Affiliations: [a] Division of Information Technology, NSIT, New Delhi, India
| [b] School of Computer and System Sciences, JNU, New Delhi, India
| [c] Division of Computer Engineering, NSIT, New Delhi, India
Correspondence:
[*]
Corresponding author. Devender Kumar, Division of Infor-mation Technology, NSIT, New Delhi, India. E-mail: dk_iitm@yahoo.co.in.
Abstract: Most of the user authentication schemes are based on smart cards; however, a smart card requires additional infrastructure that includes card reader, leading to more deployment cost. Recently, Kumari et al. have discussed a user anonymous authentication scheme that uses common storage device such as USB stick, mobile phone, etc. rather than using a smart card. The common storage device is used to store some authentication information issued by the server. We cryptanalyze the Kumari et al.’s scheme and find that it is not resistant to the device stolen, privileged insider and denial of service attacks. In this paper, we propose a user authentication scheme based on public key cryptography to overcome its drawbacks. We show its formal security analysis using random oracle model and discuss its informal security analysis to show that it is resistant to the various known attacks. We simulate it using the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool for its formal security verification. We compare our scheme with the related schemes and show that it has better communication cost and provides more security features.
Keywords: Common storage device, user anonymity, user authentication, denial of service attack, public key cryptography
