## 4 Security Analysis of BSNCare+
How to efficiently identify such counterfeit messages and eliminate new potential threats in an IoT-based healthcare environment has thus become increasingly important. Messages forged by the malicious attackers may exist in any kind of expressions and new cheating tricks may be launched through the heterogeneous network architectures of IoT. Hence, an examination scheme for identifying the counterfeit messages and accordingly for preventing malicious attacks is indispensable for an authentication scheme. In the BSNCare+, without the knowledge of \(K_{is}\) and \(K_{js}\), it is difficult for the attacker to counterfeit legitimate messages such as \(AID_{i}\), \(M_{1}\), \(M_{2}\), \(V_{1}\), \(Tr\), \(V_{2}\) and \(V_{3}\), and to launch a forgery attack. Note that these two secrets are chosen by the _Server_ and have a high-entropy to resist against brute-force attacks. Even if the attacker sends a valid-but-used message, eavesdropped from the previous authentication session, to a victim party, the verification of these previously-used messages will fail. This is because the random numbers, i.e., \(N_{i}\), \(N_{j}\) and \(N_{s2}\), have a one-time-use for each session. That is, the examination of the freshness of these used random numbers will make the verification invalid. Therefore, the resistance to replay attack is embedded in the BSNCare+. Next, in the BSNCare+, we embed the GPS information of \(BS_{i}\) and \(MG_{j}\) into \(M_{1}\) and \(M_{A_{1}}\), respectively. For the un-traceability for \(BS_{i}\), the GPS information of \(BS_{i}\) is well-protected in \(M_{1}\). Nobody except the _Server_ can perform a un-traceability attack on \(BS_{i}\) due to the unknown \(K_{is}\). On the _Server_ side, a verification process for examining location spoofing attacks is presented. The resistance to location spoofing attacks is naturally embedded into the BSNCare+. Finally, we analyze the robustness against man-in-the-middle attacks. In the BSNCare+, an attacker may interrupt authentication sessions and fool the legal communicating entities that he/she is the other legitimate side via eavesdropped (or counterfeited) messages. To prevent such a phenomenon, we embed all the entities' identities into the protocol messages for mutual authentication among communication entities; for example, \(K_{is}=H(ID_{s}\mid\mid N_{is}\mid\mid ID_{i})\), \(K_{js}=H(ID_{s}\mid\mid N_{js}\mid\mid ID_{j})\), \(M_{1}=H(K_{is}\oplus N_{i})\oplus GPS_{i}\), \(AID_{i}=H(M_{1}\mid\mid GPS_{i}\mid\mid ID_{j}\mid\mid GPS_{j}\mid\mid TR_{seq})\), \(M_{2}=H(K_{js}\oplus N_{j})\), \(V_{1}=H(M_{A_{1}}\mid\mid TR_{seq}\mid\mid ID_{j}\mid\mid N_{js})\), \(Tr=H(K_{is}\mid\mid N_{s2})\oplus Tr_{seqseq}\), \(V_{3}=H(Tr\mid\mid K_{is})\) and \(V_{2}=H(ID_{j}\mid\mid N_{js}\mid\mid K_{js})\). It is obvious that all the messages contain the entities' identities actually communicating in the authentication session. Accordingly, to counterfeit a forged message containing other invalid entities' identities is difficult because of the irreversibility of the one-way hash function. On the other hand, the previously used message cannot be reused (or modified) under the protection of the one-way hash function with one-time use random numbers. The resistance against man-in-the-middle attack is actually provided. * Claim 5: The non-repudiation transaction property is provided. In an IoT-wide universe, a mechanism capable of proving a group of mobile objects (or mobile gateway and sensors) existing at the same place and at the same time is important for preventing possible fraud event. In our proposed BSNCare+ system, the identities and the GPS information of \(BS_{i}\) and \(MG_{j}\) is embedded into the authentication messages, i.e., \(M_{A_{1}}\) and \(M_{A_{2}}\), to demonstrate the involved entities and the location of current transaction session.