## 6 Security Analysis
### Informal Security Analysis
At first, the card \(SC_{i}\) always checks the legitimacy of \(P_{i}\) based upon \(V_{i}\) and their input credentials \(ID_{i}^{*}\), \(PW_{i}^{*},B_{i}^{*}\). If the verification does not hold, the system will immediately terminate the session. Therefore, \(\mathcal{A}\) is not able to flood the communication with subsequent steps. \(S_{m}\) also identifies \(P_{i}\) upon \(ID_{i}\), as well as verifying the freshness of \(u_{m,i}\) through some ECC-based lightweight computation steps. Repeatedly retransmitting \(\{C_{i,m1},C_{i,m2},T_{i,m}\}\) to disrupt \(S_{m}\)'s services would not work efficiently considering the redundant resources on the server side. Moreover, the communication will be stopped if the check on \(u_{m,i}\) fails. Hence, the conclusion is established. _Resistance to MITM attacks_: In intercepting the login message, \(\mathcal{A}\) may use its own parameters to forge and generate a candidate message. The purpose is to act as a middle man to compromise the conveyed messages between \(P_{i}\) and \(S_{m}\) without being noticed. However, since \(\mathcal{A}\) does not know the key \(prk_{m}\) and the identity \(ID_{i}\), it is not possible for \(\mathcal{A}\) to compute a correct \(u_{i,m}\) for verification and a correct \(Z_{m,j}\) for generating \(R_{i,m}\). Without \(R_{i,m}\), \(\mathcal{A}\) is also not able to create a tampered message \(\{\theta_{m,i}\}\) sent to \(P_{i}\). Thus, my protocol is robust against MITM attacks. _Resistance to replay attacks_: Suppose \(\mathcal{A}\) intercepts and resends the message \(\{C_{i,m1},C_{i,m2},T_{i,m}\}\) to \(S_{m}\) in order to perform a replay attack on the subsequent communication session. In my protocol, timestamp \(T_{i,m}\), which can only be used once, is employed to check whether the message is reset. Moreover, even if \(\mathcal{A}\) can somehow pass the timestamp challenge, the replay attack will also fail, since \(\mathcal{A}\) does not know \(R_{i,m}\) and \(a_{i,m}\) to decrypt \(\theta_{m,i}\) and compromise \(K_{i,j}\). Therefore, the conclusion is established. _Resistance to online and offline password guessing attacks_: In the online login interface, \(\mathcal{A}\) may enter a guessed password (even with a correct identity and correct biometrics) into the system. Based on the rule of my protocol, \(SC_{i}\) will check the value \(V_{i}\) and easily decline the candidate password entered by \(\mathcal{A}\). Suppose \(\mathcal{A}\) somehow obtains values \(A_{i,m}\) and \(V_{i}\) and then \(\mathcal{A}\) attempts to guess \(P_{i}\)'s password based on these hash values. However, other than \(PW_{i}\), \(A_{i,m}\) and \(V_{i}\) contain \(ID_{i}\), \(B_{i},\sigma_{i}\). Therefore, it is not possible for \(\mathcal{A}\) to compute the candidate hashes \(A_{i,m}^{\prime}\), \(V_{i}^{\prime}\) and compare them with \(A_{i,m}\), \(V_{i}\) to guess the correct password. Thus, the conclusion is established. Along with the password, biometrics is also fully protected in my protocol during the communication process, which guarantees a strong three-factor authentication mechanism. Moreover, the password and biometrics update function is provided in the proposed protocol, which further enhances the security of \(PW_{i}\) and \(B_{i}\). _Resistance to stolen smart card attacks_: Suppose the card \(SC_{i}\) of \(P_{i}\) is somehow lost and \(\mathcal{A}\) has obtained it; \(\mathcal{A}\) conducts a power analysis [34] and retrieves all the parameters stored in \(SC_{i}\). Nevertheless, the password \(PW_{i}\) and biometrics \(B_{i}\) are not directly stored in \(SC_{i}\); they are therefore not exposed to \(\mathcal{A}\) upon power analysis. Even if \(\mathcal{A}\) can simultaneously obtain \(MD_{i}\) and \(SC_{i}\), \(\mathcal{A}\) is not able to pass the smart card verification without \(ID_{i}\), \(PW_{i}\), \(B_{i}\) when entering the credentials to the login system.