A security enhanced user authentication scheme for multi-server environment without using smart cards Online publication date: Thu, 28-May-2015
by Pengshuai Qiao
International Journal of Electronic Security and Digital Forensics (IJESDF), Vol. 7, No. 2, 2015
Abstract: With the popularity of internet and wireless networks, more and more network architectures are used in multi-server environment, in which users remotely access servers through open networks. For the reliability of accessing these remote services, user must pass a verification procedure to obtain the authorisation for legal resource acquisition and data exchange. Lee et al. proposed an authentication scheme for multi-server architecture. Recently, Yeh and Nai demonstrated that Lee et al.'s scheme is insecure against server spoofing attack, user impersonation attack and undetectable online password guessing attacks. Yeh and Nai also proposed an improved authentication scheme and claimed their scheme could withstand various attacks. Unfortunately, we find that Yeh and Nai's scheme is still vulnerable to offline password guessing attack and stolen-verifier attack. Furthermore, a security enhanced authentication scheme is developed to eliminate the identified weaknesses.
Existing subscribers:
Go to Inderscience Online Journals to access the Full Text of this article.
If you are not a subscriber and you just want to read the full contents of this article, buy online access here.Complimentary Subscribers, Editors or Members of the Editorial Board of the International Journal of Electronic Security and Digital Forensics (IJESDF):
Login with your Inderscience username and password:
Want to subscribe?
A subscription gives you complete access to all articles in the current issue, as well as to all articles in the previous three years (where applicable). See our Orders page to subscribe.
If you still need assistance, please email subs@inderscience.com
Our Blog 
Follow us on Twitter 
Visit us on Facebook