3
pointed out Lin and Lai’s biometrics-based authentication scheme [17] is susceptible to the server spoofing attack.
In 2004, Lin and Lai [22] proposed a fingerprint-based user authentication scheme for multimedia systems.
However, Yoon and Yoo pointed out that Lin and Lai’s scheme [23] was vulnerable to the impersonatio
n attack, and
they proposed an enhanced fingerprint-based user authentication scheme for multimedia systems. In 2010, Li and
Hwang [24] proposed an efficient biometric based three-factor remote user authentication scheme, their scheme is
based on biometric verification, smart card, one-way hash function and nonce, so it was more efficient compared
with other related remote user authentication schemes. However, in 2011, Li et al. [25] and Das [26] pointed out the
security and design flaws of Li and Hwang’s scheme respectively. More recently, An has shown the security
weaknesses of Das’s scheme and proposed an improvement to overcome these weaknesses [27]. However, we find
that An’s scheme is also exist some flaws, i.e. cannot resist denial-of-service (DoS) attack caused by the hash
function problem in biometric authentication, cannot resist forgery attack, cannot quickly detect unauthorized login,
and does not provide session key agreement. In this paper, to overcome these flaws, we propose a robust biometric
based three-factor remote user authentication scheme with key agreement using elliptic curve cryptosystem (ECC)
[28] and fuzzy extractor [29] for multimedia systems. Our new authentication scheme could be applied to the
architecture of any multimedia system in order to better prevent unauthorized data exchange and ensure secure
communications.
The rest of the paper is organized as follows. In section 2, we give a brief review of An’s scheme. Section 3
describes the weaknesses of An’s scheme. Section 4 introduces some preliminary knowledge. The proposed
three-factor remote user authentication scheme for multimedia systems and the corresponding security analysis are
presented in section 5 and section 6, respectively. Finally, we draw our conclusions in section 7.
2 Reviews of An’s scheme
The notations used throughout this paper are summarized in table 1. For the detailed analysis, we review An’s
biometric-based remote user authentication scheme using smart cards. In An’s scheme, there are three participants,
i.e. the registration center (R), the server (S
i
) and the user (C
i
), where R is supposed as a trusted party, and
responsible for system initialization and user registration. R chooses the master secret key X
S
and distributes it to S
i
via a secure channel. An’s scheme contains three phases: the registration phase, the login phase, and the
authentication phase. We review An’s biometrics based authentication scheme in detail as follows.
Table1. The notations used in this paper
Trusted registration center
Biometric template of the user C
i
An elliptic curve defined on finite field F
p
with prime order n
A point on elliptic curve E
p
(a, b) with order n
A secret number chosen by C
i
A secret number chosen by S
i
Message concatenation operation
⊕