An Improved User Authentication and Key Agreement Scheme Providing User Anonymity  

作　　者：Ya-Fen Chang Pei-Yu Chang 

机构地区：[1]with the Department of Computer Science and Information Engineering, National Taichung Institute of Technology

出　　处：《Journal of Electronic Science and Technology》2011年第4期352-358,共7页电子科技学刊（英文版）

基　　金：supported by National Science Council under Grant No. 98-2221-E-025-007- and 99-2410-H-025-010-MY2

摘　　要：When accessing remote services over public networks, a user authentication mechanism is required because these activities are executed in an insecure communication environment. Recently, Wang et al. proposed an authentication and key agreement scheme preserving the privacy of secret keys and providing user anonymity. Later, Chang et al. indicated that their scheme suffers from two security flaws. First, it cannot resist DoS （denial-of-service） attack because the indicators for the next session are not consistent. Second, the user password may be modified by a malicious attacker because no authentication mechanism is applied before the user password is updated. To eliminate the security flaws and preserve the advantages of Wang et aL＇s scheme, we propose an improvement in this paper.When accessing remote services over public networks, a user authentication mechanism is required because these activities are executed in an insecure communication environment. Recently, Wang et al. proposed an authentication and key agreement scheme preserving the privacy of secret keys and providing user anonymity. Later, Chang et al. indicated that their scheme suffers from two security flaws. First, it cannot resist DoS （denial-of-service） attack because the indicators for the next session are not consistent. Second, the user password may be modified by a malicious attacker because no authentication mechanism is applied before the user password is updated. To eliminate the security flaws and preserve the advantages of Wang et aL＇s scheme, we propose an improvement in this paper.

关 键 词：AUTHENTICATION key agreement smart card user anonymity. 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TN918.1[自动化与计算机技术—计算机科学与技术]