An ECC-based mutual data access control protocol for next-generation public cloud

Abstract

Through the broad usage of cloud computing and the extensive utilization of next-generation public clouds, people can share valuable information worldwide via a wireless medium. Public cloud computing is used in various domains where thousands of applications are connected and generate numerous amounts of data stored on the cloud servers via an open network channel. However, open transmission is vulnerable to several threats, and its security and privacy are still a big challenge. Some proposed security solutions for protecting next-generation public cloud environments are in the literature. However, these methods may not be suitable for a wide range of applications in a next-generation public cloud environment due to their high computing and communication overheads because if security protocol is strengthened, it inversely impacts performance and vice versa. Furthermore, these security frameworks are vulnerable to several attacks, such as replay, denial-of-service (DoS), insider, server spoofing, and masquerade, and also lack strong user anonymity and privacy protection for the end user. Therefore, this study aims to design an elliptic curve cryptographic (ECC) based data access control protocol for a public cloud environment. The security mechanism of the proposed protocol can be verified using BAN (Burrows-Abadi-Needham) logic and ProVerif 2.03, as well as informally using assumptions and pragmatic illustration. In contrast, in the performance analysis section, we have considered the parameters such as the complexity of storage overheads, communication, and computation time. As per the numerical results obtained in the performance analysis section, the proposed protocol is lightweight, robust, and easily implemented in a practical next-generation cloud computing environment.

Introduction

With the rapid development of high-speed internet, cloud computing has become an essential factor in the information and communication technology (ICT) industry. Next-generation cloud computing provides internet services without exposing the end user’s physical location and system configuration. Cloud computing moves data and computing away from laptops, portable PCs, and desktops into large data centres. It enables better use of distributed resources, combining them to achieve higher throughput and solve huge-scale computation problems [1, 2]. The word “cloud” came from telecommunications when telecom companies started offering Virtual Private Network (VPN) services. Before VPN, these companies provided point-to-point data over circuits that squandered bandwidth. However, using VPN services, they managed to balance the overall network utilization [2]. According to John McCarthy, way back in the 1960s, “computation may someday be organized as a public utility” [3]. In his book, “The Challenge of the Computer Utility” [4], Douglas Parkhill describes how the characteristics of cloud computing were first investigated in 1966. Using next-generation cloud computing, we can access a shared pool of configurable computing resources [2]. These resources can be storage, applications, networks, servers, and services that can be managed with little help from the cloud service provider (CPS) [5]. Cloud computing has many benefits, but security and privacy-related problems must be addressed before migrating to the cloud. Security issues exist at both ends of next-generation public cloud computing, such as users and cloud service providers [6]. Many researchers have proposed different authentication schemes, but these schemes have high communication and computation cost. These methods, however, may not be suitable for a wide range of applications in a next-generation public cloud environment due to their high computing and communication overheads. Furthermore, these security frameworks are susceptible to a wide range of attacks, including, but not limited to, man-in-the-middle (MITM), replay, denial-of-service (DoS), insider, server spoofing, masquerade threats, and many others. Also, it does not provide adequate safeguards to ensure the privacy and anonymity of its users. Consequently, this work aims to develop an ECC-based authentication system for the privacy of a next-generation public cloud environment. ECC is a public-key cryptography scheme based on the algebraic structure of the elliptic curve over finite fields. The key size of ECC-based protocols is smaller than other non-ECC cryptographic techniques. Thus, it reduces the storage and transmission requirements. For example, if the RSA public key uses 3072 bits to secure data, the ECC provides the same security in just 256 bits. Therefore, the ECC reduces packet overheads, power consumption and removes needless computation power [7]. Finally, the performance analysis section considered the complexity of storage overheads, communication, and computation costs. In the end, the analysis section shows that the proposed scheme is lightweight, robust, and easily implemented in a practical next-generation public cloud computing environment.

Motivation and contributions

With the proliferation of next-generation public cloud computing and the integration of the Internet of Things (IoT), the most difficult challenge is the authentication of a remote user over an insecure channel. Few security applications provide anonymity from adversaries but cannot be offered in the case of a next-generation public cloud. The author [8] utilized a discrete logarithm problem to authenticate three-party authentication. According to our analysis, the protocol [8] has high computation and communication overheads that are unsuitable for energy and resource constraint devices such as mobile and IoT and also insecure against potential threats, which was a prime motivation for us to design a new security scheme. Other main contributions of this research paper are as under:

• 1. The proposed protocol uses lightweight elliptical curve cryptography (ECC) public key technique to resist potential attacks.

• 2. The proposed protocol is verifiably protected in the BAN logic against the hardness assumptions of the elliptic curve discrete logarithm problem and the elliptic curve computational Diffie-Hellman problem.

• 3. The proposed protocol is secure, based on analyzing the automated verification software toolkit ProVerif 2.03.

• 4. The proposed protocol will have lower communication costs, computation complexity, and less storage overhead than the existing protocols.

• 5. The proposed protocol significantly balances the performance and security measures often lacking in existing schemes.

Paper organization

This article is organized as follows: Section “Preliminaries” provides a detailed examination of the preliminary topics. The literature review is presented in Section “Literature review”. Section “Proposed scheme” focuses on the proposed scenario, while Section “Security analysis” examines the security analysis. The performance of the framework is explored in Section “Performance analysis”. Finally, Section “Conclusion” concludes the paper.

Preliminaries

This section discusses, defines, and illustrates the key terms used in this research study. The basic concepts and ideas are necessary to improve cryptography and security, which are not exhaustively considered.

Hash function

A hash function is a mathematical function used to check the message’s integrity [5]. Moreover, the hash function converts a numerical input value into a compressed numerical value. A hash function’s output value, on the other hand, is always of a fixed length, such as $h\left( 0,1\right) ^*\epsilon Zq^*$ produces fixed size out $M = h(Str)$, where Str is a random size input string [9]. It is simple and easy to compute $M = h(Str)$ if Str is given, although it is impractical to figure out Str if $M = h(Str)$ is specified. Furthermore, the size of a hash value is significantly less than the original message because the hash function sometimes refers to the compression function. Therefore, converting messages to hash values is easy. However, the actual message is very hard to calculate from the hash value. Moreover, when an exact message is converted $\eta$ times, the hash function values remain the same. Therefore, the hash function could not be successfully performed when the two messages have the same hash value. However, it is not the case in general.

Elliptic curve cryptography (ECC)

ECC is more efficient than Diffie Hellman, DSA, and RSA cryptographic protocols [7, 10]. The ECC is defined by an elliptic curve $Eq(a,b):y^{2}=x^{3}+ax+b \; mod\; q$, where a and b belong to $Z_q \lbrace a,b \; \epsilon \; Z_q^{*} \rbrace$. Furthermore, a and b selection must be carefully chosen to satisfy $4a^{3}+27b \; mod \; q \; \ne \; 0$, where q represents a prime number, and the length of q is equal and greater than 160 bits $\lbrace |q|\ge 160 \;bits \rbrace$. The ECC has two operations: the ECC point of multiplication and the ECC point of addition. ECC is symmetric about the $x-axis$. Therefore, drawing a line on the graph takes a maximum cut of 3 points. Let $E_q (a,b)$ be the point on the elliptic curve, consider the equation $Q=KP$ where Q, P point on the curve and $K\leqslant n$. if K and P are given, it should be easy to find Q, but it is complicated to find K if we know Q and P.

System model

The system model presented in this subsection consisted of the end-user and next-generation public cloud servers (NG-PCS). The next-generation public cloud server plays a crucial role in our system model. It provides connectivity, data access, storage facilities, data sharing, cookies, and other security services for all its users. It is worth mentioning here that the next-generation public cloud server is considered a trusted entity because, without declaring it trusted, it will degrade the overall system. The end user alone cannot be trusted because it can degrade system credibility. In order to access the next-generation public cloud server, the user sends a request message. The next-generation public cloud server sends a challenge message back to the user to check the authenticity of a user. After receiving the response message from the user, the next-generation public server starts the session with the user if the user is legit. The detailed procedure is explained in the proposed protocol. Our system model is shown in Fig. 1.

Fig. 1

System model

Threat model

Dolev and Yao first demonstrated the DY threat model [11]. We have extended the threat model used in [1, 12] by adopting a solid adversary ($\forall$). According to this model, any threat to the system can be analyzed and examined before operationalizing it for the real-world environment. So, keeping this view, all possible threats to our system include:

• 1. An $\forall$ intercepts the communication between a user and the next-generation public cloud server.

• 2. An $\forall$ captures the open network channel data for possible insertion, deletion, and modification.

• 3. The $\forall$ can dynamically monitor the broadcast message among legal peers.

• 4. An $\forall$ can act as a legal participant and launch masquerading, impersonation, and man-in-the-middle attacks.

• 5. The communication medium between the user and the next-generation public cloud server is secure. However, the $\forall$ can intrude into the insecure communication medium between the user and the next-generation public cloud server.

• 6. The identity of the next-generation public cloud server is publicly announced.

• 7. The $\forall$ cannot extract the next-generation public cloud server’s secret key $SK_{pcs}$.

• 8. Other system threats are privacy, server spoofing, insider, and session key threats.

Security goals

The security requirement goals were introduced by Canetti [13]. The increasing usage of next-generation cloud computing increases the probability of being attacked remotely. The cloud service provider or the user can be compromised in next-generation cloud computing. Therefore, the attacker can take control of user data without having physical access to the server. Moreover, remote access to the cloud can compromise sensitive information, and the primary cause of unauthorized access to the communication may be replayed, modified, spoofed, or eavesdropped. Thus, all communication peers must be authenticated to prevent unauthorized access to secure transmitted information. Therefore, our proposed scheme aims to achieve the following security goals (SGs) and compares SG’s existing schemes in the performance section.

SG 1. Resists Offline Password Guessing Attacks: The $\forall$ can guess the user’s password and gets access to sensitive data of the next-generation public cloud server. However, the protocol should be strong enough to prevent this attack.

SG 2. Free from De-synchronization Attacks:The $\forall$ tries to update or synchronize something on both peers, such as the $\forall$ trying to update a user’s password or block communication between the next-generation public cloud server and the user. The protocol should be capable of resisting de-synchronization attacks.

SG 3. Provision of Key Agreement:The user and next-generation public cloud server authenticate using secure values and integers to communicate securely.

SG 4. Spoofing Attacks: The $\forall$ falsifying data and trying to impersonate a legit user to access the next-generation public cloud server. Therefore, the proposed scheme should be strong enough to prevent spoofing attacks.

SG 5. Resists Insider Attack:$\forall$ tries to pretend to be a legitimate user or attempts to access the user-sensitive data. Therefore, the protocol must prevent insider attacks.

SG 6. Perfect Message Authentication:The $\forall$ trying to send unverified messages to the next-generation public cloud server or user to gain access to the communication. Therefore, the scheme should prevent the next-generation public cloud server and the user from falsifying messages.

SG 7. User Anonymity: The scheme should be capable of maintaining user anonymity if the $\forall$ is trying to capture an authentication message.

SG 8. Mutual Authentication: The scheme should mutually authenticate the next-generation public cloud server and user to prevent the $\forall$ from pretending to be one of the peers.

SG 9. Replay attacks: An $\forall$ captures the previous session and tries to repeat or delay the communication to confuse peers. The proposed scheme should be capable of preventing replay attacks.

SG 10. Impersonate attack: The $\forall$ tries to use the user identity or password to impersonate the user to access the next-generation public cloud server. However, the protocol should identify the legit user to prevent impersonation attacks.

SG 11. Provide Password Revocation/Changing: If the user forgets his/her password, the proposed scheme should provide a password revocation/changing option to access the next-generation public cloud server.

Literature review

Next-generation public cloud computing offers unlimited access to resources over the internet [14]. It is because of the availability of high-speed internet, more individuals and organizations are outsourcing their data to next-generation cloud servers for later access via the internet, and it reduces the burden on local storage. Although, different sources continuously generate a large amount of data that are outsourced to next-generation public cloud servers [15, 16]. However, securing outsourced data in the cloud is imperative for data owners [17]. In addition, the authentication protocols enable users to access these services through the remote servers over an insecure network. Furthermore, in this part of the literature, we discuss various schemes that have security vulnerabilities and high computation and communication overheads. In 1981, the author [18] proposed the first authentication protocol, which uses a username and password to secure a user’s access to a server. Nevertheless, there was a drawback in the protocol because it maintained a password table. As a result, the adversary can intercept the password, perform a replay attack, and successfully log into the server. In 1990, a more secure two-factor authentication protocol was proposed by [19]. The two-factor authentication protocols use a username, password, and a smartcard. The topic of smartcard loss attacks has recently been brought up in the authentication schemes. Three-factor authentication combines a username, password, and a smartcard, which is a more secure method to access remote servers. Traditional two-factor authentication methods are only used for a single server environment. On the other hand, commercial services are based on a multi-server environment. Thus, the traditional authentication protocols do not provide untraceability and anonymity. Therefore, the author [20] proposed a three-factor authentication protocol; however, according to [21], the protocol proposed in [20] cannot provide user anonymity and is vulnerable to impersonation attacks. Furthermore, a multi-server environment scheme based on three-factor authentication was proposed by [20, 22]. However, according to [23], the protocol [22] is vulnerable to user impersonation attacks. The author [24] improves the security drawbacks of the scheme [25]. Moreover, the protocol [24] is vulnerable to insider and smartcard loss attacks. Therefore, the author [26] improves and solves the security vulnerabilities of the protocol [24]. The author [27] cryptanalysis the scheme [28] and find out security vulnerabilities such as the scheme cannot provide user anonymity. These security vulnerabilities were solved by [29]. The protocol designed by [30] stores the user’s public keys on the server side, and this practice leads to man-in-the-middle attacks. Additionally, the author’s [31] proposed scheme that cannot provide user untraceability and suffers from insider, server impersonation, and man-in-the-middle attacks. Moreover, the scheme [32] exposed the security vulnerabilities in protocols [26, 33]. Therefore, some researchers pay attention to network security, such that [34] proposed a scheme that places a network inspection detection system to verify packets received by the cloud. However, their approach has some drawbacks in its performance. Furthermore, [35] focuses on virtual network security to solve security issues between firewalls and virtual machines. However, against malicious external traffic, the scheme is powerless. On the other hand, the DDOS protection service [36, 37] and the intrusion detection system’s importance were presented by [38]. Moreover, cloud computing offers multi-type network-based services. Thus, a single network security service will not fulfill the network security requirement. Because the cloud is a multi-tenant environment, the security and privacy challenges differ from those encountered in traditional computing environments [39]. According to [40], the existing three-factor authentication schemes have too much communication and computation cost. In addition, they do not have a dynamic revocation mechanism. The scheme proposed by [41] does not establish a session key, and the communication cost is also very high. According to [23], the protocol used by [42] suffers from temporary session information attacks. So far, different approaches have been used to authenticate remote users and eliminate the risk of cyberattacks. The authors [43] proposed an authentication scheme to provide secure authentication for the telecare medicine information system (TMIS). The protocol [43] used XOR, a one-way hash function, and a one-time password. The authors [44, 45] proposed an authentication scheme based on ECC in smart grid environments. The author [46] proposed an ECC-based authentication scheme for telecare medical information systems. Although, the scheme is robust, but vulnerable to offline password guessing attacks, DoS attacks, and user impersonation attacks and cannot provide perfect forward secrecy and anonymity. Another three-factor authentication protocol is proposed by [47]. However, according to [48], the scheme [47] is vulnerable to insider attacks and cannot provide anonymity. Furthermore, the author [48] also claimed that there is a flaw in the scheme [47] password update phase as well. Moreover, accurate authentication of users can prevent forgery attacks. However, to avoid forgery attacks in next-generation public cloud computing, the client and the cloud server must authenticate using mutual or one-way authentication. Although many authentication protocols are proposed in [33, 49,50,51], but most of these schemes lack mutual authentication. These existing protocols are also vulnerable to MITM, impersonation, synchronization, and playback attacks [52]. According to [53], mutual authentication is essential to determine if the communication between two parties is genuine. Recently, researchers have developed authentication schemes based on lattice-based and Identity-Based Encryption (IBE) [54]. IBE is a two-factor security protection mechanism proposed by the authors [55]. In the IBE protocol, the sender only needs to know the receiver’s identity to which it wants to send data, and no other information is required. The sender transmits data to the cloud, where the receiver can download the necessary data when needed. To decrypt the data, the receiver needs two things. The first one is the secret key, and the second is a unique personal security device. Hence, it is impossible to decrypt the ciphertext without these two devices. Hereafter, the unique personal device can be revoked if it gets lost. In both cases, the user data on the next-generation public cloud server is highly vulnerable to access by an adversary. Furthermore, in the authentication process, deep learning and neural network are also used [56]. Deep learning is a type of machine learning in which algorithms are used to learn from large datasets [57]. Neural networks are a type of artificial neural network (ANN) made up of interconnected layers of neurons that use inputs to generate predictions or decisions [58, 59]. Both of these technologies are used in authentication systems to assist in identifying and authenticating users, detecting anomalies and fraud, and improving system security. Deep learning can recognize patterns and classify data, whereas neural networks can detect patterns and anomalies, as well as recognize faces and fingerprints. Although, elliptic curve cryptography (ECC) is a prominent asymmetric cryptographic scheme that can provide security like the RSA technique, with a smaller key size and lightweight nature. However, according to [60] that the scheme used in [61] and [62] suffers from no anonymity, DoS, reply, masquerade and impersonation attacks. Meanwhile, in the scheme [62], information can be easily intercepted and injected by an adversary over a public channel. However, according to [63, 64], it is impossible for anyone to inject false information and break the credentials of the session shared key by using the Elliptic Curve computation Diffie-Hellman technique [63] and Elliptic Curve Discrete Logarithmic problem [64]. As a result, according to the author [65], the session key is not secure between different peers in the [66], and the scheme is vulnerable to masquerade attacks. Hence, a protocol has been proposed in [66] to overcome [65] scheme issues by using a robust protocol based on ECC by keeping a point at infinity on the curve. Through this technique, the attacker cannot challenge the legitimacy of the peers. Meanwhile, the author [67] is trying to solve the DoS attack in the scheme [65]. Finally, the abovementioned schemes have security vulnerabilities, high communication, and computation overheads. Therefore, it is not suitable for resources and energy constraints devices. Thus, we are designing a lightweight authentication protocol for next-generation public cloud computing to achieve lower computation and communication overhead while not compromising on security. We also illustrate a comprehensive literature review in Table 1.

Table 1 Comprehensive literature review

Proposed scheme

This section presents the proposed ECC-based mutual data access control protocol for the next-generation public cloud server. There are 4 phases of our proposed protocol, i.e., setup, registration, key agreement, and password change. Each of these phases is described below, and Table 2 shows the symbols used to describe them.

Table 2 Common symbols

Setup procedure

This phase of our proposed protocol is accomplished in the following ways.

• 1. At the start, the Public Cloud Server (PCS) picks a non-singular elliptic curve $E (F_q)$.

• 2. Select Point P from the curve of ECC $( E/F_q)\rightarrow P$

• 3. Select collision-free one-way hash functions $h_1 ( . ) \rightarrow \lbrace 0,1 \rbrace ^{*}, h_2 (.) \rightarrow \lbrace 1,0\rbrace ^{*}$

• 4. Select a secret value of PCS, namely s.

• 5. Compute a master secret key $MSK_{PCS}=P.s$

• 6. The PCS selects g, the base point of an order G.

• 7. Finally, the public cloud server publishes ${g,G,h_1(.),h_2(.)}$.

Registration procedure

This phase of our proposed protocol is accomplished in the following ways.

• 1. User, u will register itself with the public cloud server in the registration phase. The u chooses identity $ID_u$ password $PW_u$ and a random number $r_{u} \epsilon \, Z_q^{*}$. Furthermore, the u computes $PID_u=h(ID_u\parallel r_u\parallel PW_u)$ and sends $<ID_u, PID_u>$ over a secure channel.

• 2. After receiving, the message from u, the public cloud server generates a random number $r_{PCS} \; \epsilon \; Z_{q}^{*}$ and computes $V_1=ID_u \bigoplus r_{PCS}, V_2=h(ID_u\parallel V_1 \parallel r_{PCS})\bigoplus MSK_{PCS}$, and $V_3=V_2 \bigoplus PID_u$. After computation, the public cloud server sends $<V_1, V_3, G, g, h(.)>$ message towards u over a secure channel.

• 3. On receiving $<V_1, V_3, G, g, h(.)>$ message, the user u calculates $S_{1}=r_{u} \bigoplus h(ID_{u} \parallel PID_{u}), S_{2}=h(PID_{u} \parallel S_{1}), S_{3}=r_{u} \bigoplus h(ID_{u}\parallel V_1)$ and saves $\lbrace S_1, S_2, S_3, g, G, h(.)\rbrace$ in its memory as shown in Fig. 2.

  Fig. 2

  

  Registration procedure

Key-agreement procedure

After successful registration, the user sends an entry request to the next-generation public cloud server for mutual authentication and cross-verification.

• 1. The user provides an identity $ID_u$ password $PW_u$ and compute $r_u^{*}=S_1\bigoplus h(ID_u\Vert PID_u), PID_u^{/}=h(ID_u\Vert r_u^{*}\Vert PW_u), S_2^{/}=h(PID_u^{/}\Vert S_1)$ and verify $S_2^{/}?=S_2$. If it is validated, compute it further; otherwise, suspend it. Now, the user u generates another random number $r_{u1} \; \epsilon \; Z_q^{*}$ and computes $V_{2}^{*}=V_{3}\bigoplus PID_{u}^{/}, V_{1}^{*}=h(ID_{u}\Vert V_{1}) \bigoplus r_{u1}, C_{2=h}(ID_{u}\Vert r_{u}\Vert V_{1}^{*}), K_{u1}=h(ID_{u}\Vert r_{u}\Vert S_{3})$ and selects timestamp $T_{LA1}$, compute $N=h(ID_u\Vert V_1^{*}\Vert C_2\Vert V_2^{*}\Vert T_{LA1})$ and sends $< S_3, V_1^{*}, C_2, N, T_{LA1}>$ message toward cloud server over a public channel.

• 2. After receiving $< S_3, V_1^{*}, C_2, N, T_{LA1}>$ message, the cloud server selects its random number $r_{PCS} \; \epsilon \; Z_q^{*}$ computes $K_{PCS1}=h(ID_u\parallel S_3)\bigoplus h(r_{PCS}\parallel S_3)$ verify $T_{LA2}-T_{LA1} \le \vartriangleleft T$, if found within the pre-defined time interval, continue onward, else, terminate it. Further, compute: $S_3^{*}= r_{PCS} \bigoplus h(ID_u\parallel V_1), V_2^{*} = h (ID_u \parallel V_1 \parallel r_{PCS})\bigoplus MSK_{PCS}$, verifies $V_2^{*}? =V_2$, if validated, proceed; else, terminate. Computes $N^{*}=h(ID_u \parallel V_1^{*} \parallel C_2\parallel V_2^{*}\parallel T_{LA1})$ and again checks $N^{*}?=N, V_1^{**}=h(ID_u^{*} \parallel K_{PCS}) \bigoplus h(S_3\parallel r_{PCS})$ selects another random number $r_{PCS1}\; \epsilon \;Z_q^{*}$, timestamp $T_{LA3}$ and compute $K^{*}_{PCS} = h(V_1^{**}\parallel C_2\parallel V_2^{*}\parallel N^{*}\parallel T_{LA3}), SK_{PCS} = h(ID_u^{*} \parallel ID_{PCS} \parallel K^{*}_{PCS} \parallel N^{*}.g \parallel r_{u1}.r_{pcs1}.g\parallel V_2^{*}\parallel T_{LA3}), W= h(r_{u1}.g \parallel r_{PCS1}.g\parallel r_{u1}.r_{pcs1}.g\parallel T_{LA3}), X = SK_{PCS}\bigoplus h(ID_u^{*}\parallel V_2\parallel ID_{PCS}), Y = ID_{PCS} \bigoplus h (S_3\parallel r_u\parallel N^{*}\parallel V_1^{*}\parallel V_2^{**})$ and send back $< W,X,Y>$ message towards user over a public channel.

• 3. After Collecting $< W, X, Y>$ message from the cloud server, the user first checks the time validity $T_{LA}-T_{LA4} \le \vartriangleleft T$ if it is true, then proceeds further and computes $K_{u2}= h(V_1^{*} \parallel C_2 \parallel V_2 \parallel N \parallel T_{LA3}), W^{*}= h (r_{u1}.g \parallel r_{PCS1}.g\parallel r_{u1}.r_{pcs1}.g\parallel T_{LA3})$, verifies $W^{*}?=W, X^{*} = SK_{PCS}\bigoplus h(ID_u\parallel V_2\parallel ID_{PCS}^{*}), Y^{*} = ID_{PCS} \bigoplus h (S_3 \parallel r_u \parallel N^{*} \parallel V_1^{*}\parallel V_2^{**})$ and $SK_u=h(ID_u^{*}\parallel ID_{PCS} \parallel K^{*}_{PCS}\parallel N^{*}.g\parallel r_{u1}.r_{pcs1}.g\parallel V_2^{*}\parallel T_{LA3})$ and establish it the secret session key as shown in Fig. 3.

  Fig. 3

  

  Key-agreement procedure

Password change procedure

 

• 1. Input $ID_u^{'}$ and $PW_u^{'}$.

• 2. After received $ID_u^{'}$ and $PW_u^{'}$, computes $r_u^*= S_1 \bigoplus h(ID_u^{'} \parallel PW_u^{'}), PID_u^{'}=h(ID_u^{'} \parallel r_u^{*} \parallel PW_u^{'} ), V_2^{*}=V_3 \bigoplus PID_u^{'}$, and verifies $S_2=^{?} h(PW_u^{'} \parallel S_1)$ if it is true, then permit to change the password; otherwise, terminate the request. $r_u^{NEW}= S_1 \bigoplus h(ID_u^{'} \parallel PW_u^{NEW}), PID_u^{NEW}=h(ID_u^{'} \parallel r_u^{NEW} \parallel PW_u^{NEW} ), S_1^{NEW}= r_u^{NEW}\bigoplus h(ID_u^{'} \parallel PID_u^{NEW}), V_3^{NEW}= V_2\bigoplus PID_u^{NEW}$.

• 3. After computing the value, replace $\lbrace PW_u, S_1,S_3\rbrace$ with $\lbrace PW_u^{NEW},S_1^{NEW}, S_3^{NEW}\rbrace$ and update the password.

Security analysis

In this section, we scrutinize the security of the proposed authentication protocol, both formally using BAN logic, Proverif2.03, and informally using a pragmatic illustration. The detailed security proof is as under:

Formal security analysis

Here we have shown how the protocol provides trust and, freshness, correctness and how the protocol develops attacks based on a lack of security features. It also discusses why broad authentication protocol assaults occur and how to deal with them on the basis of trustworthiness and freshness. Keeping all of these problems in mind, we formally examine them using the two methodologies that researchers commonly employ.

ProVerif 2.03 simulation

ProVerif 2.03 is the widely used verification software toolkit for checking session key reachability, confidentiality, and secrecy. Upon simulating, we first define two channels (secure and public) and then define events, constraints, and functions. The result generated demonstrates that the secret session key $(S_k)$, at any stage, could not be attacked by an attacker, as given in Fig. 4.

Fig. 4

ProVerif code and result

BAN logic

A logic of trust, belief, and correctness of the protocol was first presented by Bahrower-Abdi-Nedhem in 1990 [54] and named BAN logic. Table 3 shows the primary symbols of BAN logic. The correctness of the proposed protocol is verified using the BAN (Burrows-Abadi-Needham) logic of belief.

Table 3 BAN logic basic symbols

BAN Logic Rules: The following basic BAN logic rules are well-defined including:

Message Meaning:

$$\begin{aligned} \frac{u\;\mid \equiv \; u \,\xleftarrow {S_{K}}\xrightarrow \,PCS, \vartriangleleft \lbrace X \rbrace }{u\;\mid \equiv \; PCS \mid \sim X} \end{aligned}$$

(1)

If u believe that u and PCS share $S_K$ and sees message X, then u believe PCS once said X.

Message Meaning:

$$\begin{aligned} \frac{u\;\mid \equiv \; \# (X), PCS\mid \sim X}{u\;\mid \equiv \; PCS\;\mid \equiv \;X} \end{aligned}$$

(2)

If u believes that message X is fresh and that PCS once said X, then u believes that PCS believes message X.

Jurisdiction Rule:

$$\begin{aligned} \frac{u\;\mid \equiv \; PCS \mid \Rightarrow (X),u\;\mid \equiv \; PCS\;\mid \equiv \;u}{PCS\;\mid \equiv \;u} \end{aligned}$$

(3)

If u believes PCS control X because it has under the jurisdiction of both peer and u believes that PCS believes message X, then u believes message X.

Session Key Rule:

$$\begin{aligned} \frac{u\;\mid \equiv \; \# (X), u\;\mid \equiv \;PCS\;\mid \equiv \; X!}{u\;\mid \equiv \;X \,\xleftarrow {S_K}\xrightarrow \,PCS} \end{aligned}$$

(4)

If u believes that message X is fresh, and PCS believes X, then u believes that they shared session key

Goals:

$$\begin{aligned} Goal_1=u\;\mid \equiv \; (u \,\xleftarrow {S_K}\xrightarrow \,PCS)\end{aligned}$$

(5)

$$\begin{aligned} Goal_2=u\;\mid \equiv \; PCS\;\mid \equiv \;(u\,\xleftarrow {S_K}\xrightarrow \,PCS)\end{aligned}$$

(6)

$$\begin{aligned} Goal_3=PCS\;\mid \equiv \; (u \,\xleftarrow {S_K}\xrightarrow \,PCS)\end{aligned}$$

(7)

$$\begin{aligned} Goal_4=PCS\;\mid \equiv \; u\;\mid \equiv \;(u\,\xleftarrow {S_K}\xrightarrow \,PCS) \end{aligned}$$

(8)

Idealize Form:

$$\begin{aligned} Message_1. u\longrightarrow PCS:\lbrace S_3, V_1^{*}, C_2, N, T_{LA1}\rbrace \end{aligned}$$

(9)

$$\begin{aligned} Message_2. PCS\longrightarrow u:\lbrace W,X,Y \rbrace \end{aligned}$$

(10)

Initial Assumptions:

$$\begin{aligned} A_1. u\mid \equiv \# (r_{u1})\end{aligned}$$

(11)

$$\begin{aligned} A_2. u\mid \equiv \# (r_u^{*})\end{aligned}$$

(12)

$$\begin{aligned} A_3. u\mid \equiv PCS \,\xleftarrow {SK_{PCS}}\xrightarrow \,u) \end{aligned}$$

(13)

$$\begin{aligned} A_4. u\mid \equiv u \,\xleftarrow {ID_u, PID_u}\xrightarrow \,PCS)\end{aligned}$$

(14)

$$\begin{aligned} A_5. PCS\mid \equiv \# (r_{pcs})\end{aligned}$$

(15)

$$\begin{aligned} A_6. PCS\mid \equiv PCS \,\xleftarrow {SK_{PCS}}\xrightarrow \,u) \end{aligned}$$

(16)

$$\begin{aligned} A_7. PCS\mid \equiv PCS \,\xleftarrow {V_1,V_3,G,g,h(.)}\xrightarrow \,u) \end{aligned}$$

(17)

Keeping the assumptions mentioned above in mind, we proceed step by step to achieve the aforementioned objectives. So, according to $Message_1$ and $A_1$, we get,

$$\begin{aligned} A_8. u\mid \equiv r_{u1}\longrightarrow \lbrace S_3, V_1^{*}, C_2, N, T_{LA1}\rbrace \end{aligned}$$

(18)

By taking $A_3$ and $A_8$, we get,

$$\begin{aligned} A_9. u\mid \equiv \lbrace S_3, V_1^{*}, C_2, N, T_{LA1}\rbrace \end{aligned}$$

(19)

Now, taking $A_2$ and $A_9$, we get,

$$\begin{aligned} A_{10}. u\mid \equiv \# (r_u^{*}) \rightarrow \lbrace S_3, V_1^{*}, C_2, N, T_{LA1}\rbrace \end{aligned}$$

(20)

Finally, by taking $A_3$ and $A_{10}$, we get,

$$\begin{aligned} A_{11}. u\mid \equiv \rightarrow \lbrace S_3, V_1^{*}, C_2, N, T_{LA1}\rbrace \end{aligned}$$

(21)

$A_{11}$ can also be written as:

$$\begin{aligned} A_{12}. u\mid \equiv (u \rightarrow \lbrace S_3, V_1^{*}, C_2, N, T_{LA1})\rbrace \end{aligned}$$

(22)

The $A_{12}$ can be written as:

$$\begin{aligned} A_{13}. u\mid \equiv (u \,\xleftarrow {S_K}\xrightarrow \, \lbrace S_3, V_1^{*}, C_2, N, T_{LA1})\rbrace \end{aligned}$$

(23)

or

$$\begin{aligned} A_{14}. u\mid \equiv (u \,\xleftarrow {S_K}\xrightarrow \, PCS)\rbrace \end{aligned}$$

(24)

Getting $A_{14}$ we achieved Goal1.

Taking $message_1$ and $A_5$, we get,

$$\begin{aligned} A_{15}. u\mid \equiv PCS \rightarrow \# (r_{PCS}):\lbrace S_3, V_1^{*}, C_2, N, T_{LA1}\rbrace \end{aligned}$$

(25)

Take $A_4$ and $A_{15}$, and we get

$$\begin{aligned} A_{16}. u \rightarrow PCS \mid \equiv u \rightarrow (u \,\xleftarrow {S_K}\xrightarrow \, PCS), \end{aligned}$$

(26)

We can also write this equation as:

$$\begin{aligned} A_{17}. u \mid \equiv PCS \mid \equiv (u \,\xleftarrow {S_K}\xrightarrow \, PCS) \end{aligned}$$

(27)

Getting $A_{17}$ we achieved Goal2.

For the following two goals, let’s take $Message_2$ and $A_6$

$$\begin{aligned} A_{18}. PCS \rightarrow \mid \equiv PCS \,\xleftarrow {SK_{PCS}}\xrightarrow \, u: \lbrace W.X,Y \rbrace \end{aligned}$$

(28)

$A_7$ and $A_{18}$ becomes

$$\begin{aligned} A_{19}. PCS \rightarrow \mid \equiv \,\xleftarrow {V_1,V_3,G,g,h(.)}\xrightarrow \, u: \lbrace W.X,Y \rbrace \end{aligned}$$

(29)

$$\begin{aligned} A_{20}. PCS \,\xleftarrow {V_1,V_3,G,g,h(.)}\xrightarrow \, u:\mid \equiv \lbrace W.X,Y \rbrace \end{aligned}$$

(30)

$A_{18}$ and $A_{20}$ can write as

$$\begin{aligned} A_{21}. PCS \,\xleftarrow {SK_{PCS}}\xrightarrow \, u\mid \equiv \lbrace W.X,Y \rbrace \end{aligned}$$

(31)

$$\begin{aligned} A_{22}. PCS \mid \equiv u \,\xleftarrow {SK_{PCS}}\xrightarrow \, \lbrace W.X,Y \rbrace \end{aligned}$$

(32)

$$\begin{aligned} A_{23}. PCS \mid \equiv (u \,\xleftarrow {SK_{PCS}}\xrightarrow \, PCS) \end{aligned}$$

(33)

Getting $A_{23}$ we achieved Goal3.

Now, for the $Goal_4$, we will take $A_{23}$ and $A_2$.

$$\begin{aligned} A_{24}. PCS \mid \equiv (u \,\xleftarrow {SK_{PCS}}\xrightarrow \, PCS): \# (r_u^{*}) \end{aligned}$$

(34)

Taking $A_{21}$ and $A_{24}$, we get

$$\begin{aligned} A_{25}. PCS \,\xleftarrow {SK_{PCS}}\xrightarrow \, u: \mid \equiv \,\xleftarrow {SK_{PCS}}\xrightarrow \, PCS): \# (r_u^{*}) \end{aligned}$$

(35)

Take $A_{19}$ and $A_{25}$, and we get

$$\begin{aligned} A_{26}. PCS \mid \equiv u: \mid \equiv \# (r_u^{*}) \end{aligned}$$

(36)

or

$$\begin{aligned} A_{27}. PCS \mid \equiv u \mid \equiv ( u \,\xleftarrow {SK_{PCS}}\xrightarrow \, PCS) \end{aligned}$$

(37)

From $A_{26}$ and $A_{27}$, we get that

$$\begin{aligned} A_{28}. PCS \mid \equiv u \mid \equiv ( u \,\xleftarrow {S_K}\xrightarrow \, PCS) \end{aligned}$$

(38)

Getting $A_{28}$ we achieved Goal4.

Informal security analysis

We present a pragmatic discussion of different attacks for achieving the key security and feature attributes. These are as follows:

• 1. Resists Offline Password Guessing Attack: Let’s suppose the adversary $\forall$ guesses the $ID_\forall , PW_\forall$, and random number $r_\forall$ and computes $PID_\forall = h (ID_\forall \Vert r_\forall \Vert PW_\forall )$ and later launches the attack. After checking $ID_u, PID_u$, and verifying the condition $S_2=^{?}h(PID_\forall \Vert S1)$. The adversary $\forall$ tests $ID_\forall =^{?}IDu, PW_\forall =^{?}PWu$, and $PID_\forall =^{?}PIDu$. However, $ID_\forall$ and $PW_\forall$ are finite values, while $r_\forall$ is too hard to guess; thus, our scheme resists offline password-guessing attacks.

• 2. Free from De-synchronization Attack: There is no need to update the proposed scheme’s parameters on the user or PCS side. In contrast, in the case of the password update phase, the entities validate each other. Therefore, the user and PCS do not require synchronization properties in the proposed scheme.

• 3. Provision of Key Agreement: In our proposed protocol, the user and PCS authenticate each other with $ID_u^{*}= ID_u, ID_{PCS}^{*}= ID_{PCS}$, $N^{*}=N , V_2{*}=^{?}V_2$ and agree on $S_K= S_{Ku}= S_{KPCS}$.

• 4. Spoofing Attack: $SK_{PCS}$ is a secret key of PCS; hence $\forall$ cannot calculate $V_2=h(ID_u \Vert V_1 \Vert r_{PCS})$ and $N^{*}=h(ID_u \Vert V_1^{*} \Vert C_2^{*} \Vert V_2^{*} \Vert T_{LA1} )$ Thus $N^{*} \ne N$ Therefore, $\forall$ cannot launch a spoofing attack.

• 5. Resists Insider Attack: In the proposed protocol registration phase u calculate $PID_u=h(ID_u \Vert r_u1 \Vert PW_u )$, where $r_{u1}$ is a random number, and thus the administrators are unable to get $PID_u$. Therefore, our proposed scheme resists insider attacks.

• 6. Perfect Message Authentication: The PCS received $Message_1=(S_3, V_1^{*}, C_2, N, T_{LA1})$ and verified $T_{LA2}-T_{LA1} \; \leqslant \; \vartriangle T, V_2^{*}=^{?}V_2$ and $N^{*}=^{?}N$ then sent $Message_2=(W, X,Y)$ toward the u, and the user verified $T_{LA4}-T_{LA3}\; \leqslant \; \vartriangle T$, $W_=^{?} W, X=^{?} X$ and $Y=^{?} Y$. After the verification process, the message will not be accepted if any message fails. Therefore, authentication is verified between u and PCS

• 7. Support Anonymity: In the proposed protocol, the PCS uses the anonymous identity of u $ID_u^{*}$ and for itself $ID_{PCS}^{*}$. Therefore, the identity is untraceable.

• 8. Offers Mutual Authentication: In the proposed protocol login and authentication phase, the PCS compute $W=h(r_{u1}.g\Vert r_{PCS1}.g\Vert r_{u1}.r_{pcs1}.g\Vert T_{LA3})$ and u verify $W_=^{?}h(r_{u1}.g\Vert r_{PCS1}.g\Vert r_{u1}.r_{pcs1}.g \Vert T_{LA3})$ thus, u and PCS mutual authenticate each other.

• 9. Resists Replay Attack: The proposed protocol uses timestamps and random numbers to resist replay attacks. LAP timestamp $T-T\; \leqslant \; \vartriangle T$, where $\vartriangle T$ is the max time delay. Moreover, u and PCS used different random numbers. If the $\forall$ tries to launch a replay attack, the proposed scheme verifies $W_=^{?}h(r_{u1}.g\Vert r_{PCS1}.g\Vert r_{u1}.r_{pcs1}.g \Vert T_{LA3}), N^{*}=N$ and session key $S_{K}=S_{Ku}=S_{KPCS}$ Thus, the proposed scheme is secure against reply attacks.

• 10. Resists Stolen Verifier Attack: Our proposed scheme does not store password verification and validation tables in the database on the PCS side. Thus, $\forall$ cannot masquerade as a u to mislead the PCS in the authentication process. Therefore, our scheme resists stolen verifier attacks.

• 11. Free of Impersonation Attack: The $\forall$ commonly use two techniques in order to impersonate u. The first one $ID_u$, and the second one is $PW_u$, and it uses these two techniques, the $\forall$ constructs $Messgae_1=(S_3, V_1^{*}, C_2, N, T_{LA1})$. However, the stolen verifier and offline password guessing attack are impossible for $\forall$. Thus, our scheme is more secure against user impersonation attacks.

• 12. Man-in-The-Middle (MITM) Attacks: In our proposed protocol, the user (u) and next-generation public cloud server (PCS) share session keys after the mutual authentication. The $\forall$ needs $u, ID_u, PW_u$, and PCS secret key $S_{KPCS}$ to pass verification. The $\forall$ also cannot guess random numbers $r_u, r_{PCS}$. Therefore, the $\forall$ cannot construct a connection with PCS and u; thus, the proposed scheme resists man-in-the-middle attacks.

Performance analysis

This section is carried out by considering four features of protocol performance, including the security comparison shown in Table 4, storage overheads, communication costs, and computation time complexity; each of these can be described for the proposed protocol as under:

Table 4 Security features comparison

Security feature

We have compared our proposed protocol to existing schemes in this part of the article, such as [7, 23, 31, 40,41,42, 69724 shows that our proposed scheme resists all known possible security threats.

Storage overheads

First of all, we considered the work done by Kilinc et al. [73]. The hash code is 160 bits, the identity is 64 bits, the password is 60 bits, and the timestamp is 56 bits. Therefore, keeping this in view, the storage process for the proposed protocol is considered only in the registration phase, i.e., $S_1=320$ bits, $S_2= 160$ bits, $S_3= 320$ bits, $g=160$ bits, $G=160$ bits, $h(.)=160$ bits, $ID=64$ bits, $PW=60$ bits, and timestamp = 56 bits. $(320+ 160+ 320+ 160+ 160+ 160+ 64+ 60+ 56= 1460)$.

Communication cost

In this section, our proposed scheme communication cost is discussed and calculated. The communication cost is calculated using the messages transmitted between the u and the PCS in the login and authentication. u to $PCS Messgae_1=(S_3,V_1^{*},C_2,N,T_{LA1}), {(160+160) + (160+160) + (160) + (160) + (56) =1016}$, while from PCS to $u Message_2=(W,X,Y)$,${(160+56) + (160+160) + (64+160) = 760}$. Therefore, the total communication cost of our proposed protocol is 1776 bits. Moreover, the communication cost comparison of our proposed scheme with [23, 31, 40,41,42, 69,70,71,72] is shown in Fig. 5. Figure 5 shows that our scheme is lightweight than the existing schemes, except [69]. However, the computation cost of [69] is much higher than our scheme.

Fig. 5

Communication cost comparison

Computation cost

In this section, we consider the work accomplished by [73] that used a smartphone with a memory of 4 GB, a CPU size of an octa-core 2.01 GHz processor, and a laptop with an intel core $i7-2620 M (2.7 GHz processor)$, and 4 GB of RAM. Keep in mind that the first is a user and the last is a next-generation public cloud server. Let’s suppose the computation cost for a one-way hash function is denoted by $T_h,$XOR$, T_\phi$, ECC point of multiplication $T_M$, point of an addition $T_A$, random number extraction $T_R$. Figure 6 shows that our scheme achieved better computation costs than existing schemes. Furthermore, the computation comparison of our scheme with the existing protocols is illustrated in Fig. 6.

Fig. 6

Computation cost comparison

Conclusion

Nowadays, users outsource a tremendous amount of data remotely to the next-generation public cloud. The main concern with data broadcasting is how to securely access it, which is a big challenge for researchers. Therefore, we attempted to make it secure for both parties. In this regard, we have chosen a lightweight public cryptographic technique such as ECC and, after checking security using BAN logic and ProVerif2.03 simulation. As a result, it concludes that the scheme is verifiably secure against all known attacks. Furthermore, the performance analysis section evaluated the key features. The result shows that the proposed scenario is lightweight, efficient, effective, practical, and recommended for next-generation public cloud computing. We intend to improve our proposed authentication process for end users in the future to protect against quantum attacks. Simultaneously, its security will be tested using the AVISPA simulator.