# Towards a Provably Secure Authentication Protocol for Fog-Driven IoT-Based Systems
## 4 Security Analysis
### Formal Security Analysis  
Random Oracle Model  
In this subsection, the formal security analysis of the proposed protocol is discussed using the following theorem. Theorem 1: _Let \(P\) denote the proposed protocol. If an adversary \(\mathcal{A}_{att}\) wins the AKA attack game, having advantage \(Advt_{p}^{AKA}(\mathcal{A}_{att})\), then there must be a polynomial time algorithm that can solve the \(DBDH\) hard problem with following:_  
\[ \begin{split} Advt_{Gm_{1},Gm_{2}}^{DBDH}\leq\frac{1}{q_{sd}} Advt_{p}^{AKA}(\mathcal{A}_{att})-\\ \frac{\Sigma_{a=0}^{a=4}q_{ha}^{2}+(q_{sn}+q_{ex})^{2}}{2 pq_{sn}}+ \frac{q_{ls5}}{pq_{sn}}+\frac{2q_{l0}q_{ls3}}{p^{2}q_{sn}}\end{split}  \tag{1}\]  
_whereas \(q_{ha}=(a=0,1,2,3,4,5),q_{sn},q_{ex},q_{rv}\) indicates the time of \(Hash,Send,Execution,\) and Reveal queries, respectively._  
Proof: Let \(\mathcal{A}_{att}\) be an attacker who attacks on protocol and wins the game with an advantage of \(\varepsilon\). A challenger \(C\) is constructed, who solves \(DBDH\) problem instance \((P,SP,YP,VP,h)\) for some unknown \(s,t,veZ_{p}^{s}\) and \(h\varepsilon G_{2}\), to decide if \(h=e(P,P)^{stv}\) holds or not. All the hash functions of the proposed protocol are simulated as random oracles, and \(C\) established a hash list \(L_{Hash}\) which is initialized as an empty list. Message (a = 1,2,3,4) indicates the messages that are being transmitted by the entities during protocol's execution. \(C\) chooses \(r_{k}{\in}Z_{p}^{s}\) randomly and publishes \(RID_{k}=h(ID_{k}\oplus r_{k})\); \(C\) also sets identities \(ID_{k}\), \(ID_{f}\) for the user and fog-node. \(C\) runs the proposed protocol and answers the following queries of \(A_{att}^{s}\) oracle. **Send query**: \(\mathcal{A}_{att}\) initiates an active attack and using different \(Send\) queries forwards the messages. Four different \(Send\) queries are available to \(\mathcal{A}_{att}\), which are as follows:  
1. \(Send\) (\(U_{k}^{i}(FN_{f},START)\)): After getting the query, \(C\) initiates a new session and returns the login message produced by the user. Particularly, \(C\) chooses \(r_{3}\) and \(r_{4}\) randomly and computes \(M_{1}=(r_{3}\|r_{4})\oplus X_{k}^{t},auth_{k}=h(ID_{k}\|ID_{csp}\|X_{k}^{t}\|r _{4})\). Moreover, \(C\) returns \(\{M_{1},TID_{k},auth_{k}\}\) to \(\mathcal{A}_{att}\), and \(\Pi_{c}^{i}\) is set to an expecting state. 2. \(Send(FN_{f}^{j},Message_{1})\): After getting this query, \(C\) first breaks the \(Message_{1}\) into \((M_{1},TID_{k},auth_{k})\), picks \(r_{5},r_{6}\), and computes \(X_{f}^{\prime}=ID_{f}\oplus Y_{f}\), \(M_{2}=(r_{5}\|r_{6})\oplus X_{f}^{\prime}\), \(auth_{f}=h(ID_{f}\|ID_{csp}\|X_{f}^{\prime}\|r_{6})\). Then \(C\) returns \(\{M_{1},M_{2},TID_{k},TID_{f},auth_{k},auth_{f}\}\) to \(\mathcal{A}_{att}\) and sets \(\Pi_{FN}^{j}\) to an expecting state. 3. \(Send(CSP^{k},Message_{2})\): After getting this query, \(C\) breaks the \(Message_{2}\) into \(\{M_{1},M_{2},TID_{k},TID_{f},auth_{k},auth_{f}\}\) and computes \(auth_{k}^{\prime}\) and \(auth_{f}\) and checks either \(auth_{k}^{\prime}\stackrel{{? }}{{=}}h(ID_{k}\|ID_{csp}\|X_{k}\|r _{4})\) and \(auth_{f}\stackrel{{? }}{{=}}h(ID_{f}\|ID_{csp}\|X_{f}\|r_{6})\) holds or not. If not, \(A_{att}^{s}\) query is rejected by \(C\) and returns nothing. Else, \(C\) picks \(r_{7}\) and calculates \((N_{1},N_{2},\mathcal{SK}_{k-f-csp},auth_{csp_{1}},auth_{csp_{2}},Q_{k},Q_{f})\) and sends \(\{N_{1},N_{2},Q_{k},Q_{f},auth_{csp_{1}},auth_{csp_{2}}\}\) to \(\mathcal{A}_{att}\) and instance \(csp\) terminates. 4. \(Send(FN_{f}^{j},Message_{3})\): After getting this query, it is assumed that \(\Pi_{FN_{f}}^{j}\) is in an expecting state, and determines if \(auth_{csp_{2}}^{\prime}\stackrel{{? }}{{=}}h(ID_{f}\|ID_{csp}\|X_{k} \|\mathcal{SK}_{k-f-csp}\|r_{6}\|r_{7})\) holds or not, If not, then \(C\) rejects \(\mathcal{A}_{att}^{\prime}\) query otherwise \(C\) returns back \(\{N_{1},auth_{csp_{1}},Q_{k}\}\) to \(\mathcal{A}_{att}\) and fog instance terminates. 5.