Two-factor user authentication in multi-server networks

Abstract

Recently, Chang and Cheng proposed a robust mechanism for smart card based remote logins in a multi-server architecture. However, based on the security analyzes conducted by us, we find their mechanism is vulnerable against smart card lost problems, leak-of-verifier attack and session key disclosure attack. To eliminate all identified security threats in their mechanism, we further proposed an improved version of two-factor based user authentication protocol in multi-server networks.