期刊名称：International Journal of Security and Its Applications
印刷版ISSN：1738-9976
出版年度：2013
卷号：7
期号：4
出版社：SERSC
摘要：Remote user authentication scheme with key agreement is a very practical mechanism to verify a remote user and then provide secure communication. Furthermore, many network environments have been becoming multi-server based due to the rapid growth of computer networks. Therefore, more and more researches have been focused on proposing smart card based remote authentication scheme with session key agreement for multi-server environment. Recently, Tsaur, Li and Lee (2012) proposed such a novel scheme which adopts a self-verified timestamp technique to help the smart card based authentication scheme not only effectively achieve password-authenticated key agreement but also avoid the difficulty of implementing clock synchronization in multi-server environments. They claimed that their scheme is against various attacks and more efficient. However, we observe that Tsaur-Li-Lee's scheme is still vulnerable to off-line password guessing attack, insider attack and malicious user attack. Besides, Tsaur-Li-Lee's scheme has no password change phase and also suffers from weaknesses of static identity and inefficiency in wrong password detection. In this paper, we propose an improved dynamic identity based scheme to eliminate all the security and efficiency weaknesses without decreasing other security performances
