Lightweight and provably secure user authentication with anonymity for the global mobility network

TLDR

Seamless roaming in GLOMONET is desirable, but authentication is difficult due to wireless network vulnerabilities and limited mobile terminal resources, prompting recent anonymous authentication proposals. The paper identifies security weaknesses in existing anonymous GLOMONET authentication schemes. The authors propose a lightweight, provably secure anonymous authentication protocol for GLOMONET that relies solely on symmetric cryptographic and hash primitives, exchanges only four messages among user, foreign agent, and home agent, and is formally verified with AVISPA. The protocol achieves multiple security properties—preventing various attacks, enabling single registration, preserving user anonymity, eliminating password/verifier tables, using one‑time session keys, and defending against smart card breaches. © 2010 John Wiley & Sons, Ltd.

Abstract

Abstract Seamless roaming in the global mobility network (GLOMONET) is highly desirable for mobile users, although their proper authentication is challenging. This is because not only are wireless networks susceptible to attacks, but also mobile terminals have limited computational power. Recently, some authentication schemes with anonymity for the GLOMONET have been proposed. This paper shows some security weaknesses in those schemes. Furthermore, a lightweight and provably secure user authentication scheme with anonymity for the GLOMONET is proposed. It uses only symmetric cryptographic and hash operation primitives for secure authentication. Besides, it takes only four message exchanges among the user, foreign agent and home agent. We also demonstrate that this protocol enjoys important security attributes including prevention of various attacks, single registration, user anonymity, user friendly, no password/verifier table, and use of one‐time session key between mobile user and foreign agent. The security properties of the proposed protocol are formally validated by a model checking tool called AVISPA. Furthermore, as one of the new features in our protocol, it can defend smart card security breaches. Copyright © 2010 John Wiley & Sons, Ltd.