![](bg2.png)
indicated in (Yang, 2007), the alias approach has the
drawback that a user may have to renew his alias from
time to time. Moreover, when the wireless communi-
cation link is accidentally broken or when some state
information of either party is corrupted, the user and
his home agent may loose the alias synchronization.
Yet another approach is based on sophisticated
cryptographic constructions, particularly some spe-
cial public-key operations. For instance, proxy sig-
nature (Tang, 2008), identity-based encryption (Wan,
2008) and blind signature (He, 2004) have been used
for providing anonymity in mobile networks. Sim-
ilar technique is observed in (Tzeng, 2006), though
the context is for user-to-server anonymous authenti-
cation (where the roaming service scenario is not con-
sidered). However, these schemes intrinsically suffer
from observable inefficiency in terms of computation
and/or communication; they may not be practically
applicable to mobile devices whose resources are usu-
ally constrained.
Recently, by using secure authenticated key ex-
change protocols (AKEPs) as building blocks, Yang
et al. proposed a novel construction for anonymous
authentication in mobile networks (Yang, 2007). The
construction eliminates the alias synchronization, and
does not rely on any additional security assumptions
on the communication channel between the foreign
network and the user’s home network. However, the
anonymous authentication protocol involves digital
signatures; although less expensive than proxy sig-
nature (Tang, 2008) and blind signature (He, 2004),
public-key operations like ordinary digital signatures
are still far inefficient compared with symmetric op-
erations. Moreover, the communication overhead of
(Yang, 2007) is higher than those of other anony-
mous authentication protocols that are not based on
underlying AKEPs. Nevertheless, the idea of employ-
ing certain security protocol as a building block for a
generic construction motivates our work.
In this paper, by using secure password authen-
tication scheme based on the smart card as a build-
ing block, we present a secure and generic construc-
tion for anonymous authentication for roaming ser-
vice. Our proposal can generally convert a certain
password authentication scheme into an anonymous
authentication protocol of interest, and features no en-
cryption or digital signature operation. In addition,
we show that the generic construction can be instanti-
ated efficiently, and the computation and communica-
tion costs of the instantiation are lower than or com-
parable to those of similar schemes.
The rest of this paper is organized as follows. Sec-
tion 2 and Section 3 formally describe a smart card
based password authentication (SCBPA) scheme and
an anonymous authentication protocol for roaming
service, respectively. Our generic construction is pre-
sented in Section 4, where security analysis and per-
formance evaluation are also included. Section 5 con-
cludes the paper.
2 SMART CARD BASED
PASSWORD
AUTHENTICATION
Our anonymous authentication protocol is built upon
a smart card based password authentication (SCBPA)
scheme.
In a smart card based password authentication
scheme, a participant may be a user U or a remote
server S. The scheme consists of three phases: regis-
tration phase, login phase, and authentication phase.
(1) Registration Phase (SCBPA.Reg). When a user
U registers with a server S,U selects his password
PW and submits it along with his identifier ID to
the server S through a secure channel. Then S is-
sues a certain smart card to U.
(2) Login Phase (SCBPA.Log). The user U inserts
his smart card to a terminal and keys in his iden-
tifier ID and password PW. Then the terminal
computes and sends on behalf of the user a lo-
gin request message m to the remote server S. To
authenticate the user, a secret value sv should be
embedded in the message m in a cryptographic
manner (e.g., through encryption), so that only
the user U and the server S are able to compute
sv, while any other entity cannot obtain sv even if
he eavesdrops on the communication channel and
thus knows the message m.
(3) Authentication Phase (SCBPA.Auth). The
server S checks the legitimacy of the received
message m by verifying the secret value sv, and
consequently determines whether to accept U’s
login request or not.
As mentioned above, the registration phase
(SCBPA.Reg) takes place in a secure environment,
and both partiesU and S are assumed to be honest and
to perform exactly according to the scheme specifica-
tion. This phase, in the real word, is typically done
out-of-band (e.g., at a service counter) so that the
transaction is authenticated, confidential, and reliable.
In the login and authentication phases (SCBPA.Log
and SCBPA.Auth), the communication channel is no
longer supposed to be still secure. For example, an
active adversary A may have totally control over the
wireless communication channel; he may intercept,
SECRYPT 2011 - International Conference on Security and Cryptography
270