# A Secure and Efficient Three-Factor Authentication Protocol in Global Mobility Networks
## 6 Security Analysis
### ROR Model Analysis  
To evaluate the session key (SK) security of the protocol from the malicious adversary \(U_{A}\), the proposed protocol performs the ROR model [26], which is a widely known formal security analysis. We first introduce the ROR model before doing a SK security proof for the proposed protocol.  
**Participants:** There are three participants: the mobile user \(P_{MUL}^{t_{1}}\), the foreign agent \(P_{FA}^{t_{2}}\), and the home agent \(P_{HA}^{t_{3}}\) are instances \(t_{1}^{th}\) of the \(MU\), \(t_{2}^{th}\) of the \(FA\), and \(t_{3}^{th}\) of the \(HA\), respectively.  
**Partnering:** The instances \(t_{1}^{th}\) and \(t_{2}^{th}\) are partners if they satisfy the following conditions: (1) \(t_{1}^{th}\) and \(t_{2}^{th}\) are in the accept state, (2) \(t_{1}^{th}\) and \(t_{2}^{th}\) authenticate each other mutually sharing the same \(sid\), and (3) \(t_{1}^{th}\) and \(t_{2}^{th}\) are mutually authenticated.  
**Freshness:** If the \(U_{A}\) does not obtain the SK between \(MU\) and \(FA\) by utilizing the reveal query _R reveal_, the instance \(t_{1}^{th}\) or \(t_{2}^{th}\) is considered fresh.  
**Adversary:** In the ROR model, the \(U_{A}\) can eavesdrop, modify, delete, or insert the exchanged messages during the communication. Furthermore, the \(U_{A}\) will have the access to the following queries.  
* \(Execute(P_{MUL}^{t_{1}},P_{FA}^{t_{2}},P_{HA}^{t_{3}})\): It denotes that \(U_{A}\) performs the eavesdropping attack by eavesdropping exchanged messages between \(MU\), \(FA\), and \(HA\) over wireless communication.
* \(CorruptDevice(P_{MUL}^{t_{1}})\): It is modeled from the mobile device lost/stolen attack, in which the \(U_{A}\) is able to extract the secret data in the mobile device.  
* \(Send(P^{t},M)\): In this query, the \(U_{A}\) can dispatch a message \(M\) to the instance \(P^{t}\) and can also reply accordingly.
* \(Test(P^{t})\): It corresponds to the semantic security of the \(SK_{ij}\) between \(MU\) and \(FA\) following the indistinguishability style in the ROR model [26]. In this query, before the experiment starts, an unbiased coin \(c\) is tossed. If the \(U_{A}\) executes \(Test\) query and the established \(SK_{ij}\) is fresh, then \(P^{t}\) returns \(SK_{ij}\) for the case when \(c=1\) or a random value when \(c=0\). On the other cases, it returns a null value (\(\bot\)).
* \(Reveal(P^{t})\): With this query, the \(U_{A}\) can reveal the \(SK_{i}\) created by its partner to \(U_{A}\) in the current session.  
**Semantic security of the session key:** In this formal security model, the malicious adversary \(U_{A}\) must distinguish between an instance's actual \(SK\) and a random secret key. The \(U_{A}\) can perform \(Test\) queries to either \(P^{t_{1}}_{MUI}\) or \(P^{t_{2}}_{FA}\), and its output is checked for consistency against the random bit c. If the condition \(c^{\prime}=c\) is valid, the \(U_{A}\) wins the game. Otherwise, the \(U_{A}\) loses the game. Let \(Succ\) denote an event that is \(U_{A}\) winning the game. Therefore, the advantage of \(U_{A}\) in breaking the semantic security of our protocol \(P\) is shown in Equation (1). The proposed protocol \(P\) is secure relative to the ROR model when \(Adv_{P}\leq\psi\), for any sufficiently small \(\psi>0\).  
\[Adv_{P}=|2\cdot Pr[Succ]-1| \tag{1}\]  
**Random oracle:** In this paper, all the participants and the malicious adversary \(U_{A}\) can access a collision-resistant one-way hash function \(h(\cdot)\). We model \(h(\cdot)\) as a random oracle, say _Hash_.