Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China.
College of Computer, National University of Defense Technology, Hunan Changsha, China.
PLoS One. 2018 Oct 9;13(10):e0202657. doi: 10.1371/journal.pone.0202657. eCollection 2018.
Recently, Li et al. proposed a novel smart card and dynamic ID-based remote user authentication scheme for multi-server environments. They claimed that their scheme can resist several types of attacks. However, through careful analysis, we find that Li et al.'s scheme is vulnerable to stolen smart card and off-line dictionary attacks, replay attacks, impersonation attacks and server spoofing attacks. By analyzing other similar schemes, we find that a certain type of dynamic ID-based multi-server authentication scheme in which only hash functions are used and whereby no registration center participates in the authentication and session key agreement phase faces difficulties in providing perfectly efficient and secure authentication. To compensate for these shortcomings, we propose a novel dynamic ID-based remote user authentication scheme for multi-server environments based on pairing and self-certified public keys. Security and performance analyses show that the proposed scheme is secure against various attacks and has many excellent features.
最近，李等人提出了一种新颖的智能卡和基于动态 ID 的远程用户认证方案，适用于多服务器环境。他们声称，他们的方案可以抵御多种类型的攻击。然而，通过仔细分析，我们发现李等人的方案容易受到偷取智能卡和离线字典攻击、重放攻击、伪装攻击和服务器欺骗攻击的影响。通过分析其他类似的方案，我们发现，在某种基于动态 ID 的多服务器认证方案中，仅使用哈希函数，并且在认证和会话密钥协商阶段没有注册中心参与，这种方案在提供完全高效和安全的认证方面存在困难。为了弥补这些缺点，我们提出了一种新颖的基于配对和自认证公钥的多服务器环境下的基于动态 ID 的远程用户认证方案。安全和性能分析表明，所提出的方案能够抵御各种攻击，具有许多优良的特性。
