# A Secure and Efficient Three-Factor Authentication Protocol in Global Mobility Networks
## 6 Security Analysis
### ROR Model Analysis
#### 6.4.1 Security Proof  
We utilized Zipf's law [27] to assess the SK security of our protocol and the detailed theorems are given as follows:  
**Theorem 1**. : _If \(Adv_{U_{A}}\) denotes the advantage function of the \(U_{A}\) in violating SK security of our protocol. Then, we obtain the following._  
\[Adv_{U_{A}}\leq\frac{q_{h}^{2}}{|Hash|}+2\{C\cdot q_{send}^{s},\frac{q_{s}}{2^ {l_{b}}}\}\]  
_where Hash, \(q_{send}\), and \(q_{h}\) are the number of Hash queries, the number of Send queries, and the range space of the hash function \(h(. )\), respectively; \(l_{b}\) is the number of bits present in the \(MU_{i}\)'s biometric secret key \(b_{i}\); and \(s\) and \(C\) are the Zipf's parameters [27]._  
Proof. : We follow the proof as presented in [28; 29]. A sequence of five games denoted by \(GM_{i}\), where \(i\in[0,3]\), are defined to demonstrate the SK security of our protocol. \(Succ_{i}\) denotes the probability of \(U_{A}\) winning the game \(GM_{i}\). Each game is described in detail as follows. * **Game \(GM_{0}\)**: This game is considered as an actual attack by the \(U_{A}\) for the proposed protocol \(P\). Since the bit \(c\) is guessed at the beginning of \(G_{0}\). According to this game, we obtain the following: \[Adv_{P}=|2\cdot Pr[Succ_{0}]-1|.\] (2)
* **Game \(GM_{1}\)**: This game is modeled so that the \(U_{A}\) performs an eavesdropping attack in which the exchanged messages \(\{M_{1},M_{2},RID_{i},Q_{M}\}\), \(\{M_{1},RID_{i},Q_{M},ID_{FA},M_{3},Q_{F}\}\), \(\{M_{4},M_{5},Q_{H}\}\), and \(\{M_{4},Q_{MF}\}\) are intercepted during the authentication phase using the \(Execute(P^{t_{1}}_{MUI},P^{t_{2}}_{FA},P^{t_{3}}_{HA})\) query. Then, \(U_{A}\) performs the \(Test\) query to check whether it is the real SK or a random number. In the proposed protocol, the \(SK_{i}\) is calculated as \(SK_{i}=h(R_{MUI}|R_{FA})\). To derive \(SK_{i}\), the \(U_{A}\) needs secret credentials, such as \(R_{MUI}\), \(R_{FA}\), and \(X_{i}\). Consequently, the \(U_{A}\)'s probability in winning \(GM_{1}\) by eavesdropping on the exchanged messages does not increase. We can obtain \[Pr[Succ_{1}]=Pr[Succ_{0}].\] (3)* **Game**\(GM_{2}\): The difference between \(GM_{1}\) and \(GM_{2}\) is that the \(Hash\) and \(Send\) queries are included in \(GM_{2}\). This game can be considered as an active attack in which the \(U_{A}\) may try to fool a legitimate entity to accept the exchanged messages modified by the \(U_{A}\). All exchanged messages are protected by using the collision-resistant one-way hash function \(h(\cdot)\). All exchanged messages are constructed using the random credentials \(R_{MU}\), \(R_{FA}\), and \(X_{i}\). All exchanged messages are constructed using the random credentials \(R_{MU}\), \(R_{FA}\), and \(X_{i}\) and these messages are protected by using the collision-resistant one-way hash function \(h(.)\). Using birthday paradox, we can obtain the following result: \[|Pr[Succ_{2}]-Pr[Succ_{1}]|\leq\frac{q_{h}^{2}}{2|Hash|}.\] (4)
* **Game**\(GM_{3}\): In the final game, the \(CorruptDevice\) query is modeled. In this case, a \(U_{A}\) can extract the secret parameters \(\{A_{i},B_{i},P_{i}\}\) from a mobile device's memory utilizing the power-analysis attack. Here, \(A_{i}=X_{i}\oplus h(RID_{i}||RPW_{i})\), \(B_{i}=h(RPW_{i}||X_{i})\) and \(P=Gen(BIO_{i})\). It is computationally infeasible for \(U_{A}\) to derive the real identity \(ID_{MU}\) and password \(PW_{MU}\) of \(MU\) correctly via the \(Send\) query without \(HA\)'s master key \(K_{s}\) and secret parameter \(X_{i}\). The probability of guessing the biometric key \(b_{i}\) of \(l_{b}\) bits by the \(U_{A}\) is approximately \(\frac{1}{2^{b_{i}}}\). Consequently, the \(GM_{2}\) and \(GM_{3}\) are indistinguishable if password/biometrics guessing attacks are not implemented. Therefore, utilizing [PERSON]'s law [27], we can obtain the following result: \[|Pr[Succ_{3}]-Pr[Succ_{2}]|\leq max\{C\cdot q_{send^{*}}^{s}\frac{q_{s}}{2^{ b_{i}}}\}\] (5)  
As all the games are executed, the \(U_{A}\) must guess the exact bit \(c\).