基于智能卡的多服务器远程匿名认证密钥协商协议

本文先对Xu等人近期提出的一个基于智能卡的动态身份用户认证(简称XJWM)方案进行分析,指出其不能抵抗冒充攻击和密钥泄露攻击,且不能实现前向安全和后向安全. 然后利用Diffie-Hellman密钥协商算法及生物认证技术,提出一个新的多服务器环境下多因子远程匿名认证密钥协商协议,有效弥补了XJWM方案存在的安全缺陷. 最后,用改进的BAN逻辑证明了新方案密钥协商的正确性、会话密钥机密性与新鲜性以及双向认证性.性能与安全性分析说明新方案在少量增加通信、存储和计算量的情况下具有好的安全性.

Multi-server anonymous remote authenticated key agreement protocol based on smart card

Xu et al. recently proposed a dynamic ID based remote user authentication scheme using smart cards (short for XJWM scheme). We found that XJWM scheme is vulnerable to impersonation attacks and key leakage attacks, and it is also lack of perfect forward security and backward security. Based on Diffie-Hellman key agreement protocol and biometrical authentication technology, a new multi-server and multi-factor anonymous remote authenticated key agreement protocol is presented, which efficiently eliminates the security vulnerabilities of XJWM scheme. At last, the security of the new scheme is proved by the improved BAN logic. It shows that the new scheme can ensure the correctness of key agreement, key confidentiality, key freshness and mutual authentication. The results of security and performance analysis demonstrate the proposed scheme provides relatively more security features without increasing too much communication, computation and storage overhead.