A novel and provably secure biometrics-based three-factor remote authentication scheme for mobile client–server networks. (July 2015)

• Record Type: Journal Article
• Authors: Wu, Fan; Xu, Lili; Kumari, Saru; Li, Xiong
• Is Part Of: Computers & electrical engineering. Volume 45(2015)
• Page Start: 274
• Page End: 285
• Publication Date: 2015-07
• Subjects: Three-factor -- Biometrics -- Formal proof -- User anonymity; Computer engineering -- Periodicals; Electrical engineering -- Periodicals; Electrical engineering -- Data processing -- Periodicals; Ordinateurs -- Conception et construction -- Périodiques; Électrotechnique -- Périodiques; Électrotechnique -- Informatique -- Périodiques; Computer engineering; Electrical engineering; Electrical engineering -- Data processing; Periodicals; Electronic journals; 621.302854
• DOI: 10.1016/j.compeleceng.2015.02.015
• Languages: English
• ISSNs: 0045-7906

Abstract

Graphical abstract: Highlights: We point out that Yeh et al.'s scheme is not secure because it has several disadvantages in security. We point out that Khan et al.'s scheme is not secure with some weaknesses. We present a new three-factor scheme based on ECC. We prove our scheme secure with a formal proof and analysis. By comparing with some latest schemes, our scheme is more practical for application due to the security and efficiency. Abstract: The biometrics, the password and the storage device are the elements of the three-factor authentication. In 2013, Yeh et al. proposed a three-factor user authentication scheme based on elliptic curve cryptography. However, we find that it has weaknesses including useless user identity, ambiguous process, no session key and no mutual authentication. Also, it cannot resist the user forgery attack and the server spoofing attack. Moreover, Khan et al. propose a fingerprint-based remote authentication scheme with mobile devices. Unfortunately it cannot withstand the user impersonation attack and the De-synchronization attack. Furthermore, the user's identity cannot be anonymous, either. To overcome the disadvantages, we propose a new three-factor remote authentication scheme and give a formal proof with strong forward security. It could provide the user's privacy and is secure. Compared to some recent three-factor authentication schemes, our scheme is secure and practical.