Title: A security enhanced user authentication scheme for multi-server environment without using smart cards

Authors: Pengshuai Qiao

Addresses: North China University of Water Resources and Electric Power, Zhengzhou, 450045, China

Abstract: With the popularity of internet and wireless networks, more and more network architectures are used in multi-server environment, in which users remotely access servers through open networks. For the reliability of accessing these remote services, user must pass a verification procedure to obtain the authorisation for legal resource acquisition and data exchange. Lee et al. proposed an authentication scheme for multi-server architecture. Recently, Yeh and Nai demonstrated that Lee et al.'s scheme is insecure against server spoofing attack, user impersonation attack and undetectable online password guessing attacks. Yeh and Nai also proposed an improved authentication scheme and claimed their scheme could withstand various attacks. Unfortunately, we find that Yeh and Nai's scheme is still vulnerable to offline password guessing attack and stolen-verifier attack. Furthermore, a security enhanced authentication scheme is developed to eliminate the identified weaknesses.

Keywords: user authentication; secure communications; key agreement; multi-server architectures; network security; offline password guessing attacks; stolen verifier attacks.

DOI: 10.1504/IJESDF.2015.069592

International Journal of Electronic Security and Digital Forensics, 2015 Vol.7 No.2, pp.197 - 210

Received: 08 Feb 2014
Accepted: 07 Mar 2014
Published online: 28 May 2015 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article