A Secure Biometrics and PUFs-Based Authentication Scheme With Key Agreement For Multi-Server Environments

The emergence of multi-server authentication key protocol schemes provides a viable environment for users to easily access the services of multiple legitimate servers through a single registration. Biometric identification technology has the characteristics of forgery difficulty, duplication difficulty and guess difficulty, etc. Therefore, it is an indispensable authentication technology in smart card-based user authentication protocol. There are many shortcomings in the existing schemes based on biometrics, including leakages of biometrics information, smart card theft attack, lack of user anonymity, user impersonation attack, server impersonation, and so on. To overcome these shortcomings, we propose a new user authentication and key agreement scheme in the multi-server environment. To some extent, we not only are able to guarantee the communication security between the user and the servers, but also ensure the physical security of the smart card and biometrics information. In this respect, we use lightweight cryptographic primitives, such as Physically Unclonable Functions (PUFs), Fuzzy extractor and One-way hash functions, and so on. The proposed scheme can effectively protect user’s anonymity without the use of password and provide mutual authentication and key agreement in the multi-server environment. Subsequently, we used informal analysis, Burrows-Abadi-Needham Logic (BAN-Logic) proof, and a widely accepted Real-Or-Random model to prove the security and robustness of proposed scheme. Finally, our authentication protocol can protect the security of communication.


I. INTRODUCTION
With the continuous development of Internet and communication technologies and the growing demand for shared data resources, people need to access several different servers anytime, anywhere to meet their needs. In lots of areas, such as ecommerce, telemedicine information systems, and distributed cloud storage systems, secure and efficient communication between participants are becoming increasingly important. Clearly, privacy protection has become an important issue for secure and trusted communications. In this context, remote authentication is required to establish secure communication The associate editor coordinating the review of this manuscript and approving it for publication was Cristina Rottondi . between the user (client) and the remote server. For example, only authorized private users can access resources stored in the cloud server [1], [2], [5], [6]. In order to deal with security, confidentiality and access rights, many documents have user authentication schemes for single-server environments [3], [4], [6].
In recent years, distributed environments have emerged and are rapidly evolving. In this environment, various servers cooperate to provide services and resources for user services. In this case, single-server authentication scheme is more difficult, above all, for these users who need to register with each server separately. Besides, in order to overcome the multiregistration problem of numerous different servers, a multiserver user authentication scheme [1], [2], [5] is proposed.
In a single registration mode, the multi-server authentication scheme allows users to access services from multiple servers over the Internet. Typically, a multi-server authentication scheme consists of a user, a group of servers, and a trusted registration center (RC), which is responsible for registering users and servers. The registration center RC maybe participate in the user's login and authentication stage. Once the j-th user U i is registered in the RC, U i can access any server that has registered in the RC. Actually, in reality, multiserver environment often occurs in various situations. For example, in a hospital, every doctor almost needs to access different servers to complete job. There exist dozens of different general-purpose servers, such as accounting server, drug server, patient data server, and Web services server. Therefore, in recent two decades, the multi-server authentication scheme has been increasing becoming a research hotspot [1], [2], [5]- [7].

A. RELATED WORK
In 1981, Lamport [8] first proposed an insecure passwordbased authentication scheme. In the Lamport's scenario, the server needs to maintain a password table; therefore, an important piece of information can be cracked by a hacker. Later, many researchers published many improved passwordbased authentication schemes based on this problem [9]- [13]. Nonetheless, one obvious insufficient of these single-server authentication schemes is the registration issue. If a new user wants to use a large number of network services, they must register on those servers. It is very cumbersome for a user to register with the server, which not only wastes user time but also wastes server resources. Many researchers have proposed various multi-server authentication schemes based on the shortcomings of the single-server authentication scheme [1], [2], [5]- [7].
In 2001, Li et al. [14] first proposed a multi-server authentication scheme based on neural network. In Li's scenario, the server does not need to store any authentication tables, and any legitimate remote user can get services from multiple servers without having to register with each server separately. However, there is a deficiency in the scheme of Li, because it takes a long time to train the neural network based on the neural network, then it will require extremely high communication and computational costs. In 2003, Lin et al. [15] proposed an improved scheme based on the discrete logarithm problem. In 2006, Cao et al. [16] pointed out that Lin et al.'s program could not resist counterfeiting attacks.
In 2008, Tsai et al. [17] considered that the registration center and all servers are trusted. Tsai et al. proposed a smart card-based multi-server identity authentication scheme. In Tsai's scenario, the authentication scheme is based on a one-way hash function and does not require any validation tables to be stored in the registry and server. In 2012, Tsaur et al. [18] found that most of these previously proposed schemes used timestamps to defend against replay attacks, while replay attacks required the cost of clock synchronization. To overcome this problem, they proposed a self-validating timestamp method to avoid the difficulty of clock synchronization in a multi-server environment.
In 2013, Yoon et al. [19] proposed the first biometricbased multi-server environment authentication scheme. Their scheme uses elliptic curve cryptography (ECC) to ensure security. However, He et al. [20] pointed out that Yoon's scheme is weaker against impersonation attacks and privileged internal attacks, because once an adversary gets a password and a smart card, it can easily impersonate a valid user. He et al. designed a new robust solution to this weakness, a three-factor authentication solution in a multi-server environment. However, user anonymity in the He program is relatively weak and cannot withstand instant messaging attacks. In 2014, Chuang et al. [21] proposed a biometricbased authentication scheme based on smart cards and biometrics to provide user anonymity.
In 2016, Chatterjee et al. [22] used Chebyshev chaotic map to design a new biometric-based authentication protocol. Comparing Chatterjee's solution with the existing one, Chatterjee's solution has the advantages of small key, fast calculation and high efficiency. In addition, Barman et al. [23] proposed a multi-server environment authentication scheme based on biometrics. Their approach uses fuzzy extraction methods to provide an appropriate match of biometric patterns.
Password-based multi-server authentication schemes use passwords and cryptographic keys in remote user authentication. However, there are some problems with passwordbased methods, such as long, random passwords that cannot be used in this scenario because it is difficult for users to remember such long, random passwords; otherwise, passwords need to be stored somewhere. In addition, passwords may be forgotten, lost, or shared with others, and it is not possible to identify who the actual user is. In conclusion, a multi-server authentication scheme without passwords has been put forward by us.
Today, most existing biometric-based authentication schemes perform mutual authentication, whereas session key protocols do not consider the security of diverse biological templates in a multi-server environment. In addition, the above existing work does not consider the physical security of the smart card, which is very important for the protection of the smart card. Some existing literatures have discussed that physical unclonable functions (PUF functions) have been successful in some other areas [24], [25], such as some basic settings for safety meters, street lamps, medical systems, and so on. In 2012, Esbach et al. [26] proposed to install the PUF function security architecture on the smart card, which proved the feasibility of the smart card in our scheme.
In this paper, our goal is to design a new multi-server authentication protocol, using fuzzy commitment methods for biometric verification, and using PUF functions to ensure the uniqueness of smart cards. In proposed scheme, once the user U i is registered in the RC, U i can access any server that has registered with the RC, and the RC doesn't have to VOLUME 8, 2020 participate in the user's login and authentication phase. The Figure 1 shows the proposed system model in multi-server environment.

B. OUR CONTRIBUTIONS
A new biometrics and PUFs-based is designed for remote user authentication and session key protocol in multi-server environment. We summarize the main contributions of our scheme as follows: • The biometrics and PUFs are used to ensure the uniqueness of the user and smart card respectively, which can ensure the physical security of proposed scheme.
• The biometrics key and auxiliary data are generated from user's biometrics template by using Fuzzy Extractor and stored in smart-card. Biometrics information are not stored in anywhere in the system, and avoid the risk of biometrics information loss. Discarded traditional password, in this case, it provides convenience for the user to use.
• Each server S j and user U i need to register with the trusted registration center RC. Users only need to register once in the RC to access all the servers registered in the RC. The RC doesn't have to participate in the user's login and authentication phase. The remainder of this paper is organized as follows. Section II we first provide a brief introduction to oneway hash function, PUF and fuzzy extractor. In Section III, we present our scheme for multi-server authentication. Security of the proposed scheme is analyzed in Section IV. Finally, conclude our article with concluding remarks in Section V.

A. FUZZY EXTRACTOR
A hash function h : A → B is a deterministic mapping from a variable-length set A = {0, 1} * of documents (strings) to another set of fixed-length strings B = {0, 1} l , called l-bits (called hash outputs or message digests). A one-way cryptographic hash function is a special hash function with the following properties: 1) For any input x ∈ A, it can be calculated in polynomial time or less time complexity and the output length is fixed. Furthermore, the hash function h(.) is deterministic in nature, and the same input message outputs the same hash value under the action of the hash function. 2) Any change to the input x ∈ A will cause the hash to be completely uncorrelated with h(x), which seems to be random. 3) Preimage resistance: It is computationally difficult to implement information x from a hash value h(x). 4) Weakly collision resistance: For any input x ∈ A, it is difficult to find an x such that h (x) = h x . 5) Strong collision resistance: In a one-way hash function, collisions are defined as h (x) = h x for any x, x ∈ A and x = x . Strong collision resistance is difficult to find two x, x ∈ A such that x =x with h (x) = h x .
Definition: if Adv HASH A (t) denotes the advantage of an adversary A in finding a hash collision in polynomial time t, then Adv HASH where, Pr[X ] denotes the probability of a random event X , and (ins 1 , ins 2 ) ∈ R . A indicates that the input strings ins 1 and ins 2 and ins 1 . An (ψ, t)-anversary A attacking the collision resistance of h(.) means that the runtime of A is at most t, while it is like to satisfy the formula (2). (2)

B. PHYSICAL UNCLONABLE FUNCTION (PUF)
The PUF is characterized by a challenge-response pair (CRP). It is an integrated circuit (IC) that takes a string of bits as an input challenge and generates a series of bits called a response. The response R of the PUF to the challenge C can be expressed as: R = PUF(C). PUF utilizes the uniqueness of the physical physics of the IC created during the manufacturing process to ensure that no two PUFs are identical.
Since the PUF output depends on the physical characteristics of the IC, any attempt to tamper with the PUF will change its behavior and invalidate the PUF. Due to this unique feature, PUF has gained popularity as an important example of the physical security of resource-constrained devices. However, noise in the PUF output due to environmental conditions (eg., temperature) is still a limiting factor in PUF design and probably result in one or more output bits of the PUF being incorrect for approximate any input challenge. To solve this problem, the concept of a fuzzy extractor was introduced. A (d, n, l, ε, )-PUF needs to meet the following requirements to be called security: 1) For any two physical unclonable function PUF 1 (·) and PUF 2 (·), and C 1 ∈ {0, 1} K should satisfy the following formula: Here, the term HD represents the Hamming distance. 2) For any physical unclonable function and any input PUF i (·) and for any input C 1 , . . . , C n ∈ {0, 1} K , 3) For any two physical unclonable functions PUF i (.) and PUF j (.), and for any input C 1 , . . . , C n ∈ {0, 1} K , then This condition indicates that different PUFs are evaluated using multiple inputs. While the internal distance i.e., the distance between two PUF responses from the same PUF instance and using the same challenge is smaller than d, the minimum entropy of the PUF is likely to be greater than λ [27]. The mutual distance i.e., the distance between two PUF responses with different PUF instances based on the same input challenge, is greater than d.

C. ENCRYPTED ONE-WAY HASH FUNCTION
As known to all, fuzzy extractor A (d, λ, ) is consisted of two parts, one is FE,Gen [28], [24], it is a probabilistic key generation approach. Specially, a bit character R as an input, a key K and auxiliary data hd as two outputs, i.e., (K , hd) = Fe.Gen(R. Furthermore, the other is FE.Rec method, in fact, it is a deterministic reconstruction strategy, the key K from the noisy input variable R and the auxiliary data hd, are effectively recovered, K = FE.Rec(R , hd).What is more, sometimes, while the Hamming distance between R and R is at most d. A fuzzy extractor (FE) ensures security in the extraction of a strong cryptographic key if the min-entropy of input R is at least, λ and K is statistically -close to an uniformly distributed random variable in {0, 1} K . In practice, fuzzy extractor A(d, λ, ) is said to be secure if the following condition holds: where, the term HD is the Hamming distance.
2) If the min-entropy

III. PROPOSED SCHEME
In this section, we will present our proposed remote multiserver authentication and key agreement scheme using biometrics and PUFs. In particular, the scheme mainly includes: server registration, user registration, login, mutual authentication and key agreement.
• In the registration phase, ∀S j needs to be registered in RC; then, ∀U i registers in RC. • During the login phase, any registered user u only needs to enter the identity ID u and the biometric information BIO u , so that the protocol is initiated to authenticate the smart card SC i .
• In the authentication and key exchange phase, mutual authentication is performed between the authorized registered user U i and the registration server S j , and a session key SK ij is established between U i and S j . Especially, the symbols used in the protocol are given in Table 1.

A. SERVER REGISTRATION PHASE
In the proposed solution, ∀S j , 1 ≤ j ≤ m, (m is the total number of servers available in the original network), needs to be registered in the trusted registry RC. Therefore, if S j is willing to become an authorization server and provide services to registered users, it generally sends a registration request, including a unique identity SID j . The RC sends two secret keys K 1 and K 2 to each S j via the Internet Key Exchange Protocol (IKEv2) [23]. Note that K 2 is unique to each server S j and it is used in the mutual authentication process of user U i and server S j . In figure 2, the process of server registration is concretely depicted. Additionally, the specific steps are listed as follows: 1) During initialization process, a master secret key K , a random secret b are selected by RC. 2) S j submits its identity SID j towards RC.
3) The validity of SID j is checked. If invalid, the server SID j returns existing information, and then submits a new SID j . Subsequently, the two keys are RC computed as K 1 = h(K|| b) and K 2 = h(SID j ||h(b)). Moreover, both keys (K 1 and K 2 ) are sent to S j employing a confidential channel. In this manner, S j is successfully registered through RC. VOLUME 8, 2020

B. USER REGISTRATION PHASE
At the beginning, ∀U i needs to register in the RC through a secure channel. At this stage, U i needs to select a user identity ID u and a random number C u . Besides, U i also provides his/her biometric data to the biosensor, which captures the biometric data BIO u . In fact, U i provides unique biological keys by using fuzzy-extracted FE.Gen algorithm, at some time, equally unique R u is gained by using physical noncloning function (PUF). After the RC accepted the user registration information, the private key of the RC will be stored in the smart card in an encrypted manner, and then the smart card is sent to the user. More specially, figure 3 summarizes the user registration process, the specific steps are shown as follows: 1) U i gives biometric key K u and auxiliary information hd using FE.Gen algorithm according to its biometric data BIO u , that is, (K u ,hd) = Fe.Gen(BIO u ). Next, the U i achieves R u under the action of PUF. Then U i sends the registration information{ID u , <C u ,R u >,K u } to the RC. 2) After receiving the registration information sent by the i-th user U i , the RC checks the validity of the user ID u , if the u-th user's ID u is invalid, RC returns that the user information ID u has been registered and the new ID u is selected for registration. Subsequently, the below operations are conduced: . Clearly, the RC stores{ID u , <C u ,R u >} and a smart card SC i , i.e., the information{V i ,Z i ,Y i } saved into the card. Finally, RC sends SC i to user.
3) After receiving the information sent by the RC, U i computes UC u = C u ⊕ K u and A u = h(ID u ||R u ||K u ). Finally, U i put information {UC u , hd, A u } into the SC i , and embed the integrated circuit of PUF into the SC i .

C. USER LOGIN PHASE
At this stage, the registered user U i inserts the smart card SC i into the card reader of the specific terminal and provides its identity ID u . additionally, U i also scans the biometrics at the biosensor for authentication. Specific steps are shown as follows: 1) U i scans his/her biometrics, and extracts feature BIO u from the captured fingerprint image. 2) U i inserts the smart card SC i into the carder reader and enters the credential ID u . 3) U i generates K u as K u = FE.Rec(BIO u ,hd), and extracts Cu , R u according to the forms C u = UC u ⊕ K u and R u = PUF(C u ). Besides, SC i then compares the computed h(ID u ||R u ||K u ) with the stored A u . If they are not equal, the session is terminated 4) After the completion of check the U i , U i obtain K , SI according to the forms PK = V i ⊕h(ID u ||K u ||C u ) and SI = h(SID j ||PK). U i selects a random nonce N 1 and uses N 1 to encrypt to get encrypted information and sends login message{M 1 , SID u , SC u , A ij ,SPK, A 1 } to server S j .

D. MUTUAL AUTHENTICATION PHASE
After the successfu1 login of a registered user U i , the authentication of a server S j is verified. After successful mutual authentication, the session key is established between U i and S j . The login and mutual authentication phases are briefly described in figure 4. The detailed steps are given below. 45296 VOLUME 8, 2020

1) S j receives the login message and decrypt messages
S j reads the record{ID u , <C u ,R u >} from the database and checks h(ID u ||C u ||R u )= ?h(ID * u ||C * u ||R * u ), if they are not equal, the session is terminated. 2) In order to complete user verification, S j have to obtain X * i as X * i = h(ID * u ||K 1 ||K * u ). Then S j computes h(X * i ||ID * u ||K * u ||N * 1 ||h(SID j ||PK * )), and compares it with the login message A 1 . If they are not equal, the session is terminated.
3) Then, S j generates a nonce N 2 . Next, S j achieve M 2 as M 2 = N 2 ⊕h(SID j ||PK * ||K * u ) and generates a session key SK ij = h(X * i || SID j ||K * u ||N * 1 ||N 2 ||PK * ). Finally, S j generates an authentication message the session is terminated. Otherwise, the session key SK ij is established for secure message communication between U i and S j .

IV. SECURITY ANALYSIS A. FORMAL SECURITY USING THE ROR MODEL
We use the Real-Or-Random (ROR) model proposed by Abdalla et al. [29] to demonstrate the safety of the protocol. In the case of passive/active attacks, the ROR model can still provide session key SK security. Recently, formal security analysis based on the ROR model has been popularized, and the analysis method is applied to various authentication key exchange protocols [22], [30], [31].

1) ROR MODEL
In our proposed solution, there are three participants, one user U i , one server S j and one registry RC. Participants: π u U i , π t S j and π v RC are denoted as the instance u, t and v of U i , S j and RC, respectively.
Partnering: The instance π u U i of U i has instance π t S j of S j as its partner and conversely. π t S j is called the partner ID pid u U i of π u U i . The partial transcript of the messages exchanged between U i & S j is unique, and is known as session ID sid u U i for the ongoing session in which π u U i takes part. Freshness: If the session key SK ij established between U i and S j is not leaked via the reveal oracle Reveal defined below, we call π u U i or π t S j fresh. Adversary: Under the ROR model, attacker A uses the widely accepted Dolev-Yao (DY) threat model to intercept, modify, delete, and even inject some or all of the exchange information between U i and S j . Some operations of A are given as follows: • Execute(π t , π u ): This query is executed by A to obtain exchanged message between U i and S j . This query implement an active attack.
• Reveal(π t ): Using this query, A can know the session key SK ij which is generated by π t and its partner in the current session.
• Send(π t , m): This query implements an active attack wherein A can send a message m to a participate instance π t , and in reply, it receives a response from π t .
• CorruptSmartCard(π u U i ):This query is about SC i modeling loss/stolen attack. A can extract all the sensitive secret information stored in its memory via power analysis attack.
• Test(π t ): Based on the indistinguishability of the model, the semantic security model of SK ij is established between U i and S j . In this query, an unbiased coin c is flipped in the beginning of the game, and its output is used as a decider. The outcome is kept secret to A to check the output from the Test query. Let A execute this query. If the session key SK ij shared between U i and S j is fresh, π t returns SK ij when c = 1or a random number when c = 0. Otherwise, it returns null.

a: SEMANTIC SECURITY OF THE SESSION KEY
In the ROR model, attacker A was tested in the experiment to distinguish between the real session key SK ij and the instance's random key. Therefore, A is allowed to query a large number of Test operations to the sensor node instance or user instance. The output of the Test operation should match the random bit c. Ultimately, attacker A will output a guess bit c , if c = c , then attacker A successfully obtains the correct information in the experiment. Suppose Succ indicates that A succeeded in the experiment. At a polynomial time t, the advantage of attacker A is to break the security of the proposed session key (SK), called P, defined Both attacker A and each participant are provided with a oneway hash function h(· ), which is modeled as a random oracle, say Hash [31]. The Hash oracle is simulated by a two-tuple (a, b) table of binary strings. In this case, if a hash query h(a) is made, the Hash oracle returns b when a is present in the table; otherwise, it returns a uniform random string b and the pair (a, b) is kept safe in the corresponding table [32].

2) SECURITY PROOF
Under the ROR model, the formal proof of the session key security of the system is as follows: Theorem: Let Adv A v (t) be polynomial-time t-adversary A's advantage function in breaking the SK security of the proposed scheme P: where q h , q s , l, | Hash | and |D| are the he number of H queries, the number of Send queries, the number of bits in the biometric key, the range space of the hash function h(·) and the size of a uniformly distributed random dictionary D, respectively. Proof: Proof of the formal security key is as follows, very similar to what has appeared in the literature [33], [31].
We need the next four game stages Gm j (j = 1, 2, 3, 4). We use Succ A Gm j indication that the attacker can win Gm j . • Game Gm 0 : In the initial game Gm 0 , the bit c is chosen by a polynomial-time t adversary A. Since the Gm 0 , and the actual protocol in the ROR are basically identical, it follows that • Game Gm 1 : A invokes the Execute query in the game to implement the eavesdropping function. Then, A calls the Test query after the game is completed. The output of the Test operation is used as a deciding factor for distinguishing the actual session key SK ij between U i and S j with the random number in the session. The session key formation is as follows. S j computes the session key shared with U i , and the same session key computed by U i , is shared with S j as SK ij = h(X i ||SID j ||K u ||N 1 ||N 2 ||PK). Suppose A is able to use some manipulation to get intercept message Msg1 = {M 1 , SID u ,SC u , SR u , A ij , SPK, A 1 } and Msg2 = {M 2 , A 2 }. The session key computation by A needs the long-term secrets ID u , RC's master key K and b. A also the short-term secrets N 1 and N 2 . Without these secret credentials, the chance of winning game Gm 1 by intercepting messages Msg1 and Msg2 is not increased. Since both games Gm 0 and Gm 1 are essentially indistinguishable, we have the following:  ). Therefore, due to the collision resistance of the one-way cryptographic hash function h, the calculation of ID u , RC's master key K , b, Biological key K u , and short-term keys N 1 and N 2 is computationally infeasible. Since game Gm 2 is identical to game Gm 1 when the simulation of Send and Hash queries is not involved, the results from the birthday paradox give the following result: • Game Gm 3 : In the game Gm 3 , the CorruptSmartCard operation is used. Therefore, A has the secret credentials Without the secret credentials C u , R u ,and biometric secret key K u , it is computationally infeasible to derive the UC u and A u . Assuming UC u is l bits, the guessing probability of UC u ∈ {0, 1} l by A is approximately 1/2 l [34]. Note that games Gm 2 and Gm 3 are identical when password and biometrics guessing attacks are not involved. Hence, we have the following result: Since all games are executed, attacker A can only guess the correct bit c. Then come to the following conclusion: According to formula (8), formula (9) and formula (12), we can get the following conclusions: The following results are obtained by triangular inequality: The formula (13) and the formula (14) are combined to obtain: Finally, multiply both sides of equation (15) by 2 and simplify to get the desired result:

B. MUTUAL AUTHENTICATION USING BAN LOGIC
We use a formal analysis of Burrows-Abadi-Needham (BAN) logic [35] to demonstrate that in our proposed protocol, the interaction verification between user U i and server S j is safe. BAN logic has been widely used in interactive authentication, mainly to provide interactive authentication for authentication and session key protocols [2], [23]. The basic building blocks of BAN logic: A| ≡ X : A believes in a statement X . #X : denotes freshness of X A X : A sees X . A| X : A once said statement X . A ⇒ X : A has jurisdiction over X A K ←→ B : K is used by A and B to communicate with each other.
{X , Y } K : X and Y are encrypted with key K . (X , Y ) K : X and Y are hashed with key K . < X > K : X is combined with key K . The main rules of BAN logic are given below: 1) Message-meaning rule(R1): 3) Jurisdiction rule(R3): ←→ B According to the analysis process of BAN logic, our proposed protocol needs to meet the following two objectives: We first list the assumptions related to the proposed scheme: ←→ S j Idealized forms of messages: In the proposed scheme, messages Msg1 = {M 1 , SID u , SC u , SR u , A ij , SPK , A 1 } and Msg2 = {M 2 , A 2 } can be written in their respective idealized forms as follows: The main security proof consists of the following steps: 1) Consider the message Msg1, Under the premise of assuming A6, we can use the message meaning rule R1 to obtain: S1 : S j | ≡ U i | ∼ N 1 2) At the conclusion of S1, the assuming A1 and nonceverification rule R2 can be obtained: 3) Under the conclusion of S2, using hypothesis A4 and jurisdictional rule R3, we can get: S3 : S j | ≡ N 1 4) Server S j believes that N 2 is fresh (available from assuming A2). N 1 , N 2 are the two necessary parameters that make up the key SK ij = h(X * i ||SID j ||K * u | N * 1 |N 2 ||PK * ). So using the session key rule R6 we can get: ←→ S j 5) Next, Consider the message Msg2, we can get: S5 : U i N 2 US j 6) Under the premise of S5, using assuming A7 and message meaning rule R1, we can infer: On the basis of S6, using the nonce-verification rule R2 and the hypothesis A2, we can obtain: 8) Then at S7, assume A3 and the governing rule R3 can be launched: ) U i believes that N 1 is fresh (as can be seen from hypothesis A1), so the key with the combination of N 1 and N 2 also has this property. Therefore, based on the session key rule R6, the assumptions A1 and S8, we can get: It can be seen from the above proof that the defined targets G1 and G2 are implemented in the proposed scheme. Therefore, the scheme maintains a secure interactive authentication between U i and S j .

1) Protection Against Replay Attack:
In the proposed scenario, we use a random number that is more reliable than the timestamp to prevent replay attacks. The attacker cannot replay the message in the proposed scheme because each transmitted message contains a random number and the system will end directly if the random number is found to be inconsistent. In addition, the attacker cannot construct a new message because a valid message contains the biometric key K u information, and since the user's biometric key K u is secure, the replay attack will not work. 2) Ensures Session Key Freshness Property: In our proposed scheme, each session key contains a random number, and each random number is unique for each session. The unique key structure of each session ensures the freshness of the key. 3) Protection User Anonymity: In our scheme, user's ID anonymity is preserved at each login request. We compute an anonymous identity SID u = ID u ⊕ h(N 1 ) for U i and this ID will be different at each login attempt because it is calculated with the random number N 1 . Therefore, if you want to get ID u , you have to get a random number N 1 . But it is always very difficult, for the random number, it is usually hard to guess [39]. Moreover, it is extremely difficult to get the user ID u in the next pass. In particular, the information including several random numbers and the Biological key K u , is always wrapped in a hash function. Typically, the random number of each session is obviously different, it clearly leads to decipher the user ID u more difficult. Therefore, our scheme protects the user's anonymity. 4) Mutual Authentication: In our proposed strategy, only the biometric BIO u of the legitimate user can obtain an correct and unique bio-key K ' u , i.e., K u = FE.Rec (BIO u ,hd). Obvi-ously, K ' u is obtained based on the fuzzy extraction function. After obtaining the bio-key, you also need to get C u (the random number selected during registration) and the same unique R u through the non-clonal function to verify the user's smart card. In the next step, the server obtains C u and R u by decryption, and then the server reads the information for user authentication. While the pipeline that server verifies relevant users, has accomplished, the following process is that the user's verification phase to the server. During validation, the user needs to verify the private key of RC to determine whether or not the server is correctly registered. Ideally, the user and server generate the session key after authentication. Therefore, the proposed scheme can provide mutual verification. 5) Resist Stolen Smart Card Attack: An attacker can obtain information{UC u ,hd,A u ,V i ,Z i ,Y i } stored on smart card. An attacker needs a valid user ID u , key-value pair (C u ,K u ) and corresponding biological key K u to generate a valid login information. User ID u and key-value pair (C u ,K u ) are not stored directly on the smart card, user ID u and key-value pair (C u ,K u ) are hard to guess, so the login information is secure. The calculation of valid biological key K u needs fuzzy extraction. Without correct biological information, it is impossible to generate valid biological key K u , and the biological key is unique. Therefore, it is never possible that the biological key K u has been effectively guessed. Since the biological key K cannot be guessed and the server's private key is not public, the login information is hardly computed. Hence, the proposed scheme can resist the attack of stolen smart card.
Clearly, it is able to see that A needs some secret information ID u , key-value pair (C u ,K u ) and biological key K u . Without this information, it is difficult to get a new valid one. Similarly, it is also difficult for attacker A to modify the intercepted communication message Msg2 and make it become a new effective message. Obviously, the proposed scheme can resist the man-in-the-middle attack. 7) Impersonation Attacks: • User Impersonation Attack: To convince server S j with the information came from a legitimate user U i , an attacker A have to generate a new random nonce N * 1 . In the next moment, A attempt to calculate login request message {M 1 ,SID u ,SC u ,A ij ,SPK,A 1 } based on user login phase. The information calculated from user login phase is as follows: . Whereas, such attempt by A often is failure, while the secret credentials ID u , key-value pair (C u ,K u ) and biological key K u are unknown to A. In this case, the proposed scheme can resist user simulation attack.
• Server Impersonation Attack: In this attack, attacker A needs to convince the user U i that the information is coming from a valid server S j ., initially, A generates a random number N * 2 , and then computes the verification information{M 2 , A 2 }. However, without short-term key N 1 , user ID u and server key K 1 , A is difficult to form an effective verification information. To some extent, the proposed scheme can also resist server simulation attack.

V. PERFORMANCE ANALYSIS AND COMPARISON
To show the advantage of our proposed scheme, now we first compare the proposed scheme with four recently proposed multi-server authentication key protocol schemes. From Table 2, we can see that, the proposed scheme is secure against all the imperative security threats and accomplishes diverse features. We focus on the security against replay attack and anonymity, stolen smart card attack and Man-inthe-middle attack, user impersonation attack, cloud server impersonation attack, mutual authentication and session key freshness and protection smart card physical security. We note that none of these past schemes including Kumari et al. [5], Feng et al. [36], Sood et al. [37] and Shen et al. [38], fulfill all the essential security properties in contrast to our scheme which achieves all the security properties simultaneously.
The scheme presented by Barman et al. cannot ensure mutual authentication and session key freshness and protection smart card physical security. Feng et al.'s schemes suffer from stolen smart card attack and Man-in-the-middle attack. The scheme proposed by Sood et al. cannot prevent impersonation attack. Shen et al.'s scheme cannot satisfy both user and cloud server identity protection (anonymity) and mutual authentication. Shen et al.'s schemes require the support of RC to achieve the mutual authentication and does not provides the owner confirmation method in smart card. It is worth noting that none of the existing schemes are completely protection smart card physical security. However, our proposed protocol is able to protect smart card physical security.
Next, we compare our scheme with the existing multiserver schemes with respect to the computation cost of login and authentication phases. We evaluated the performance of our improved scheme and compared it with four recently proposed schemes in the literature, i.e., Barman et al [5], Feng et al [36], Sood et al [37], and Shen et al [38]. We apply hash function, PUF, fuzzy extractor and elliptic scalar point multiplication to determine the computational overhead for each authentication schemes. The comparison results are shown in Table 3. The following notation is used to represent the computation cost:  • C h : Computational complexity to execute a one-way cryptographic hash function • C puf : Computational complexity to execute a PUF function • C ecm : Computational complexity to execute an elliptic curve scalar point multiplication • C fcs : Computational complexity to execute a fuzzy extraction operation Based on the experimental results reported in [5], we have C h ≈ 0.0023ms, C fcs ≈ C ecm ≈ 2.226ms and C puf ≈ 0.12ms. Based on these results, we calculate the rough computation time (in milliseconds) and present the results in Table 3. It is worth noting that our scheme has low computation cost compared to Feng et al. 's scheme, and its cost is also comparable with the schemes of Shen et al. Although our scheme has high computation cost compared to that for the schemes of Barman et al., Sood et al., our scheme offers superior security and more functionality features (see Table 3). Hence, it can be argued that the proposed scheme is secure and more efficient for multi-server authentication.

VI. CONCLUSION
In this paper, we presented a secure biometrics and PUFsbased authentication scheme with key agreement for multiserver environments, which allows users to login servers without password. Our scheme allows user to anonymously communicate with the server and users only need to register with the registry once to access multiple servers in the registry. The proposed protocol provides the desired security characteristics efficiently for smart card by exploiting the inherent security features of PUFs. Hence, we argue that the proposed scheme is be a viable and promising solution for the security of multi-server environment authentication. HUI ZHANG is currently pursuing the M.S. degree with Anhui Normal University, China. Her research interests include image processing, machine learning, and biometrics privacy protect. VOLUME 8, 2020