Abstract:Password-based user authentication service is widely used in Internet. Most of the password-based authentication protocols are constructed under the single-server structure that a authencitation server stores cleartext passwords or verification data derived from password and responds to users' authentication request.The security of single-server authentication system is very fragile. In particular, when the server is comprimised, all of users' verification data is exposed to the attacker. Nowadays, development of mobile Internet leads the demand of authentication on roaming device. In this scenario, easily memorable short password and simple secret is accepted by most people despite of its security limitation. The utilization of short password worsens the situation of single-server authentication protocol. Attackers controlling the system can launch off-line dictionary attack from internal of server side to obtain users' original password.Multi-server authentication protocols can improve the security of verification data by distributed storing data on the cluster. This approach increases the difficulty of internal attack and guarantees security even if a portion of servers in the cluster are controlled by adversary. But in practice, There are some problems in existing multi-server protocols. For example, communicating with multiple servers brings extra network and computational burden to client device.To address these problems, in this paper we propose a novel password-based multi-server authenication protocol which not only require less computation on client device but remain functional and secure even if adversary controls some servers and forces them collude to attack our protocol.

Password-based User Authentication and Key Distribution Protocols for Client-Server Applications

Password-based Authentication and Key Distribution Protocols with Perfect Forward Secrecy

Inter-domain authentication scheme for Pervasive Computing Environments

Hash Function and Smart Card Based Multi-Server Authentication Protocol

Password Authenticated Key Exchange Protocols Among Diverse Network Domains

A Threshold Multi-server Protocol for Password-Based Authentication.

Efficient Three-Party Authentication and Key Agreement Protocols Resistant to Password Guessing Attacks

An Efficient Delegation-Based Anonymous Authentication Protocol

Enhanced Three-Party Encrypted Key Exchange Without Server Public Keys

Weaknesses of a Password-Authenticated Key Exchange Protocol between Clients with Different Passwords

On the Security of Some Password Authentication Protocols.

Defending Secret-Key Based Authentication Protocols Against the Stolen-Secret Attack.

Finding and Fixing Vulnerabilities in Several Three-Party Password Authenticated Key Exchange Protocols Without Server Public Keys.

A lightweight dynamic pseudonym identity based authentication and key agreement protocol without verification tables for multi-server architecture

Simple authenticated key agreement protocol resistant to password guessing attacks.

Security Analysis of Yang et al.'s Practical Password-Based Two-Server Authentication and Key Exchange System

Secure Key Agreement Protocols for Three-Party Against Guessing Attacks

Public key versus symmetric key cryptography in client–server authentication protocols

Simple three-party password-based key exchange protocol with provable security

A Secure and Efficient Password-Authenticated Group Key Exchange Protocol for Mobile Ad Hoc Networks.

An efficient dynamic ID based remote user authentication scheme using self-certified public keys for multi-server environment