In addition, we also show that Tsai–Lo’s scheme does not provide the session-key security (SK-security)and strong user credentials’ privacy when ephemeral secret is unexpectedly revealed to the adversary.
In order to withstand these security pitfalls found in Tsai–Lo’s scheme, we propose a provably secure
authentication scheme for distributed mobile cloud computing services. Through the rigorous security
analysis, we show that our scheme achieves SK-security and strong credentials’ privacy and prevents
all well-known attacks including the impersonation attack and ephemeral secrets leakage attack.
Furthermore, we simulate our scheme for the formal security analysis using the widely-accepted AVISPA
(Automated Validation of Internet Security Protocols and Applications) tool, and show that our scheme
is secure against passive and active attacks including the replay and man-in-the-middle attacks. More
security functionalities along with reduced computational costs for the mobile users make our scheme
more appropriate for the practical applications as compared to Tsai–Lo’s scheme and other related
schemes. Finally, to demonstrate the practicality of the scheme, we evaluate the proposed scheme using
the broadly-accepted NS-2 network simulator.