# Provably Secure ECC-Based Anonymous Authentication and Key Agreement for IoT
## 1 Introduction
### Related Work  
Over the last few years, numerous AKA solutions have been developed for IoT applications. The symmetric cryptography-based AKA protocols [6; 7; 8; 9] have the advantages of lowcomputational complexity and high efficiency. On the other hand, such schemes necessitate sharing key parameters between end devices beforehand or each device transferring its key to the server. It is unrealistic for numerous end devices and significantly burdens the servers. Physical Unclonable Function (PUF) is a promising lightweight hardware security primitive adopted by many IoT AKA protocols [10; 11; 12]. Each participant in these schemes should record one or more Challenge-Response Pairs (CRPs) of its PUF with the registration server beforehand. When a registered device, Alice, wants to communicate with another registered device, Bob, it can only do so with the assistance of the server, which results in a lack of flexibility and efficiency. In contrast, the asymmetric cryptography-based AKA schemes requiring fewer restrictions have attracted increasing attention [13]. Elliptic Curve Cryptography (ECC) provides smaller key sizes than other asymmetric algorithms with the same security [14; 15], which makes it introduced in IoT AKA protocols. Numerous IoT AKA protocols based on ECC have been developed. In 2015, a bilinear pairing-based AKA protocol for wireless body area networks (WBAN) was put forward by [PERSON] et al. [16], which requires a high computational overhead. They claimed that their scheme achieves absolute anonymity, perfect forward security (PFS), and overcomes the weaknesses of previous schemes. After analysis, it was found that the session key could be captured after temporary session information disclosure. In addition, [PERSON] et al. [17] pointed out that the protocol is incapable of withstanding impersonation (IM) attacks. And then, they proposed an enhanced version for WBANs. However, the enhanced scheme also uses bilinear pairing and suffers from ephemeral secret leakage (ESL) attacks. [PERSON] et al. [18] introduced an AKA scheme for dynamic WSNs. Later, [PERSON] et al. [19] pointed out that the scheme [18] could not provide PFS; then, they proposed a scheme for establishing an authenticated key between WSNs and cloud servers, whereas the proposal [19] is also not resistant to ESL attacks and cannot provide user anonymity. In 2020, an AKA scheme for IoT was introduced by [PERSON] et al. [20]. In this scheme, heterogeneous-type IoT smart devices are deployed based on a trust model. Their solution requires higher computational and communication costs and is susceptible to ESL attacks [21]. In the same year, [PERSON] et al. [22] introduced an AKA protocol for SG that offers solutions to some of the previously mentioned problems, such as ESL attacks and private key leakage attacks. Unfortunately, in [22], the trusted authority (TA) is able to masquerade as a smart meter to agree on session keys with the server provider [23]. Moreover, the scheme needs more computational and communication costs for the bilinear pairing computation. Recently, [PERSON] et al. [24] designed an anonymous AKA protocol with [PERSON]'s signature. Later, [PERSON] et al. [23] demonstrated that the scheme [24] is prone to man-in-the-middle (MIM) attacks and IM attacks. Cryptanalysis identifies that the protocol [24] is also vulnerable to key escrow problems and ESL attacks. [PERSON] et al. [25] stated that [PERSON] et al. 's scheme [26] suffers from MIM attacks and key compromise impersonation (KCI) attacks and is incapable of providing PFS, and then introduced an enhanced cloud-based scheme. Unfortunately, the enhanced scheme has key escrow problems and is incapable of providing user anonymity. [PERSON] et al. [27] presented an AKA scheme for SG using ECC and symmetric encryption. Unfortunately, this scheme [27] has key escrow problems and suffers from MIM attacks. [PERSON] et al. [28] examined the deficiencies of four existing AKA schemes and then proposed an improved device-to-device AKA scheme in the IoT.