card can be extracted by physically monitoring its power consumption. So, in Tseng et al.’s scheme, a legal but malicious user 𝑈_𝐴 can extract information (𝐾_{𝑥𝐴𝑦𝐴},𝜃_𝐴,𝑈_𝐶(𝑥_𝐴),𝑣_𝐴,ℎ(⋅),𝑝,𝑔) from his/her own smart card, and with his/her own identity ID_𝐴 and password PW_𝐴, he/she can compute the value of ℎ(𝐾_𝑆)=𝜃_𝐴⊕ℎ(ID_𝐴⊕𝐾_{𝑥𝐴𝑦𝐴})⊕ℎ(PW_𝐴). When the valid login request message 𝑀_𝑖=(𝐶_𝑖,𝐸_𝑅𝑖(ID_𝑖,𝑟_𝑖,𝑈_𝐶(𝑥_𝑖),𝑣_𝑖,𝑇),𝐻_𝑖,𝑆_𝑖,𝑇) of a legal user 𝑈_𝑖 was to be intercepted by this malicious user 𝑈_𝐴 from the public communication channel, the malicious user 𝑈_𝐴 can compute 𝑅_𝑖=𝐶_𝑖⊕ℎ(𝐾_𝑆), and then he/she can decrypts 𝐸_𝑅𝑖(ID_𝑖,𝑟_𝑖,𝑈_𝐶(𝑥_𝑖),𝑣_𝑖,𝑇) using 𝑅_𝑖 to obtain (ID_𝑖,𝑟_𝑖,𝑈_𝐶(𝑥_𝑖),𝑣_𝑖,𝑇) of the user 𝑈_𝑖. Obviously, the malicious user 𝑈_𝐴 can obtain the real identity ID_𝑖 of the user 𝑈_𝑖. From the above discussion, we can see that Tseng et al.’s scheme cannot really protect user anonymity.

4.2. Insider Attack

In the registration phase of Tseng et al.’s scheme, the user 𝑈_𝑖 sends ID_𝑖,ℎ(PW_𝑖) to the server for registration, and these information can be acquired by the privileged insider. However, in password change phase, the server simply not checks the validity of user 𝑈_𝑖’s ID_𝑖 and PW_𝑖. So, this privileged insider of the remote system can masquerade as the user 𝑈_𝑖 to send the triple (ID_𝑖,ℎ(PW_𝑖),ℎ(PW^′_𝑖)) to the server to perform the password-changing phase. Upon receiving the password-changing message, the server takes the following steps:(1)computes 𝜃^′_𝑖=𝜃_𝑖⊕ℎ(PW_𝑖)⊕ℎ(PW^′_𝑖)=ℎ(ID_𝑖⊕𝐾_{𝑥𝑖𝑦𝑖})⊕ℎ(PW^′_𝑖)⊕ℎ(𝐾_𝑆);(2)replaces 𝜃_𝑖 with 𝜃^′_𝑖 in the smart card.

Therefore, since the server does not check the validity of the user’s identity and password when the user wants to change his/her password, Tseng et al.’s scheme is vulnerable to insider attack, and the privileged insider can easily change the legal user’s password.

4.3. Stolen Smart Card Attack

Stolen smart card attack is that if the user’s smart card is lost or stolen, the attacker can extract the information stored in the smart card and can easily change the password of the smart card, can guess the password of the user by using password guessing attacks, or can impersonate the user to login to the system.

In Tseng et al.’s scheme, a legal but malicious user 𝑈_𝐴 having his own smart card can gather information (𝐾_{𝑥𝐴𝑦𝐴},𝜃_𝐴,𝑈_𝐶(𝑥_𝐴),𝑣_𝐴,ℎ(⋅),𝑝,𝑔) from his own smart card, and he/she can get the value of ℎ(𝐾_𝑆) as shown in Section 4.1. Now the malicious user 𝑈_𝐴 can intercept a valid login request message 𝑀_𝑖=(𝐶_𝑖,𝐸_𝑅𝑖(ID_𝑖,𝑟_𝑖,𝑈_𝐶(𝑥_𝑖),𝑣_𝑖,𝑇),𝐻_𝑖,𝑆_𝑖,𝑇) of the legal user 𝑈_𝑖 from the public communication channel. Then the malicious user 𝑈_𝐴 can compute 𝑅_𝑖=𝐶_𝑖⊕ℎ(𝐾_𝑆) and can get the identity ID_𝑖 of user 𝑈_𝑖 by decrypt 𝐸_𝑅𝑖(ID_𝑖,𝑟_𝑖,𝑈_𝐶(𝑥_𝑖),𝑣_𝑖,𝑇) using 𝑅_𝑖. In case the user 𝑈_𝑖’s smart card is stolen by this malicious user 𝑈_𝐴, he/she can extract the information (𝐾_{𝑥𝑖𝑦𝑖},𝜃_𝑖,𝑈_𝐶(𝑥_𝑖),𝑣_𝑖,ℎ(⋅),𝑔,𝑝) from the memory of the smart card. With the information ID_𝑖, ℎ(𝐾_𝑆), 𝐾_{𝑥𝑖𝑦𝑖}, and 𝜃_𝑖, the malicious user 𝑈_𝐴 can guess 𝑈_𝑖’s password by the following processes.(1)The attacker computes ℎ(PW_𝑖)=𝜃_𝑖⊕ℎ(ID_𝑖⊕𝐾_{𝑥𝑖𝑦𝑖})⊕ℎ(𝐾_𝑆).(2)The attacker chooses a password PW^′_𝑖 from a uniformly scattered dictionary.(3)The attacker computes ℎ(PW^′_𝑖) and verifies the correctness of password PW^′_𝑖 by checking whether ℎ(PW^′_𝑖) equals ℎ(PW_𝑖) or not.(4)The attacker repeats steps (2) and (3) until ℎ(PW^′_𝑖) equals ℎ(PW_𝑖) to guess a correct password.

After getting the correct ID_𝑖, and PW_𝑖, the malicious user 𝑈_𝐴 can easily change the password of user 𝑈_𝑖 and can impersonate 𝑈_𝑖 to login to the system.

4.4. Inefficient for Wrong Password Login

Generally speaking, in practical applications, the user 𝑈_𝑖 may keep different passwords for different applications to ensure security. Users are easy to confuse the password such that the user cannot match the application with the correct password; in other words, it is possible that the user enters a wrong password in the login phase.

In the login phase, the smart card does not verify the correctness of the entered password by the user. If the user 𝑈_𝑖 inputs a wrong password PW^′_𝑖(≠PW_𝑖) by mistake, the smart card and the server will perform the following steps:(1)generates a random number 𝑟, gets the current timestamp 𝑇, and computes 𝐻_𝑖=𝐾_{𝑥𝑖𝑦𝑖}⊕ℎ(𝑟⊕𝑇) and 𝑆_𝑖=𝜃_𝑖⊕ℎ(PW^′_𝑖)⊕𝑟;(2)generates a random number 𝑎 and computes 𝑟_𝑖=𝑔^𝑎mod𝑝 and 𝑅_𝑖=ℎ(𝜃_𝑖⊕𝑟_𝑖);(3)encrypts (ID_𝑖,𝑟_𝑖,𝑈_𝐶(𝑥_𝑖),𝑣_𝑖,𝑇) with 𝑅_𝑖 and computes 𝐶_𝑖=𝜃_𝑖⊕ℎ(ID_𝑖⊕𝐾_{𝑥𝑖𝑦𝑖)}⊕ℎ(PW^′_𝑖)⊕𝑅_𝑖(=ℎ(𝐾_𝑆)⊕ℎ(PW_𝑖)⊕ℎ(PW^′_𝑖)⊕𝑅_𝑖);(4)sends the login request message 𝑀_𝑖=(𝐶_𝑖,𝐸_𝑅𝑖(ID_𝑖,𝑟_𝑖,𝑈_𝐶(𝑥_𝑖),𝑣_𝑖,𝑇),𝐻_𝑖,𝑆_𝑖,𝑇) to the server;(5)when the server receives the login request message 𝑀_𝑖, the server computes 𝑅^′_𝑖=𝐶_𝑖⊕ℎ(𝐾_𝑆)=ℎ(𝐾_𝑆)⊕ℎ(PW_𝑖)⊕ℎ(PW^′_𝑖)⊕𝑅_𝑖⊕ℎ(𝐾_𝑆)=ℎ(PW_𝑖)⊕ℎ(PW^′_𝑖)⊕𝑅_𝑖. It is obvious that 𝑅^′_𝑖≠𝑅_𝑖, since PW^′_𝑖≠PW_𝑖;(6)when the server decrypts 𝐸_𝑅𝑖(ID_𝑖,𝑟_𝑖,𝑈_𝐶(𝑥_𝑖),𝑣_𝑖,𝑇) using 𝑅^′_𝑖, the server will find that the user 𝑈_𝑖’s identity is invalid. Thus, the server rejects the user 𝑈_𝑖’s login request.

In this case, the user 𝑈_𝑖 is unaware of the fact that he/she has entered his/her password incorrectly in the login phase, which results in unnecessary extra communication and computation costs.

5. The Proposed Scheme

In this section, we apply the LU decomposition of matrices to design a novel bilateral remote user authentication scheme with user anonymity, where LU decomposition of matrices ensures secretly information exchange between the user and the server, and enhances the security of the authentication scheme. To initiate the scheme, the server chooses a 𝑛×𝑛 symmetric matrix 𝐴 with LU decomposition as 𝐴=𝐿𝑈 and secretly stores these matrices as his/her secret key in other servers, where 𝑛 is the number of users the system can support. The server chooses a secret key 𝐾_𝑆 with 256 bits, which makes the 𝐾_𝑆 have a high entropy and can resist brutal force attack. The proposed scheme also contains four phases, that is, the registration phase, the login phase, the authentication and key agreement phase, and the password change phase. The proposed scheme contains the timestamps, so the authentication system needs to deploy a mechanism such as NTP (Network Time Protocol) to ensure clock synchronization between the user and the remote server. The detailed information about these phases are described as follows and also shown in Figure 1.

Figure 1 

The proposed scheme.

5.1. Registration Phase

When a user 𝑈_𝑖 wants to become a legal user of the system, 𝑈_𝑖 generates his own identity ID_𝑖 and easy-to-remember password PW_𝑖 and selects and remembers a random number 𝑏_𝑖 (the bit length of 𝑏_𝑖 is assumed to be 128). Then, 𝑈_𝑖 computes RPW_𝑖=ℎ(𝑏_𝑖‖PW_𝑖) and submits ID_𝑖 and RPW_𝑖 to the server over a secure communication channel for registration. ℎ(⋅) used throughout the proposed scheme is a collision-free one-way hash function such as SHA-1 [31], which maps any message with the length less than 2⁶⁴ bit to a 160-bit message digest. Upon receiving the registration request message, the server 𝑆 and the user 𝑈_𝑖 take the following steps.(1)The server 𝑆 computes 𝐴_𝑖=ℎ(ID_𝑖‖𝐾_𝑆), 𝐵_𝑖=𝐴_𝑖⊕ℎ(ID_𝑖⊕RPW_𝑖), and 𝐶_𝑖=ℎ(𝐴_𝑖).(2)The server 𝑆 chooses two random numbers 𝑥_𝑖,𝑦_𝑖∈[1,𝑛] and computes 𝐾_{𝑥𝑖𝑦𝑖}=𝐿_𝑅(𝑥_𝑖)×𝑈_𝐶(𝑦_𝑖), 𝐷_𝑖=ℎ(𝐾_{𝑥𝑖𝑦𝑖}⊕𝐾_𝑆)⊕ℎ(ID_𝑖‖RPW_𝑖), 𝐸_𝑖=ℎ(𝐾_𝑆)⊕𝑦_𝑖, where the meaning of symbols 𝐿_𝑅(𝑥_𝑖) and 𝑈_𝐶(𝑦_𝑖) are the same as in Section 3.1.(3)The server stores {𝐵_𝑖,𝐶_𝑖,𝐾_{𝑥𝑖𝑦𝑖},𝐷_𝑖,𝐸_𝑖,𝑈_𝐶(𝑥_𝑖),𝑔,𝑝} into a smart card and issues the smart card to 𝑈_𝑖 via a secure channel, where 𝑝 is a big prime and 𝑝=2𝑞+1, 𝑞 is also a big prime, and 𝑔 is a primitive element with 𝑔^𝑞=1mod𝑝.(4)At last, in order to facilitate the subsequent verification, the user 𝑈_𝑖 enters the remembered random number 𝑏_𝑖 into the smart card, and the smart card contains {𝐵_𝑖,𝐶_𝑖,𝐾_{𝑥𝑖𝑦𝑖},𝐷_𝑖,𝐸_𝑖,𝑈_𝐶(𝑥_𝑖),𝑔,𝑝,𝑏_𝑖}.

5.2. Login Phase

When the user 𝑈_𝑖 wants to login to the system, 𝑈_𝑖 inserts his/her smart card into the card reader and inputs his/her identity ID_𝑖, password PW_𝑖. Then the smart card performs the following operations:(1)computes RPW_𝑖=ℎ(𝑏_𝑖‖PW_𝑖), 𝐴_𝑖=𝐵_𝑖⊕ℎ(ID_𝑖⊕RPW_𝑖), and 𝐶^′_𝑖=ℎ(𝐴_𝑖) and compares 𝐶=^′_𝑖^?𝐶_𝑖. If they are equal, it means the user inputs the right identity and password. Otherwise, the input identity or password is not valid, and the smart card terminates the session;(2)generates a random number 𝑟, gets current timestamp 𝑇, and computes 𝐹_𝑖=𝐷_𝑖⊕ℎ(ID_𝑖‖RPW_𝑖), 𝐺_𝑖=𝐹_𝑖⊕𝑟, CID_𝑖=𝑟⊕ID_𝑖, and 𝐻_𝑖=𝐸_𝑖⊕𝑇;(3)generates a random number 𝑟_𝑖∈(1,𝑞) and computes 𝑅_𝑖=𝑔^𝑟𝑖mod𝑝, 𝐽_𝑖=𝑅_𝑖⊕ℎ(𝑟⊕𝑇), and 𝑀_𝑖=ℎ(ℎ(ID_𝑖‖𝐾_{𝑥𝑖𝑦𝑖})‖𝑅_𝑖‖𝑟‖𝑇), where 𝑀_𝑖 is used to resist the forgery attack such that any change of the login request message is invalid login message;(4)submits the login request message {𝐺_𝑖,CID_𝑖,𝐻_𝑖,𝐽_𝑖,𝑈_𝐶(𝑥_𝑖),𝑀_𝑖,𝑇} to the server.

5.3. Verification and Key Agreement Phase

Upon receiving the login request message {𝐺_𝑖,CID_𝑖,𝐻_𝑖,𝐽_𝑖,𝑈_𝐶(𝑥_𝑖),𝑀_𝑖,𝑇}, the server performs the following steps for mutual authentication and key agreement.(1)The server 𝑆 verifies the validity of the time interval between 𝑇^′ and 𝑇. If (𝑇^′−𝑇)≥Δ𝑇, 𝑆 rejects the login request. Here 𝑇^′ is the timestamp, when the login request message was received, and Δ𝑇 is the expected valid time interval for transmission delay.(2)The server 𝑆 computes 𝑦_𝑖=𝐻_𝑖⊕ℎ(𝐾_𝑆)⊕𝑇, 𝐾_{𝑦𝑖𝑥𝑖}=𝐿_𝑅(𝑦_𝑖)×𝑈_𝐶(𝑥_𝑖).(3)The server 𝑆 computes 𝑟^′=ℎ(𝐾_{𝑦𝑖𝑥𝑖}⊕𝐾_𝑆)⊕𝐺_𝑖, 𝑅^′_𝑖=𝐽_𝑖⊕ℎ(𝑟^′⊕𝑇), and ID_𝑖=CID_𝑖⊕𝑟^′ and checks whether ID_𝑖 is the registered identity of a valid user. If so, the server 𝑆 performs the following steps. Otherwise, the session is terminated.(4)The server 𝑆 computes 𝑀^′_𝑖=ℎ(ℎ(ID_𝑖‖𝐾_{𝑦𝑖𝑥𝑖})‖𝑅^′_𝑖‖𝑟^′‖𝑇) and checks 𝑀=^′_𝑖^?𝑀_𝑖. If they are equal, the validity of the user 𝑈_𝑖 is authenticated by the server 𝑆. Otherwise, the session is terminated by the server 𝑆.(5)For achieving mutual authentication, the server chooses a random number 𝑟_𝑠∈(1,𝑞), gets the current timestamp 𝑇^′′, and computes 𝑅_𝑠=𝑔^𝑟𝑠mod𝑝, 𝐾_𝑖=𝑅_𝑠⊕𝑅^′_𝑖, and 𝑀_𝑠=ℎ(ℎ(ID_𝑖‖𝐾_{𝑦𝑖𝑥𝑖})‖𝑅^′_𝑖‖𝑅_𝑠‖𝑟^′‖𝑇^′′).(6)The server 𝑆 submits the reply message {𝐾_𝑖,𝑀_𝑠,𝑇^′′} to the user 𝑈_𝑖 for mutual authentication.(7)After receiving the mutual authentication message (𝐾_𝑖,𝑀_𝑠,𝑇^′′), the smart card verifies the validity of the time interval between 𝑇^′′′ and 𝑇^′′. If (𝑇^′′′−𝑇^′′)≥Δ𝑇, the user 𝑈_𝑖 terminates the session. Here 𝑇^′′′ is the timestamp, when the mutual authentication message was received.(8)The smart card computes 𝑅^′_𝑠=𝐾_𝑖⊕𝑅_𝑖, 𝑀^′_𝑠=ℎ(ℎ(ID_𝑖‖𝐾_{𝑥𝑖𝑦𝑖})‖𝑅_𝑖‖𝑅^′_𝑠‖𝑟‖𝑇^′′) and checks 𝑀=^′_𝑠^?𝑀_𝑠. If they are equal, the server 𝑆 is authenticated by the user 𝑈_𝑖, and the server 𝑆 and user achieve mutual authentication. Otherwise, the smart card terminates this session.(9)At last, the user 𝑈_𝑖 and the server 𝑆 can compute AK_𝑖=𝑅^′𝑟𝑖_𝑠mod𝑝=𝑔^{𝑟𝑖𝑟𝑠}mod𝑝 and AK_𝑖=𝑅^′𝑟𝑠_𝑖mod𝑝 =𝑔^{𝑟𝑖𝑟𝑠}mod𝑝, respectively, as their shared session key for future secret communication.

5.4. Password Change Phase

When the user 𝑈_𝑖 wants to renew his/her password to PW^new_𝑖, the user 𝑈_𝑖 can update his/her password by performing the following steps without communicating with the server 𝑆.(1)The user 𝑈_𝑖 inserts his smart card into a card reader and inputs his identity ID_𝑖 and old password PW_𝑖 and requests to change his/her password.(2)The smart card computes RPW_𝑖=ℎ(𝑏_𝑖‖PW_𝑖), 𝐴_𝑖=𝐵_𝑖⊕ℎ(ID_𝑖⊕RPW_𝑖), 𝐶^′_𝑖=ℎ(𝐴^′_𝑖) and compares 𝐶=^′_𝑖^?𝐶_𝑖. If they are not equal, the password change request is rejected. Otherwise the user 𝑈_𝑖 inputs a new password PW^new_𝑖.(3)The smart card computes RPW^∗_𝑖=ℎ(𝑏_𝑖‖PW^new_𝑖), 𝐵^∗_𝑖=𝐴_𝑖⊕ℎ(ID_𝑖⊕RPW^∗_𝑖), and 𝐷^∗_𝑖=𝐷^∗_𝑖⊕ℎ(ID_𝑖‖RPW_𝑖)⊕ℎ(ID_𝑖‖RPW^∗_𝑖).(4)Finally, the smart card replaces 𝐵_𝑖 and 𝐷_𝑖 with 𝐵^∗_𝑖 and 𝐷^∗_𝑖, respectively, to update his/her password.

6. Analysis of the Proposed Scheme

In this section, we first discuss the security features of the proposed anonymity bilateral authentication scheme. Then we evaluate the performance and functionality of our proposed scheme and make comparisons with Tseng et al.’ scheme.

6.1. Security of Session Key

6.1.1. Known-Key Secrecy

Known-key secrecy means that compromise of one session key should not compromise other session keys. In our scheme, the session key AK_𝑖=𝑔^{𝑟𝑖𝑟𝑠}mod𝑝 is associated with 𝑟_𝑖,𝑔^𝑟𝑖mod𝑝,𝑟_𝑠, and 𝑔^𝑟𝑠mod𝑝. According to discrete logarithm problem (DLP) and Diffie-Hellman problem (DHP), knowing a session key AK_𝑖=𝑔^{𝑟𝑖𝑟𝑠}mod𝑝 and the random number 𝑟_𝑖, 𝑟_𝑠 is useless for computing the other session keys AK^′_𝑖=𝑔^{𝑟′𝑖𝑟′𝑠}mod𝑝 without knowing 𝑟^′_𝑖 and 𝑟^′_𝑠. It is impossible for an attacker to compute the other session key AK^′_𝑖, and the proposed scheme provides known-key security.

6.1.2. Forward Secrecy

Forward secrecy means that if the long-term secret keys (e.g., the server’s secret key 𝐾_𝑆 and user’s password PW_𝑖) are compromised, the secrecy of previously established session keys should not be affected. In our scheme, we assume that the master secret key 𝐾_𝑆 and the password PW_𝑖 of user 𝑈_𝑖 are compromised for some reasons, and the attacker gets the previous communication message {𝐺_𝑖,CID_𝑖,𝐻_𝑖,𝐽_𝑖,𝑈_𝐶(𝑥_𝑖),𝑀_𝑖,𝑇} and {𝐾_𝑖,𝑀_𝑠,𝑇^′′} from the public channel; then the attacker can get 𝑦_𝑖=𝐻_𝑖⊕ℎ(𝐾_𝑆)⊕𝑇. However, since the secret matrix 𝐿 has been maintained only by the server 𝑆, the attacker cannot compute 𝐾_{𝑥𝑖𝑦𝑖}, 𝑟 and has no way to know 𝑟_𝑖, 𝑅_𝑖, 𝑟_𝑠, and 𝑅_𝑠. Therefore, the attacker has no way to get the previous session key AK_𝑖=𝑔^{𝑟𝑖𝑟𝑠}?mod?𝑝, and our scheme can ensure perfect forward secrecy.

6.2. Protect User Anonymity

In the login phase and authentication phase of the proposed scheme, the real identity ID_𝑖 of user 𝑈_𝑖 is not transmit via plain text form. If the login request message {𝐺_𝑖,CID_𝑖,𝐻_𝑖,𝐽_𝑖,𝑈_𝐶(𝑥_𝑖),𝑀_𝑖,𝑇} and the mutual authentication message {𝐾_𝑖,𝑀_𝑠,𝑇^′′} are eavesdropped by an attacker from the public channel, the attacker has to get the random number 𝑟 to compute the real identity ID_𝑖. However, the attacker has no way to know 𝐾_{𝑥𝑖𝑦𝑖} and 𝐾_𝑆, so he/she has no valid method to get the random number 𝑟 and cannot reveal the real identity ID_𝑖 of the user 𝑈_𝑖. Therefore, our scheme can really protect user anonymity.

6.3. Resist Impersonation Attack

In this type of attack, in order to impersonate as a legitimate user, the attacker or a malicious user has to forge a valid login request message {𝐺_𝑖,CID_𝑖,𝐻_𝑖,𝐽_𝑖,𝑈_𝐶(𝑥_𝑖),𝑀_𝑖,𝑇} using the previously eavesdropped messages or the information obtained from the lost smart card. However, in the proposed scheme, the attacker and any malicious user 𝑈_𝐴 cannot forge a valid login request message, since he/she has no knowledge of ID_𝑖, RPW_𝑖, 𝐹_𝑖, and 𝐾_{𝑥𝑖𝑦𝑖}, so he/she cannot impersonate as the legitimate user 𝑈_𝑖.

In addition, even if the adversary or a malicious user has obtained the smart card of user 𝑈_𝑖 and extracts the parameters {𝐵_𝑖,𝐶_𝑖,𝐾_{𝑥𝑖𝑦𝑖},𝐷_𝑖,𝐸_𝑖,𝑈_𝐶(𝑥_𝑖),𝑔,𝑝,𝑏_𝑖} which are stored in the smart card by some way, he/she still cannot forge a valid login request message, since he/she have no way to get the valid ID_𝑖, PW_𝑖, where they are all protected by the one-way hash function.

Therefore, the proposed protocol is secure against impersonation attack. At the same time, the attacker cannot get the valid ID_𝑖, PW_𝑖, so the proposed protocol can resist the denial of service attack.

6.4. Resist Insider Attack

In the registration phase of the proposed scheme, the user 𝑈_𝑖 freely selects his/her password PW_𝑖 and submits the masked password RPW_𝑖=ℎ(𝑏_𝑖⊕PW_𝑖) instead of ℎ(PW_𝑖) to the server for registration. In the proposed scheme, the password must first be verified by the smart card in login and password change phase, only the adversary gets the valid password PW_𝑖 of the user 𝑈_𝑖, and he/she can impersonate the user 𝑈_𝑖 to access service. However, if the insider of the remote system gets the information ID_𝑖 and RPW_𝑖=ℎ(𝑏_𝑖⊕PW_𝑖), he/she cannot obtain the password PW_𝑖 since it is protected by the one-way hash function and cannot impersonate the user 𝑈_𝑖 to login to the system or change the user’s password. Therefore, the proposed scheme can resist insider attack properly.

6.5. Resist Stolen Smart Card Attack

Assume that the user 𝑈_𝑖’s smart card has been lost or stolen, the attacker can extract the stored information {𝐵_𝑖,𝐶_𝑖,𝐾_{𝑥𝑖𝑦𝑖},𝐷_𝑖,𝐸_𝑖,𝑈_𝐶(𝑥_𝑖),𝑔,𝑝,𝑏_𝑖} from the smart card using differential power analysis [29] and simple power analysis [30]. Even after gathering these information, in order to change the user’s password or login into the system by using the lost smart card, the attacker has to get real identity ID_𝑖 and the password PW_𝑖 correctly at the same time. However, because the attacker has not the knowledge of the master secret key 𝐾_𝑆 and meanwhile the ID_𝑖 and the PW_𝑖 are protected by one-way hash function, it is not possible for an attacker to guess the ID_𝑖 and the PW_𝑖 correctly at the same time in real polynomial time. Therefore, the proposed scheme is secure against stolen smart card attack.

6.6. Resist Server Spoofing Attack

In the proposed scheme, in order to masquerade as the remote server to cheat the user 𝑈_𝑖, the attacker has to get the secret information 𝐿 and 𝐾_𝑆 to compute the valid reply mutual authentication message. However, the secret matrix 𝐿 is only maintained by the server 𝑆 such that the attacker has no way to recover the information 𝐾_{𝑦𝑖𝑥𝑖}. On the other hand, even if the malicious user 𝑈_𝐴 has got his own smart card information {𝐵_𝐴,𝐶_𝐴,𝐾_{𝑥𝐴𝑦𝐴},𝐷_𝐴,𝐸_𝐴,𝑈_𝐶(𝑥_𝐴),𝑔,𝑝,𝑏_𝐴} and other users’ communication messages {𝐺_𝑖,CID_𝑖,𝐻_𝑖,𝐽_𝑖,𝑈_𝐶(𝑥_𝑖),𝑀_𝑖,𝑇} and {𝐾_𝑖,𝑀_𝑠,𝑇^′′}, he/she still has no way to get 𝐾_𝑆 since it is protected by the one-way hash function. So the attacker cannot get the required information 𝐿 and 𝐾_𝑆, and the proposed scheme can resist the server spoofing attack.

6.7. Efficient for Wrong Password Verification

In the login and password change phase of the proposed scheme, the validity of the password PW_𝑖 can quickly be verified by the smart card, when the user 𝑈_𝑖 inputs his/her password. If the user 𝑈_𝑖 inputs a wrong password PW^′_𝑖(≠PW_𝑖), the smart card computes RPW^′_𝑖=ℎ(𝑏_𝑖‖PW^′_𝑖)(≠ℎ(𝑏_𝑖‖PW_𝑖)=RPW_𝑖, 𝐴^′_𝑖=𝐵_𝑖⊕ℎ(ID_𝑖‖RPW^′_𝑖)=𝐴_𝑖⊕ℎ(ID_𝑖⊕RPW_𝑖)⊕ℎ(ID_𝑖‖RPW^′_𝑖)(≠𝐴_𝑖) and gets 𝐶^′_𝑖=ℎ(𝐴^′_𝑖)≠ℎ(𝐴_𝑖)=𝐶_𝑖. So, the wrong password can quickly be checked by the smart card, and the server does not need to waste unnecessary communication and computation cost to verify the validity of the password. Thus, the proposed scheme is efficient for wrong password verification.

6.8. Performance and Functionality Analysis

In this section, we evaluate the performance and functionality of our proposed scheme and make comparisons with Tseng et al.’s scheme. In order to facilitate the computational complexity analysis of the scheme, we define the following notations.𝑇_ℎ: the time for executing a one-way hash function ℎ(⋅),𝑇_𝑀: the time for performing a vector multiplication operation,𝑇_EXP: the time for performing an exponentiation operation,𝑇_ENC: the time for performing a symmetric encryption operation, and𝑇_DEC: the time for performing a symmetric decryption operation.

Because exclusion-OR operation requires very few computations, we neglect considering its computational cost in this paper. We list the result of performance comparison in Table 2, and we can see that the total computational cost of our scheme and Tesng et al.’s scheme are 2𝑇_𝑀+18𝑇_𝐻+4𝑇_EXP and 2𝑇_𝑀+9𝑇_𝐻+4𝑇_EXP+2𝑇_ENC+2𝑇_DEC, respectively. Since the symmetric cryptosystem needs more computational costs than the one-way hash functions, our scheme is more efficient than Tseng et al.’s scheme.

Table 2 

Performance comparison of our scheme and Tseng et al.'s scheme.

Table 3 shows the functional comparison of our proposed scheme and Tseng et al.’s scheme. Compared with Tseng et al.’s scheme, our scheme can resist various attacks and can really protect user anonymity. Besides, our scheme can quickly check the validity of the password in the very beginning of login phase. Therefore, our scheme is more secure and efficient than Tseng et al.’s scheme.

Table 3 

Functionality comparison between our scheme and Tseng et al.'s scheme.

7. Conclusions

In this paper, we have applied the LU decomposition of matrices to present a novel anonymity bilateral authentication scheme. First, we pointed out the security weaknesses of Tseng et al.’s scheme, that is, their scheme is vulnerable to insider attack and stolen smart card attack, is inefficient for wrong password login, and does not really provide user anonymity. To surmount these identified weaknesses, we have proposed a novel scheme using the LU decomposition of matrices to reduce computational complexity and improve security, where LU decomposition of matrices ensures secretly information exchange between the user and the server, and enhances the security of the authentication scheme. Hence, our proposed protocol is more efficient and practical.

Acknowledgments

The authors are grateful to the editor and anonymous reviewers for their valuable suggestions which improved the paper. This work was supported by the Research Fund of the State Key Laboratory of Software Development Environment under Grant no. BUAA SKLSDE-2012ZX-17, the National Natural Science Foundation of China under Grant no. 61271041, 61170296, and 61190120, and the Program for New Century Excellent Talents in University under Grant no. NECT-09-0028.