Abstract
Secure and efficient authentication protocols are necessary for cloud service. Multi-factor authentication protocols taking advantage of smart card, user’s password and biometric, are more secure than password-based single-factor authentication protocols which are widely used in practice. However, almost all the existed two-factor authentication protocols and multi-factor authentication protocols are based on smart cards, which will inevitably lead to a series of security problems caused by the loss of smart cards. Recently, Li et al. proposed a two-factor authenticated key agreement protocol based on biometric feature and password innovatively without using smart card. But we demonstrate that Li et al.’s protocol can’t resist the privileged-insider attack and the stolen verifier attack. Moreover, their protocol failed to provide user anonymity. To overcome the weaknesses of Li et al.’s scheme, we then proposed an improved two-factor authentication protocol based on the extended Chebyshev chaotic mapping. To illustrate the security of our scheme, we give a standard formal proof with the sequence of games (SOG) technique. Furthermore, we also present a comprehensive heuristic security analysis to demonstrate that the proposed protocol is capable of withstanding all the possible various attacks and provides the desired security features. Compared with other schemes, ours is more secure and efficient.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Armbrust, M., Fox, A., Griffith, R., et al.: A view of cloud computing. Commun. ACM 53(4), 50–58 (2010)
Takabi, H., Joshi, J.B.D., Ahn, G.J.: Security and privacy challenges in cloud computing environments. IEEE Secur. Priv. 8(6), 24–31 (2010)
Bonneau, J., Herley, C., Oorschot, P.C.V., et al.: The quest to replace passwords: a framework for comparative evaluation of web authentication schemes. In: Security and Privacy, pp. 553–567. IEEE (2012)
M. Adeptus, Hashdumps and Passwords. http://www.adeptus-mechanicus.com/codex/hashpass/hashpass.php (2014)
Chang, C.C., Wu, T.C.: Remote password authentication with smart cards. IEE Proc. E – Comput. Digit. Techn. 138(3), 165–168 (2005)
Xie, Q., Wong, D., Wang, G., et al.: Provably secure dynamic ID-based anonymous two-factor authenticated key exchange protocol with extended security model. IEEE Trans. Inf. Forensics Secur. 12(6), 1382–1392 (2017)
Ding, W., Ping, W.: Two birds with one stone: two-factor authentication with security beyond conventional bound. IEEE Trans. Depend. Secur. Comput. PP(99), 1 (2016)
Wang, D., Wang, N., Wang, P., et al.: Preserving privacy for free: efficient and provably secure two-factor authentication scheme with user anonymity. Inf. Sci. 321, 162–178 (2015)
He, D., Zeadally, S., Kumar, N., et al.: Anonymous authentication for wireless body area networks with provable security. IEEE Syst. J. PP(99), 1–12 (2016)
Jiang, Q., Zeadally, S., Ma, J., et al.: Lightweight three-factor authentication and key agreement protocol for internet-integrated wireless sensor networks. IEEE Access 5, 3376–3392 (2017)
Wu, F., Xu, L., Kumari, S., et al.: An improved and provably secure three-factor user authentication scheme for wireless sensor networks. Peer-to-Peer Netw. Appl. 11, 1–20 (2016)
Li, X.W., Yang, D.Q., Chen, B.X., et al.: Two-factor authenticated key agreement protocol based on biometric feature and password. J. Commun. 38(7), 89–95 (2017)
Kocarev, L., Lian, S.: Chaos-based Cryptography: Theory Algorithms and Applications. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-20542-2
Shoup, V.: Sequences of games: a tool for taming complexity in security proofs. IACR Cryptology ePrint Archive, p. 332 (2004)
Dodis, Y., Reyzin, L., Smith, A.: Fuzzy extractors: how to generate strong keys from biometrics and other noisy data. In: Cachin, C., Camenisch, Jan L. (eds.) EUROCRYPT 2004. LNCS, vol. 3027, pp. 523–540. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-540-24676-3_31
Kanso, A., Yahyaoui, H., Almulla, M.: Keyed hash function based on a chaotic map. Inf. Sci. 186(1), 249–264 (2012)
Boyko, V., MacKenzie, P., Patel, S.: provably secure password-authenticated key exchange using Diffie-Hellman. In: Preneel, B. (ed.) EUROCRYPT 2000. LNCS, vol. 1807, pp. 156–171. Springer, Heidelberg (2000). https://doi.org/10.1007/3-540-45539-6_12
Acknowledgments
This paper is supported by National Key Research and Development Program (Nos. 2016YFB0800101 and 2016YFB0800100), Innovative Research Groups of the National Natural Science Foundation of China (Grant Nos. 61521003), National Natural Science Foundation of China (Grant Nos. 61379150 and 61309016).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 Springer Nature Switzerland AG
About this paper
Cite this paper
Song, J., Xu, Br., Zhang, Gc., Li, Gs., Ma, Cg., Ge, Aj. (2018). Improved Two-Factor Authentication Protocol Based on Biometric Feature and Password for Cloud Service. In: Sun, X., Pan, Z., Bertino, E. (eds) Cloud Computing and Security. ICCCS 2018. Lecture Notes in Computer Science(), vol 11065. Springer, Cham. https://doi.org/10.1007/978-3-030-00012-7_9
Download citation
DOI: https://doi.org/10.1007/978-3-030-00012-7_9
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-00011-0
Online ISBN: 978-3-030-00012-7
eBook Packages: Computer ScienceComputer Science (R0)