Reddy Alavalapati Goutham, Das Ashok Kumar, Odelu Vanga, Yoo Kee-Young
School of Computer Science and Engineering, Kyungpook National University, Daegu, Korea.
Center for Security, Theory and Algorithmic Research, International Institute of Information Technology, Hyderabad, India.
PLoS One. 2016 May 10;11(5):e0154308. doi: 10.1371/journal.pone.0154308. eCollection 2016.
Biometric based authentication protocols for multi-server architectures have gained momentum in recent times due to advancements in wireless technologies and associated constraints. Lu et al. recently proposed a robust biometric based authentication with key agreement protocol for a multi-server environment using smart cards. They claimed that their protocol is efficient and resistant to prominent security attacks. The careful investigation of this paper proves that Lu et al.'s protocol does not provide user anonymity, perfect forward secrecy and is susceptible to server and user impersonation attacks, man-in-middle attacks and clock synchronization problems. In addition, this paper proposes an enhanced biometric based authentication with key-agreement protocol for multi-server architecture based on elliptic curve cryptography using smartcards. We proved that the proposed protocol achieves mutual authentication using Burrows-Abadi-Needham (BAN) logic. The formal security of the proposed protocol is verified using the AVISPA (Automated Validation of Internet Security Protocols and Applications) tool to show that our protocol can withstand active and passive attacks. The formal and informal security analyses and performance analysis demonstrates that the proposed protocol is robust and efficient compared to Lu et al.'s protocol and existing similar protocols.
近年来，由于无线技术的进步及相关限制，用于多服务器架构的基于生物特征的认证协议得到了广泛应用。Lu等人最近提出了一种使用智能卡的针对多服务器环境的基于生物特征的健壮认证与密钥协商协议。他们声称他们的协议高效且能抵御常见的安全攻击。本文的仔细研究证明，Lu等人的协议不能提供用户匿名性、完美前向保密性，并且容易受到服务器和用户伪装攻击、中间人攻击以及时钟同步问题的影响。此外，本文提出了一种基于椭圆曲线密码学并使用智能卡的针对多服务器架构的增强型基于生物特征的认证与密钥协商协议。我们使用Burrows-Abadi-Needham（BAN）逻辑证明了所提出的协议实现了相互认证。使用AVISPA（互联网安全协议和应用自动验证）工具验证了所提出协议的形式安全性，以表明我们的协议能够抵御主动和被动攻击。形式和非形式安全分析以及性能分析表明，与Lu等人的协议及现有类似协议相比，所提出的协议更加健壮和高效。
