An efficient and secure 3‐factor user‐authentication protocol for multiserver environment

Summary In the last decade, the number of web‐based applications is increasing rapidly, which leads to high demand for user authentication protocol for multiserver environment. Many user‐authentication protocols have been proposed for different applications. Unfortunately, most of them either have some security weaknesses or suffer from unsatisfactory performance. Recently, Ali and Pal proposed a three‐factor user‐authentication protocol for multiserver environment. They claimed that their protocol can provide mutual authentication and is secure against many kinds of attacks. However, we find that Ali and Pal's protocol cannot provide user anonymity and is vulnerable to 4 kinds of attacks. To enhance security, we propose a new user‐authentication protocol for multiserver environment. Then, we provide a formal security analysis and a security discussion, which indicate our protocol is provably secure and can withstand various attacks. Besides, we present a performance analysis to show that our protocol is efficient and practical for real industrial environment. We showed that a user authentication protocol for multi‐server environment is vulnerable to 4 kinds of attacks and cannot provide user anonymity. We provide a secure and efficient user authentication protocol which is provably secure and can withstand various attacks. We also present a performance analysis which show that our protocol can perform efficiently.