Int. J. of Computers, Communications & Control, ISSN 1841-9836, E-ISSN 1841-9844 Vol. VI (2011), No. 2 (June), pp. 227-235 A Time-Bound Ticket-Based Mutual Authentication Scheme for Cloud Computing Z. Hao, S. Zhong, N. Yu Zhuo Hao 1. University of Science and Technology of China Department of Electronic Engineering and Information Science Hefei, Anhui 230027, P.R.China, and 2. State University of New York at Buffalo Department of Computer Science and Engineering 201 Bell Hall, Amherst, NY 14260, USA E-mail: hzhuo@mail.ustc.edu.cn Sheng Zhong State University of New York at Buffalo Department of Computer Science and Engineering 201 Bell Hall, Amherst, NY 14260, USA E-mail: szhong@buffalo.edu Nenghai Yu University of Science and Technology of China Department of Electronic Engineering and Information Science Hefei, Anhui 230027, P.R.China E-mail: ynh@ustc.edu.cn Abstract: Cloud computing is becoming popular quickly. In cloud comput- ing, people store their important data in the cloud, which makes it important to ensure the data integrity and availability. Remote data integrity check- ing enables the client to perform data integrity verification without access to the complete file. This service brings convenience to clients, but degrades the server’s performance severely. Proper schemes must be designed to reduce the performance degradation. In this paper, a time-bound ticket-based mutual authentication scheme is pro- posed for solving this problem. The proposed authentication scheme achieves mutual authentication between the server and the client. The use of time- bound tickets reduces the server’s processing overhead efficiently. The corre- spondence relationship between the digital ticket and the client’s smart card prevents user masquerade attack effectively. By security analysis, we show that the proposed scheme is resistant to masquerade attack, replay attack and pass- word guessing attack. By performance analysis, we show that the proposed scheme has good efficiency. The proposed scheme is very suitable for cloud computing. Keywords: cloud computing, mutual authentication, digital ticket, masquer- ade attack. 1 Introduction Cloud Computing [1, 2] has become a very popular technology. By using cloud computing, both the data storage and the computation resources are moved from personal computers into the cloud. Recently many companies provide the cloud storage services, including Amazon Simple Copyright c⃝ 2006-2011 by CCC Publications 228 Z. Hao, S. Zhong, N. Yu Storage Service (S3) [3], Microsoft SkyDrive [4], Nirvanix CloudNAS [5], etc. As people store their important data in the cloud without keeping a local copy, it is important for the cloud clients to be able to verify the data integrity and availability. Remote data integrity checking protocols [6–10] are proposed to ensure the data integrity in the cloud. Ateniese et al. [6] propose the technology of provable data possession to enable the client to verify the data integrity without retrieving it from the server. Juels and Kaliski [7] propose the scheme called proofs of retrievability to enable the server to produce a concise proof about the data availability. Other schemes [8–10] have also been proposed with increased scalability and efficiency. However, as the clients of cloud services are numerous and are also increasing very quickly, these technologies bring a lot of extra computation and storage overhead to the server. Mechanisms should be designed to reduce these overhead as much as possible. One possible solution is to limit the client’s data verification frequency. In this method, the server releases a certain number of digital tickets to the client at a constant frequency, e.g., 12 tickets per year. The client uses one ticket for one time of data verification, and after that, the used ticket becomes invalid and cannot be reused. If the client needs more tickets, she must purchase them from the server. On the other hand, the client’s identity should be properly authenticated to the server before she uses these services. Recently Lin and Chang [11] propose a countable and time-bound password-based user au- thentication scheme, which is a possible method for solving this problem. In the Lin-Chang scheme, the tickets {TK1, TK2, ..., TKt} are generated by the server in a way that the authenti- cation value in TKj is one of the square roots of the value in TKj+1. The Lin-Chang scheme is secure against masquerading attack and replay attack, and also achieves good efficiency at the client side. However, the Lin-Chang scheme has several disadvantages, which make it not suitable in this environment. Firstly, the ticket in Lin-Chang scheme is not associated with the client’s identity, which allows anyone who obtains the ticket to be able to use it. Secondly, the client’s tickets can only be used sequentially. Whenever TKj expires, the tickets TK1, TK2, ..., TKj−1 cannot be used anymore. Thirdly, the Lin-Chang scheme involves high-cost modular exponentia- tion operations at the server side, which bring large amount of overhead as the quantity of cloud clients increases quickly. Finally, the Lin-Chang scheme does not achieve mutual authentication. In this paper, we propose a new ticket-based mutual authentication scheme which has im- provements in these aspects. Firstly, we use smart card in the mutual authentication scheme. Each client has her own unique smart card. The client’s tickets are associated with her smart card, so that even when her tickets are lost, they cannot be used by other clients. Secondly, in the proposed scheme, tickets are relatively independent of one another, so that the tickets need not be used sequentially. When one ticket expires, all other tickets that do not expire can still be used. Thirdly, the proposed scheme involves only lightweight exclusive-or and hash compu- tations, which makes it very efficient at both the client side and the server side. Finally, the proposed scheme achieves mutual authentication, so that both the server and the client authen- ticates each other when performing the data verification. By security analysis, we show that the proposed scheme is secure against lost smart card attack, lost ticket attack, masquerade attack, replay attack, etc. By performance analysis, we show that the proposed scheme achieves good performance at both the server side and the client side. The proposed scheme is suitable for cloud computing. The rest of this paper is organized as follows. Section 2 presents the system model and introduces common notations used throughout this paper. In section 3, the proposed time- bound ticket-based mutual authentication scheme is presented. In section 4, we show that the proposed scheme is secure against adversary’s attacks. In section 5, we show that the proposed scheme is cost-efficient. Finally, we conclude in section 6. A Time-Bound Ticket-Based Mutual Authentication Scheme for Cloud Computing 229 2 System Model and Common Notations In the proposed scheme, there are two different entities: the cloud server and the client. The cloud server provides data storage services to a lot of clients, and also provides data integrity verification services to the clients. Furthermore, the cloud server is in charge of the client registration, client authentication and digital ticket management. Clients put their data at the server and retrieves the data on demand. Each client has a unique identification and a password with which she can prove her identity to the server. In addition, similar to the Lin-Chang scheme [11], a bulletin board is maintained by the server for preventing repeated usage of one ticket. For convenience of description, we denote the cloud server by S and the clients by {Ui, i = 1, 2, 3, ...}. Denote the identification and password of Ui by IDi and PWi. We use a cryptographic hash function h() and a keyed hash function hK(), with K as a cryptographic key. S has two long-term secret keys, denoted by K1 and K2. 3 The Proposed Mutual Authentication Scheme In this section, we present the proposed time-bound ticket-based mutual authentication scheme. The proposed scheme consists of 4 phases: registration phase, verification request phase, mutual authentication phase and password change phase. 3.1 Registration Phase When the client Ui initially registers herself to S, the registration phase is invoked. The registration phase consists of the following steps: 1. Ui selects her own IDi, her password PWi and a random number b. Then Ui computes IPBi = H(IDi||H(PWi ⊕b)) and sends {IDi, IPBi, t} to the server, in which t is the number of digital tickets Ui needs. At the same time Ui pays the corresponding ticket fee to S. The ticket fee can be payed in the form of either real or virtual currency, which depends on the policy of S. 2. After S receives the message and ticket fee from Ui, S generates t tickets for Ui. Denote the jth ticket of Ui by T (j) i . Denote by TID (j) i and V P (j) i the ticket ID and valid period of T (j) i respectively. Specifically, S generates {(TID(j)i , V P (j) i ), j = 1, 2, ..., t} and computes as follows: Wi = IPBi ⊕ H(IDi, K1), α (j) i = HK2(IDi ∥ TID (j) i ∥ V P (j) i ), β (j) i = α (j) i ⊕ IPBi. T (j) i has two parts: T (j) i = (T (j)1 i , T (j)2 i ), in which T (j)1 i = (TID (j) i , V P (j) i ), T (j)2 i = β (j) i . S also computes Zi = HK2(IDi) ⊕ IPBi, which is used during the password change phase. 3. S writes IDi, t, Wi, Zi and T (j) i , j = 1, 2, ..., t into a smart card and sends it to Ui. 4. When Ui receives her smart card, she writes b into the card. 230 Z. Hao, S. Zhong, N. Yu 3.2 Verification Request Phase As the client receives t tickets, she can use these tickets to perform data verification at most t times. The description below assumes that this is the kth verification request that Ui invokes. 1. Ui inserts her smart card into a card reader and enters IDi and PWi. 2. The smart card generates a nonce rU according to system time, and computes IPBi = H(IDi||H(PWi ⊕ b)), Hi = Wi ⊕ IPBi ; C1 = rU ⊕ Hi, C2 = H(rU) ⊕ T (k)2 i ⊕ IPBi. Then Ui’s smart card sends {IDi, T (k)1 i , C1, C2} to S. 3.3 Mutual Authentication Phase When S receives the verification request message from Ui, it executes the following steps: 1. S checks the validity of IDi and rejects the service request if IDi is invalid. 2. S checks whether the ticket ID TID(k)i is on the bulletin board. If it is on the bulletin board, then S rejects Ui’s service request and terminates the process. 3. S checks whether the current date is in the range of V P (k)i or not. If not, then S rejects Ui’s service request and terminates the process. 4. S computes D0 = H(IDi, K1), D1 = C1 ⊕ D0 and D2 = H(D1) ⊕ C2. 5. S computes HK2(IDi ∥ TID (k) i ∥ V P (k) i ) and checks whether it is equal to D2. If they are not equal, then S rejects Ui’s service request and terminates the process. Otherwise, S authenticates Ui successfully. 6. S generates a random nonce rS, computes C3 = D0 ⊕ rS and C4 = H(rU, rS) and sends {C3, C4} to Ui. S also computes KS = H(D0, rU||rS), which will be used as a subsequent session key. 7. Ui’s smart card computes D3 = C3 ⊕ Hi. Then it compares H(rU, D3) with C4. If they are equal, Ui authenticates S successfully. Then the smart card computes KC = H(Hi, rU||rS) and uses K to communicate with S in the subsequent data verification process. Note that KC = H(Hi, rU||rS) = H(H(IDi, K1), rU||rS) = KS. When the kth data verification is finished, Ui deletes the ticket T (k) i from its smart card, and S publishes TID (k) i to its bulletin board. Finally the smart card deletes the nonce rU , and S deletes rS from its memory, to prevent replay attack. 8. After the mutual authentication, the data verification is performed. The data verification schemes [6–10] are independent of the proposed authentication scheme, so we don’t describe the details. The keys KC and KS can be used for secret communication. 3.4 Password Change Phase This phase is invoked when Ui needs to change her password PWi to a new one. The password change phase consists of the following steps: 1. Ui inserts her smart card into a card reader, and enters IDi and PWi. 2. The smart card generates a nonce rU according to system time, and computes IPBi = H(IDi||H(PWi ⊕ b)), C1 = rU ⊕ Wi ⊕ IPBi, C2 = H(rU) ⊕ Zi ⊕ IPBi. Then Ui’s smart card sends {update, IDi, C1, C2} to S, in which update is the message type indicating this is a password change request message. A Time-Bound Ticket-Based Mutual Authentication Scheme for Cloud Computing 231 3. When S receives this message, it checks the validity of IDi. If IDi is invalid, it rejects the service request. 4. S computes D1 = C1⊕H(IDi, K1) and D2 = H(D1)⊕C2. After that S checks whether D2 is equal to HK2(IDi). If they are not equal, S rejects the password change request. Otherwise, S authenticates Ui successfully and accepts the password change request. 5. S generates a random nonce rS, computes C3 = H(IDi, K1)⊕rS and C4 = H(rU, rS) and sends {C3, C4} to Ui. 6. The smart card computes D3 = C3 ⊕ Wi ⊕ IPBi. Then it compares H(rU, D3) with C4. If they are equal, the smart card successfully authenticates S and prompts Ui to enter a new password. 7. Ui enters a new password PW newi . Then the smart card computes IPB new i = H(IDi||H(PW new i ⊕ b)). After that the smart card computes W newi = Wi⊕IPBi⊕IPB new i , which yields H(IDi, K1)⊕ IPBnewi , and computes Z new i = Zi ⊕ IPBi ⊕ IPB new i , which yields HK2(IDi) ⊕ IPB new i . The smart card also updates T (j)2i to T (j)2 i ⊕ IPBi ⊕ IPB new i for all remaining tickets, which yields α (j) i ⊕ IPB new i . 4 Security Analysis of the Proposed Scheme In this section, we present security analysis of the proposed scheme. In section 4.1, we show that the server’s secret key cannot be obtained by an adversary who monitors the communication. In sections 4.2-4.5, we show that the proposed scheme is resistant to lost smart card attack, masquerade attack, replay attack and valid period extending attack. 4.1 Secrecy of the server’s secret key In the proposed scheme, communications between Ui and S are through a common channel. So we assume the adversary can eavesdrop this channel and get any messages transmitted between Ui and S. During the kth verification request and mutual authentication phase, the adversary can get messages {IDi, T (k)1 i , C1, C2, C3, C4}, in which IDi and T (k)1 i have no relationship with K1 or K2, and C1, C2, C3, C4 are as follows: C1 = rU ⊕ Wi ⊕ IPBi = rU ⊕ H(IDi, K1) C2 = H(rU) ⊕ T (k)2 i ⊕ IPBi = H(rU) ⊕ HK2(IDi ∥ TID (k) i ∥ V P (k) i ) C3 = H(IDi, K1) ⊕ rS C4 = H(rU, rS) As rU and rS are both random nonces generated by Ui and S, the adversary cannot guess their values. In addition, due to the one-wayness of hash function, the adversary cannot get rU or rS from H(rU, rS). So the adversary cannot get the value of H(IDi, K1) or HK2(IDi ∥ TID (k) i ∥ V P (k) i ). As a result, the adversary cannot get any information on S’s secret keys by eavesdropping channels. 4.2 Resistance to Attacks Based on Lost Smart Card A user’s smart card may get lost due to an accident or the user’s carelessness. In this section, we show that when an adversary gets a lost smart card, he cannot carry out attacks to the proposed scheme. We first show that the proposed scheme is resistant to offline password guessing attack. After that, we show that the lost tickets cannot be used by the adversary. 232 Z. Hao, S. Zhong, N. Yu Resistance to Offline Password Guessing Attack When an adversary gets the lost smart card of Ui, he can extract the stored data from it by monitoring the power consumption [12] or analyzing the leaked information [13]. The values stored in Ui’s smart card are IDi, t, Wi, Zi, b, T (j) i , j = 1, 2, ..., t. The adversary can pick up a password candidate PW ′. Then he can computes IPB′i = H(IDi||H(PW ′i ⊕ b)). From Wi = IPBi ⊕ H(IDi, K1), Zi = HK2(IDi) ⊕ IPBi and β (j) i = α (j) i ⊕ IPBi = HK2(IDi ∥ TID (j) i ∥ V P (j) i ) ⊕ IPBi he can further compute H ′(IDi, K1) = Wi ⊕ IPB′i, H ′ K2 (IDi) = Zi ⊕ IPB′i and H ′ K2 (IDi ∥ TID (j) i ∥ V P (j) i ) = β (j) i ⊕ IPB ′ i. However, as K1 and K2 are S’s secret keys, the adversary cannot get them. So the adversary cannot test whether PW ′ is equal to PWi from these values. From the above analysis, we can see that the proposed scheme is resistant to offline password guessing attack. Resistance to Attacks Based on Lost Tickets When an adversary gets the lost smart card of Ui, he can extract the stored tickets T (j) i , j = 1, 2, ..., t from it. However, as the adversary cannot get PWi from offline guessing attack (refer to 4.2), he cannot compute IPBi = H(IDi||H(PWi ⊕ b)). As a result, the adversary cannot make a valid verification request message {C1, C2}, because both the computations of C1 and C2 require the knowledge of IPBi. From the above analysis, we can see that the proposed scheme is secure when an adversary gets a lost ticket. 4.3 Resistance to Masquerade Attack Suppose the adversary gets a set of history messages during the past channel eavesdropping. In order to masquerade as Ui, the adversary has to forge a valid message {ID∗i , T (k)∗1 i , C ∗ 1, C ∗ 2} which can pass S’s authentication process. It’s easy to see that the computation of C∗1 = rU ⊕ H(IDi, K1) requires the adversary to get knowledge of H(IDi, K1). From 4.1 we know that the adversary cannot get H(IDi, K1), so he cannot forge a valid verification request message either. On the other hand, if the adversary wants to masquerade as the server, he must be able to compute a valid message {C3, C4}, in which C3 = H(IDi, K1)⊕rS and C4 = H(rU, rS). Because the computation of C3 requires the knowledge of H(IDi, K1), which the adversary does not have, the adversary cannot masquerade as the server. From the above analysis, we can see that the proposed scheme is resistant to masquerade attack. 4.4 Resistance to Replay Attack In the proposed scheme, the unique ticket ID and the nonces are used for preventing replay attack. Assume that the adversary gets a valid message {IDi, T (k)1 i , C1, C2} by eavesdropping com- munications between Ui and S. Then he tries to resend the message to S after a period of time when the mutual authentication process finishes, with the expectation of obtaining data verifi- cation service. However, when S receives this message, it will find that the ticket ID TID(k)i is A Time-Bound Ticket-Based Mutual Authentication Scheme for Cloud Computing 233 already on the bulletin board. So S will reject the adversary’s service request and terminate the process. On the other hand, if the adversary gets a message from S to Ui: {C3 = H(IDi, K1)⊕rS, C4 = H(rU, rS)}. The adversary may try to resend it to Ui after a period of time when the mutual authentication process is finished. However, when Ui’s smart card receives {C3, C4}, the nonce rU has already been deleted from its storage. So this message will be discarded immediately. From the above analysis, we can see that the proposed scheme is resistant to replay attack. 4.5 Resistance to Valid Period Extending Attack Whenever Ui wants to use a ticket whose valid period does not include the current date, the protocol can ensure that the ticket cannot be used even if Ui tries to modify the ticket’s begin date or expiration date. Assume Ui wants to use ticket T (k) i by changing the ticket’s V P (k) i to ˆV P (k) i , so that the current date is included in ˆV P (k) i . Denote the modified ticket by T̂ (k) i . When Ui sends the message {IDi, T̂ (k)1 i , C1, C2} to S, S computes D1 = C1 ⊕ H(IDi, K1) and D2 = H(D1) ⊕ C2. Then S computes HK2(IDi ∥ TID (k) i ∥ ˆV P (k) i ) and compares it with D2. Since D2 = H(D1) ⊕ C2 = H(C1 ⊕H(IDi, K1))⊕C2 = α (k) i = HK2(IDi ∥ TID (k) i ∥ V P (k) i ) ̸= HK2(IDi ∥ TID (k) i ∥ ˆV P (k) i ), S will reject Ui’s verification request and terminate the process immediately. From the above analysis, we can see that the server can limit the data verification frequency by specifying a valid period for each ticket. For example, the typical coverage of the valid period can be one week, one month, one year, etc. The proposed scheme can prevent the client from using a ticket whose valid period does not include the current date. 5 Performance Analysis In this section we present performance analysis of the proposed scheme. The main operations include the hash computation and the exclusive-or operations, which are summarized in Table 1. We use the hash-based message authentication code (HMAC) [14] as the keyed hash, which incurs 2 exclusive-or and 2 common hash operations. Table 1: Performance Analysis of the Proposed Scheme operation verification request phase mutual authentication phase client xor 5 1 hash 3 2 keyed hash 0 0 server xor 0 3 hash 0 4 keyed hash 0 1 Compared with [11], which uses expensive operations like modular exponentiations, our scheme is much more efficient. According to the Crypto++ benchmarks1 [15], the SHA-256 hash algorithm [16] can achieve a throughput of 111MiB/Sec under Intel Core2 1.83GHz pro- cessor. In the proposed scheme, the length of a message to be hashed does not exceed 1KB, so the average time for one hash computation is about 0.009ms. If the Lin-Chang scheme uses 1The Crypto++ 5.6.0 benchmark is evaluated in Intel Core2 1.83 GHz processor under Windows Vista in 32-bit mode 234 Z. Hao, S. Zhong, N. Yu the primes of length 1024bits, then one time of modular exponentiation will cost about 1.46ms under the same platform [15]. Our scheme is at least 40 times more efficient than the Lin- Chang scheme [11] in case of the server’s computation time. This is a tremendous performance improvement to the cloud servers. Performance Benefit by Limiting Verification Frequency The cloud server can also benefit its performance by limiting the client’s data verification frequency. This is achieved by controlling the valid period of the digital ticket. From the performance evaluation of [6] we know that for a 30MB file, the computation time of the data integrity verification is approximately 1 second2 at the server side. Assume the cloud storage system has 100,000 clients, and each client performs data integrity verification once a week. Then the average computation time of the cloud server during one day is approxiately: 100, 000 7 · 1s ≈ 3.97 hours. By using the proposed scheme, the server can limit the data verification frequency to once per month, or even once per quarter, so that the average computation time of the cloud server is reduced to 56 minutes per day and 18.5 minutes per day respectively. 6 Conclusions In this paper, we propose a time-bound ticket-based mutual authentication scheme. In the proposed scheme, the digital tickets are associated with the client’s smart card, which effectively prevents the ticket from being used by other clients. By designing a mutual authentication based on the client’s smart card, both the server and the client are assured of each other’s identity. The proposed authentication scheme can efficiently decrease the server’s processing overhead by limiting the data verification frequency. By security analysis and performance analysis, the proposed scheme is shown to be both secure and efficient. It is very suitable for providing mutual authentication in cloud computing. Acknowledgment This work was supported by NSF CNS-0845149, NSF CCF-0915374 and Knowledge Innova- tion Program of Chinese Academy of Sciences (No. YYYJ-1013). Bibliography [1] B. Hayes, “Cloud computing,” Commun. ACM, vol. 51, no. 7, pp. 9–11, 2008. [2] C. Cachin, I. Keidar, and A. Shraer, “Trusting the cloud,” SIGACT News, vol. 40, no. 2, pp. 81–86, 2009. [3] Amazon.com, “Amazon Web Services (AWS),” http://aws.amazon.com/s3/, 2009. [4] Microsoft.com, “Microsoft Windows SkyDrive,” http://windowslive.com/online/skydrive, 2009. 2The experiment environment in [6] is Intel 2.8 GHz Pentium IV system with a 512 KB cache, an 800 MHz EPCI bus, and 1024 MB of RAM. A Time-Bound Ticket-Based Mutual Authentication Scheme for Cloud Computing 235 [5] Nirvanix.com, “Nirvanix cloudNAS,” http://www.nirvanix.com/products-services/, 2009. [6] G. Ateniese, R. Burns, R. Curtmola, J. Herring, L. Kissner, Z. Peterson, and D. Song, “Provable data possession at untrusted stores,” in CCS ’07: Proceedings of the 14th ACM conference on Computer and communications security, (New York, NY, USA), pp. 598–609, ACM, 2007. [7] A. Juels and B. S. Kaliski, Jr., “Pors: proofs of retrievability for large files,” in CCS ’07: Proceedings of the 14th ACM conference on Computer and communications security, (New York, NY, USA), pp. 584–597, ACM, 2007. [8] E.-C. Chang and J. Xu, “Remote integrity check with dishonest storage server,” in 13th ESORICS, pp. 223–237, Springer Berlin / Heidelberg, 2008. [9] A. Heitzmann, B. Palazzi, C. Papamanthou, and R. Tamassia, “Efficient integrity checking of untrusted network storage,” in StorageSS ’08, pp. 43–54, ACM, 2008. [10] K. D. Bowers, A. Juels, and A. Oprea, “HAIL: a high-availability and integrity layer for cloud storage,” in CCS ’09, (New York, NY, USA), pp. 187–198, ACM, 2009. [11] I.-C. Lin and C.-C. Chang, “A countable and time-bound password-based user authentica- tion scheme for the applications of electronic commerce,” Information Sciences, vol. 179, no. 9, pp. 1269 – 1277, 2009. [12] P. C. Kocher, J. Jaffe, and B. Jun, “Differential power analysis,” in CRYPTO ’99: Proceed- ings of the 19th Annual International Cryptology Conference on Advances in Cryptology, (London, UK), pp. 388–397, Springer-Verlag, 1999. [13] T. Messerges, E. Dabbish, and R. Sloan, “Examining smart-card security under the threat of power analysis attacks,” IEEE Transactions on Computers, vol. 51, no. 5, pp. 541–552, 2002. [14] H. Krawczyk, M. Bellare, and R. Canetti, “HMAC: Keyed-Hashing for Message Authenti- cation,” RFC2104, February 1997. [15] “Crypto++ 5.6.0 benchmarks,” http://www.cryptopp.com/benchmarks.html. [16] “Secure hash standard,” Federal Information Processing Standards Publication 180-2, August 2002.