Security Analyses of an Anonymous Two Factor Authentication Protocol for Roaming Service in Global Mobile Networks

Recently, Gupta and Chaudhari proposed an anonymous two factor authentication protocol for roaming service in global mobile networks. They claimed that their scheme could not only ensure strong user anonymity, mutual authentication and perfect forward secrecy but also resist desynchronization attack, password guessing attack, replay attack, and insider attack. After analyzing their scheme, we find that it suffers from some flaws. First, the foreign agent cannot determine who the home agent is and whether the received request is for itself or not. Second, some operation cannot be executed by the home agent to record the number of authentication failure. Third, the foreign agent cannot determine whether the message received sent by the home agent is for itself or not. Fourth, a malicious user can mount parallel attack to obtain the unauthorized service. In this paper, we will show how these flaws threaten Gupta and Chaudhari’s protocol.