Abstract:Password-based user authentication service is widely used in Internet. Most of the password-based authentication protocols are constructed under the single-server structure that a authencitation server stores cleartext passwords or verification data derived from password and responds to users' authentication request.The security of single-server authentication system is very fragile. In particular, when the server is comprimised, all of users' verification data is exposed to the attacker. Nowadays, development of mobile Internet leads the demand of authentication on roaming device. In this scenario, easily memorable short password and simple secret is accepted by most people despite of its security limitation. The utilization of short password worsens the situation of single-server authentication protocol. Attackers controlling the system can launch off-line dictionary attack from internal of server side to obtain users' original password.Multi-server authentication protocols can improve the security of verification data by distributed storing data on the cluster. This approach increases the difficulty of internal attack and guarantees security even if a portion of servers in the cluster are controlled by adversary. But in practice, There are some problems in existing multi-server protocols. For example, communicating with multiple servers brings extra network and computational burden to client device.To address these problems, in this paper we propose a novel password-based multi-server authenication protocol which not only require less computation on client device but remain functional and secure even if adversary controls some servers and forces them collude to attack our protocol.

Password-based Two-Server Authentication and Key Exchange Based on Geometric Approaches

Authentication Scheme Based on Biometric Encryption

Hash Function and Smart Card Based Multi-Server Authentication Protocol

An Efficient Password-Only Two-Server Authenticated Key Exchange System

Password-based Authenticated Key Agreement Scheme with Mutual Anonymity for Trusted Computation

Efficient Three-Party Password-Based Authenticated Key Exchange Protocol

Security Analysis of Yang et al.'s Practical Password-Based Two-Server Authentication and Key Exchange System

Efficient Password-Based Authenticated Group Key Exchange Protocol

Weaknesses of a Password-Authenticated Key Exchange Protocol between Clients with Different Passwords

A verifier-based password-authenticated key exchange protocol via elliptic curves

A Threshold Multi-server Protocol for Password-Based Authentication.

Weakness Analysis and Improvement of a Gateway-Oriented Password-Based Authenticated Key Exchange Protocol

Authentication based on Euclidean geometry properties

Efficient Password-Based Authenticated Key Exchange Protocol under Standard Model

User Authentication Scheme Using Smart Cards for Multi-Server Environments

A DYNAMIC PASSWORD AUTHENTICATION FOR REMOTE USERS IN INSECURE CHANNEL

Two-Factor Mutual Authentication Based on Smart Cards and Passwords

An Improved User Authentication With Key Agreement Scheme For Multi-Server Architecture Using Scpks

Three-party Encrypted Key Exchange

A Robust Password-Based Multi-Server Authentication Scheme

Post-quantum Verifier-Based Three-Party Password Authenticated Key Exchange Protocol