Abstract

With the development of Internet of Things (IoT) technologies, Internet-enabled devices have been widely used in our daily lives. As a new service paradigm, cloud computing aims at solving the resource-constrained problem of Internet-enabled devices. It is playing an increasingly important role in resource sharing. Due to the complexity and openness of wireless networks, the authentication protocol is crucial for secure communication and user privacy protection. In this paper, we discuss the limitations of a recently introduced IoT-based authentication scheme for cloud computing. Furthermore, we present an enhanced three-factor authentication scheme using chaotic maps. The session key is established based on Chebyshev chaotic-based Diffie–Hellman key exchange. In addition, the session key involves a long-term secret. It ensures that our scheme is secure against all the possible session key exposure attacks. Besides, our scheme can effectively update user password locally. Burrows–Abadi–Needham logic proof confirms that our scheme provides mutual authentication and session key agreement. The formal analysis under random oracle model proves the semantic security of our scheme. The informal analysis shows that our scheme is immune to diverse attacks and has desired features such as three-factor secrecy. Finally, the performance comparisons demonstrate that our scheme provides optimal security features with an acceptable computation and communication overheads.

1. Introduction

With the rapid growth of Internet of Things (IoT) technologies, Internet-enabled devices have had a tremendous impact on people’s works and lives [1–3]. However, the Internet-enabled devices have limited storage, computing power, and communication ability. To solve this limitation, cloud computing emerged as a new service paradigm [4]. It provides a new method with high efficiency and convenience to realize information and resource sharing. The users are able to access the resources, services, or applications that are deployed in distributed cloud servers by utilizing a handheld device anywhere and anytime. And the control server is in charge of authorizing the users and distributed servers.

As the communication channel is open and unprotected, there are diverse and severe security threats for stealing sensitive data and resource in cloud computing environment [5, 6]. An authentication protocol is indispensable to prevent unauthorized access and protect the sensitive data and user privacy. From the first smart card-based authentication protocol [7] introduced by Yang and Shieh in 1999, there have been a large number of enhanced schemes proposed [2, 8–13]. Based on the authentication factors the user employs, the authentication schemes are divided into two-factor authentication schemes and three-factor authentication schemes. Based on the cryptosystem the authentication scheme adopts, the authentication schemes are divided into hash-based schemes, symmetric cryptosystem-based schemes, and public key cryptosystem-based schemes.

1.1. Related Works

In terms of authentication schemes for cloud computing, some proposals have been presented one after another to improve the security and efficiency [14–17]. In 2015, Tsai and Lo [18] put forward an anonymous authentication protocol using bilinear pairing, in which the user can directly login the distributed server without the help of control server. Afterwards, He et al. [19] revealed that their scheme is not resistant to server impersonation attack and put forward an enhanced scheme. In 2017, Kumari et al. [20] presented a biometric-based authentication protocol employing elliptic curve cryptosystem (ECC). However, their scheme cannot withstand known session-specific temporary information attack and fails to preserve three-factor secrecy. In 2018, Amin et al. [21] pointed out that two anonymous authentication schemes [22, 23] have weaknesses like forgery attack and session key disclosure attack and introduced a hash-based two-factor authentication scheme. Unfortunately, Wang et al. [24] revealed that their scheme still cannot resist session key disclosure attack. In 2019, Mo et al. [25] introduced an ECC-based single-server two-factor authentication protocol. But this protocol is not resistant to stolen-verifier attack. In the same year, Zhou et al. [26] put forward a two-factor authentication scheme employing hash function. But we observe that their scheme suffers from forgery attack and replay attack and does not preserve forward secrecy. For better understanding, we summarize these schemes in Table 1.

Among these schemes, the hash-based schemes [21–23, 26] are highly efficient, but they have diverse vulnerabilities, such as desynchronization attack, forgery attack, and failure to achieve forward secrecy and user anonymity. Wang et al. [27, 28] have demonstrated that public key technique is essential for achieving some security attributes such as user anonymity. However, the existing public key cryptosystem-based schemes [18, 20, 25] still have more or less security vulnerabilities due to design deficiencies. Besides, they have high computation overhead as time-consuming operations such as bilinear pairing and scalar multiplication are involved.

In addition, the security of the session key is a noteworthy issue. The existing schemes are not secure against various session key exposure attacks. A great many schemes such as the schemes in [20, 21, 25, 26] cannot withstand known session-specific temporary information attack. And many schemes such as the schemes in [21–23, 26] cannot provide forward secrecy. Besides, in some schemes like the scheme of Amin et al. [21], the attacker can even reveal the session key when he obtains the smart card [29].

1.2. Motivation and Contributions

The existing schemes suffer from various security defects or involve high computation overhead. The security attributes or the efficiency needs to be improved. In particular, the great majority of schemes fail to guarantee the security of session key, as they are subjected to various session key exposure attacks. It motivates us to present an enhanced authentication scheme that can meet the security requirements at minimum cost and be secure against all the possible session key exposure attacks. We sum up the contributions of the paper as below:(1)We reveal that Zhou et al.’s scheme [26] does not consider impersonation attack, known session-specific temporary information attack, and forward secrecy.(2)We put forward an enhanced three-factor authentication scheme using chaotic maps. The session key comprises of a long-term secret value and the secret key generated by Chebyshev chaotic-based Diffie–Hellman key exchange. It can prevent all kinds of session key exposure attacks. The use of Chebyshev chaotic maps contributes to the establishment of secure session key and simultaneously reduces the computation cost.(3)The Burrows–Abadi–Needham logic proof confirms the completeness of our scheme. The formal analysis under the random oracle model proves the semantic security of session key. And the informal analysis shows that our scheme can resist all kinds of potential attacks and provide desired properties like three-factor secrecy. The performance comparisons demonstrate that our scheme has high security, and its computation and communication overheads are acceptable.

1.3. Organization of the Paper

The rest of the paper is formed as below. We give some background materials in Section 2. We reveal the security defects of Zhou et al.’s scheme in Section 3. We present the enhanced three-factor authentication scheme in Section 4. We discuss the security of our scheme using several widely accepted security analysis methods in Section 5. We present the performance comparisons of our scheme and related schemes in Section 6. The conclusion is given in Section 7.

2. Preliminaries

2.1. Chebyshev Chaotic Maps

According to Zhang [30], the enhanced Chebyshev polynomial is defined as , where , , and p is a big prime. The Chebyshev polynomials satisfy commutative law, i.e., .

There is a hard mathematical problem on Chebyshev polynomials:(i)Chebyshev chaotic Diffie–Hellman problem (CHDHP): for given , , and , the computation of is infeasible.

2.2. Adversary Model

Based on [31], the abilities of adversary are summarized as below:(i)The adversary can eavesdrop, replay, block, or alter the transmitted messages in open channel(ii)When testing forward secrecy, the adversary can obtain control server’s master key or cloud server’s secret key(iii)The adversary can disclose the password or the parameters of smart card(iv)When testing three-factor secrecy, the adversary is capable of obtaining any two kinds of authentication factors

2.3. Notations

The notations of the paper are presented in Table 2.

3. Cryptanalysis of Zhou et al.’s Scheme

We briefly review Zhou et al.’s scheme [26] and point out its limitations in this section. In their scheme, the attacker can perform impersonation attack by replaying the intercepted message. Besides, their scheme is vulnerable to two kinds of session key exposure attacks.

3.1. Review of Zhou et al.’s Scheme

3.1.1. User Registration Phase

delivers an enrollment request to CS in this phase. Step 1: picks his identity , pseudoidentity , and password . Then selects a random number and calculates . Afterwards, delivers the registration request to CS via the secure channel. Step 2: after getting , CS checks if is valid. If it holds, CS computes and . CS saves in its database and returns to via the secure channel. Step 3: after receiving , computes , , and . Then, stores in the memory of a smart card.

3.1.2. Cloud Server Registration Phase

CS distributes the secret key to in this phase. Step 1: chooses its identity and pseudoidentity and delivers to CS via the secure channel. Step 2: after getting , CS computes and . CS delivers to via the secure channel. Step 3: keeps as secret.

3.1.3. Login and Authentication Phase

and authenticate each other in the assistance of CS as shown in Figure 1. Step 1: inputs and . The smart card picks a new pseudoidentity , computes , , , , , , , and , where is a nonce. The smart card delivers the login request to via the public channel. Step 2: upon receiving , picks a new pseudoidentity . computes , , , and , where is a random number. sends to CS via the public channel. Step 3: after receiving , CS computes , , , and , and verifies if . If the equation holds, CS computes , , , and , and verifies if . If it holds, proceed next step, otherwise, the protocol aborts. Step 4: CS computes , , , , , , and , where is a nonce. CS sends {} to . Step 5: after receiving , computes , , and verifies if . If it holds, computes . keeps as secret and removes . delivers to . Step 6: after receiving {}, the smart card computes , , and checks if . If they are equal, the smart card calculates , stores , and removes .

Figure 1 

Login and authentication phase of Zhou et al.’s scheme.

3.2. Cryptanalysis of Zhou et al.’s Scheme

In this section, we reveal that Zhou et al.’s scheme suffers from replay attack, user impersonation attack, server impersonation attack, and known session-specific temporary information attack and fails to provide forward secrecy.

3.2.1. Forward Secrecy

Forward secrecy ensures that when the long-term secret is compromised, the attacker still cannot reveal the established session key. In Zhou et al.’s scheme, with the master key s, the attacker can reveal as follows: Step 1: the attacker intercepts and from the public channel Step 2: the attacker computes , , , , and

When the long-term secret s is compromised, all the established session keys will be disclosed.

3.2.2. User Impersonation Attack

User impersonation attack denotes that the attacker can masquerade as a valid user to login the cloud server. This attack is performed as follows: Step 1: the attacker intercepts from the public channel and sends this message to . Step 2: upon receiving , handles this message and sends to CS. Step 3: CS handles the message . As , , CS sends back to . Step 4: handles . As , sends to the attacker.

and CS believe that comes from the legitimate user . Without compromising the smart card, the attacker can impersonate the user by replaying . Zhou et al.’s scheme is vulnerable to user impersonation attack.

3.2.3. Server Impersonation Attack

Server impersonation attack denotes that the attacker can masquerade as a valid cloud server to deceive the user. This attack is performed as follows: Step 1: the attacker intercepts the message from the public channel. Step 2: when intercepting a new login request from the public channel, the attacker sends to CS. Step 3: CS handles . As , , CS returns to the attacker. Step 4: the attacker delivers to . Step 5: after receiving , as , believes that the attacker is the legitimate cloud server .

In that delivers to CS, is completely independent with . CS verifies the validity of the two messages independently. It leads that the attacker can impersonate the cloud server by replaying .

3.2.4. Known Session-Specific Temporary Information Attack

This attack denotes that when the temporary secret such as random number is compromised, the attacker can reveal the established session key. With the random number , the attacker reveals the session key as follows: Step 1: the attacker intercepts and from the public channel. Step 2: when generates a new login request using and sends to . The attacker intercepts from the public channel. Step 3: the attacker computes and .

In Zhou et al.’s scheme, if the random number α is compromised, the attacker can reveal the session key. Zhou et al.’s scheme is vulnerable to known session-specific temporary information attack.

4. The Proposed Scheme

A robust three-factor authentication scheme for cloud computing is put forward in this section. The proposed scheme is described as below.

4.1. System Setup Phase

CS picks its master key . CS also selects a nonce y as its secret value. CS picks a hash function and a symmetric cryptosystem . In addition, CS publishes the Chebyshev polynomial’s parameters .

4.2. User Registration Phase

transmits the enrollment request to CS in this phase, as shown in Figure 2. Step 1: selects his identity and password as he wishes, imprints his biometric , and calculates . Then, delivers {} to CS through the secure channel. Step 2: after receiving {}, CS picks two random numbers , calculates , , , and , where the integer satisfies . CS saves into its database. Moreover, CS stores parameters in a smart card and delivers it to .

Figure 2 

User registration phase.

4.3. Cloud Server Registration Phase

CS issues the secret key to in this phase. Step 1: delivers its identity to CS through the secure channel. Step 2: after receiving , CS calculates . CS sends back to through the secure channel. Step 3: keeps as secret.

4.4. Login and Authentication Phase

and perform mutual authentication by the aide of CS in this phase, as shown in Figure 3. Step 1: inputs his identity and password and imprints the biometric . Then, the smart card calculates and and verifies whether is equal to . If it holds, the smart card calculates , , , and , where is a nonce and is the current timestamp. is delivered to through the open channel. Step 2: after getting , verifies whether is fresh. If it holds, generates a random number and calculates , , , and , where is the current timestamp. sends to CS via the public channel. Step 3: after receiving , CS checks the freshness of and computes , , , and and verifies , . If , , the smart card is probably compromised. For the item , CS performs . When it reaches the preset value, CS suspends . If , , CS believes the authenticity of and performs the next step. Step 4: CS computes , , , and , and verifies . If it holds, CS believes the authenticity of . Otherwise, the protocol terminates. Step 5: CS picks a nonce , computes , , , and , where is the current timestamp. CS transmits to through the open channel. Step 6: after getting , checks the freshness of and computes , and verifies . If they are equal, authenticates the user successfully. computes , , and . transmits to via the public channel. Step 7: upon receiving , the smart card checks the freshness of . Then, the smart card computes , , , , and , and checks . If it holds, authenticates the cloud server successfully. The smart card replaces with in the memory.