A Secure and Robust Smartcard-Based Authentication Scheme for Session Initiation Protocol Using Elliptic Curve Cryptography

The session initiation protocol (SIP) is a signaling communications protocol, which is widely used for controlling multimedia communication sessions. Recently, Yeh et al. presented an ECC-based authenticated protocol for SIP to conquer various attacks which were found in earlier schemes. In this paper, we analyze the security of Yeh et al.’s scheme and identify that Yeh et al.’s scheme is insecure. We demonstrate the vulnerability of Yeh et al.’s scheme to resist off-line password guessing attack, and their scheme also lacks the forward secrecy. We aim to propose an efficient improvement on Yeh et al.’s scheme to overcome the security weaknesses found in Yeh et al.’s scheme, while retaining the original merits. Through the rigorous informal security analysis and the formal security analysis using the widely-accepted Burrows–Abadi–Needham logic (BAN logic), we show that our scheme is secure against various known attacks including the attacks found in Yeh et al.’s scheme. Furthermore, we simulate our scheme for the formal security analysis using the widely-accepted AVISPA (automated validation of internet security protocols and applications) tool, and show that our scheme is secure against passive and active attacks including the replay and man-in-the-middle attacks. Additionally, our proposed scheme is efficient in terms of the communication and computational overheads as compared to Yeh et al.’s scheme and other related existing schemes. To demonstrate the practicality of the scheme, we evaluate the proposed scheme using the broadly-accepted NS-2 network simulator.