Abstract:Password-based user authentication service is widely used in Internet. Most of the password-based authentication protocols are constructed under the single-server structure that a authencitation server stores cleartext passwords or verification data derived from password and responds to users' authentication request.The security of single-server authentication system is very fragile. In particular, when the server is comprimised, all of users' verification data is exposed to the attacker. Nowadays, development of mobile Internet leads the demand of authentication on roaming device. In this scenario, easily memorable short password and simple secret is accepted by most people despite of its security limitation. The utilization of short password worsens the situation of single-server authentication protocol. Attackers controlling the system can launch off-line dictionary attack from internal of server side to obtain users' original password.Multi-server authentication protocols can improve the security of verification data by distributed storing data on the cluster. This approach increases the difficulty of internal attack and guarantees security even if a portion of servers in the cluster are controlled by adversary. But in practice, There are some problems in existing multi-server protocols. For example, communicating with multiple servers brings extra network and computational burden to client device.To address these problems, in this paper we propose a novel password-based multi-server authenication protocol which not only require less computation on client device but remain functional and secure even if adversary controls some servers and forces them collude to attack our protocol.

Design of the password-authenticated protocol based on mosaic image test

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

Amogap: Defending Against Man-In-The-Middle And Offline Guessing Attacks On Passwords

Improved Against Off-Line Dictionary Attack Password Change Protocol

On the Security of Some Password Authentication Protocols.

A Shoulder Surfing Resistant Graphical Authentication System

Novel password authentication protocol based on RTT

Cryptanalysis of a Honeyword System in the IoT Platform

Password Recovery Attack on Authentication Protocol MD4(Password||Challenge)

A Threshold Multi-server Protocol for Password-Based Authentication.

A Graphical Password Scheme Against Snapshot, Remote Monitoring, and Shoulder-Surfing with Its Application in One-Time Password

An Improved User-Participating Authentication Scheme

Password based authentication for web based graphics computing services retrieval in cloud

Generating and Managing Strong Passwords using Hotel Mnemonic

A Multi-Factor Homomorphic Encryption based Method for Authenticated Access to IoT Devices

A Password Based Authentication Scheme for Wireless Multimedia Systems

Public-key cryptography and password protocols

HPAKE: Honey Password-Authenticated Key Exchange for Fast and Safer Online Authentication

On Designing a Lesser Obtrusive Authentication Protocol to Prevent Machine-Learning-Based Threats in Internet of Things

Passmap: A Map Based Graphical-Password Authentication System

Against Spyware Using CAPTCHA in Graphical Password Scheme