## 3 The Proposed Healthcare System: BSNCare+
### The Authentication Phase  
Under the public and insecure IoT communication architecture, an authentication procedure is needed to establish a secure communication channel for robust data exchange among \(BS_{i}\), the \(MG_{j}\) and the _Server_. The detailed communication procedures of the authentication phase are as shown in Figure 3. \begin{table}
\begin{tabular}{c c} \hline \hline
**Symbol** & **Definition** \\ \hline \(BS_{i}\) & Body sensor \(i\) \\ \(MG_{j}\) & Mobile gateway \(j\) (operated by the nurse or the doctor) \\ _Server_ & The BSN-Care server \\ \(ID_{i}\) & Private identity of \(BS_{i}\) \\ \(ID_{j}\) & Public identity of \(MG_{j}\) \\ \(ID_{s}\) & Public identity of _Server_ \\ \(AID_{i}\) & One-time-alias identity of \(BS_{i}\) \\ \(SID\) & A set of un-linkable shadow identities \(SID=\{\mathit{sid}_{1},\mathit{sid}_{2},\dots\ \}\) \\ \(K_{is}\) & The secret key shared between \(BS_{i}\) and _Server_ \\ \(K_{js}\) & The secret key shared between \(MG_{j}\) and _Server_ \\ \(\mathit{Tr}_{\mathit{seq}}\) & Track sequence number \\ \(\mathit{Tr}_{\mathit{seq}}\) & Random numbers \\ \(GPS_{k}\) & The GPS information of entity \(k\) \\ \(H(.)\) & Secure one-way hash function, i.e., SHA-3 \\ \(\oplus\) & Bitwise exclusive-or operation \\ \(\mid\mid\) & Concatenation operation \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Notations throughout the communication process of the BSN-Care+. **Step 1, \(BS_{i}\to MG_{j}\): \(M_{A_{1}}\)= {\(AID_{i}\), \(M_{1}\), \(N_{i}\), \(Tr_{seq}\) (if req. ), \(ID_{j}\), \(GPS_{j}\)}**  
The \(BS_{i}\) first generates a random number \(N_{i}\) and calculates \(M_{1}\) = \(H(K_{is}\oplus N_{i})\oplus GPS_{i}\) and \(AID_{i}\) = \(H(M_{1}\mid GPS_{i}\mid\mid ID_{j}\mid\mid GPS_{j}\mid\mid\)\(Tr_{seq})\). Next, \(\text{BS}_{i}\) sends \(M_{A_{1}}\) = {\(AID_{i}\), \(M_{1}\), \(N_{i}\), \(Tr_{seq}\) (if req. ), \(ID_{j}\), \(GPS_{j}\)} as an authentication request to the \(MG_{j}\). Note that if the value \(Tr_{seq}\) shared between \(BS_{i}\) and the _Server_ is out of synchronization, \(BS_{i}\) then chooses a fresh shadow identity \(sid_{h}\) from \(SID\) and, consequently, sets \(sid_{h}\) as \(AID_{i}\). After that, \(BS_{i}\) sends \(M_{A_{1}}\) = {\(AID_{i}\), \(M_{1}\), \(N_{i}\), \(ID_{j}\), \(GPS_{j}\)} as an authentication request to the \(MG_{j}\). **Step 2, \(MG_{j}\to Server\): \(M_{A_{2}}\): {\(M_{2}\), \(N_{j}\), \(ID_{j}\), \(V_{1}\), \(M_{A_{1}}\)}**  
Upon receiving the authentication request from \(BS_{i}\), the \(MG_{j}\) generates a random number \(N_{j}\) and computes \(M_{2}\) = \(H(K_{js}\oplus N_{j})\) and \(V_{1}\) = \(H(M_{A_{1}}\mid\)\(TR_{seq}\mid\)\(\mid ID_{j}\mid\)\(\mid\)\(N_{j}\)\(\mid\)\(K_{js})\). Then, the \(MG_{j}\) sends \(M_{A_{2}}\) = {\(M_{2}\), \(N_{j}\), \(ID_{j}\), \(V_{1}\), \(M_{A_{1}}\)} to the _Server_. **Step 3, _Server \(\to MG_{j}\): \(M_{A_{3}}\)= {\(N_{s2}\), \(Tr\), \(V_{3}\), \(V_{2}\)}**  
Once the _Server_ obtains \(M_{A_{2}}\) = {\(M_{2}\), \(N_{j}\), \(ID_{j}\), \(V_{1}\), \(M_{A_{1}}\)}, the _Server_ first checks whether the track sequence number \(Tr_{seq}\) is in the request. If \(Tr_{seq}\) is included in \(M_{A_{2}}\), the _Server_ performs condition (1). Otherwise, condition (2) is invoked. * Condition (1): Check the validity of \(Tr_{seq}\), and look for the corresponding tuple via \(Tr_{seq}\) from the backend database. If \(Tr_{seq}\) is valid, the _Server_ retrieves \(K_{is}\) and derives \(GPS_{i}\) = \(M_{1}\oplus H(K_{is}\oplus N_{j})\). Then, the _Server_ compares the computed \(GPS_{i}\) with the received \(GPS_{j}\) for the purpose of checking if there is a location spoofing attack. If so, the _Server_ stops the session. Otherwise, the _Server_ verifies \(M_{2}\), \(V_{1}\) and \(AID_{i}\) via the following equations. Figure 3: The authentication process of BSNCare+. \(\odot\) Are the received value \(M_{2}\) and the computed value \(M_{2}=H(K_{js}\oplus N_{j})\) equal?