## 3 Results and Discussion
### The AVISPA Results
Further, the attacker needs to compute the \(CT_{j}\) through the use of the secret key to encrypt additional parameters \(SK_{j}=h(HGW_{ID}\parallel SN_{ID}\parallel HGW_{MSK})=h(SN_{ID}\parallel SN_{MSK})\) that are shared between gateway and sensor. The \(SK_{j}\) is unknown to the attacker with \(N_{j}\), and \(PID_{i}\) to compute \(P_{i}\). As a result, even if the attacker successfully captures a sensor, he/she will be unable to impersonate a valid HGWN. As a result, the proposed scheme is resistant to a gateway impersonation attack. * IoT smart device impersonation attack: The adversary must construct a valid message to impersonate the sensor node SN and deceive the HGWN, say \(M_{3}=SN_{ID},B_{i},Z_{i},TS_{3}\) throughout the authentication phase, and make additional efforts to create a message \(M_{3}^{\prime}\) via the public channel. The attacker needs \(PID_{i}\), and \(N_{j}\). As a result, the adversary cannot pose as a valid sensor node SN in the proposed system, preventing sensor node impersonation attacks. * Agriculture professional impersonation attack: To impersonate the user \(U_{i}\) as a valid user, assume that the adversary eavesdrops on the message \(M_{1}=[SN_{ID},TID_{i},CT_{i}]\), where \(W_{i}=h(PID_{i}^{*}\parallel TID_{i}\parallel N_{i}),CT_{i}=E_{SK_{i}}[HGW_{ID },SN_{ID},W_{i},N_{i},TS_{1}]\), and \(PID_{i}^{*}=h(U_{ID}\parallel R^{*})\). Assume the attacker attempts to construct another valid log-in request message, compelling the adversary to authenticate to the HGWN. To accomplish this, the adversary must know \(PID_{i}^{*}\), which is impossible without the secret \(R^{*}\). Assume the adversary gets the \(N_{i}\), and \(TS_{1}\), but cannot generate \(CT_{i}=E_{SK_{i}}[HGW_{ID},SN_{ID},W_{i},N_{i},TS_{1}]\) because he/she does not have access to the shared User/HGWN Secret Key \(SK_{i}\). As a result, a user impersonation attack can be used against the proposed scheme. * Denial of service attack: Assume the attacker has the lost/stolen smart card of the user \(U_{i}\); he/she cannot have the user information username \(U_{ID}\), password \(U_{PW}\) and imprints of their biometric \(U_{BIO}\). Furthermore, the smart card compute \(\sigma_{i}^{*}=Rep(U_{BIO},\tau)\) using the error tolerance thresholds value \(\tau,R^{*}=T_{i}\oplus h(U_{ID}\parallel\sigma_{i}^{*})\), \(PID_{i}^{*}=h(U_{ID}\parallel R^{*})\), \(PWR_{i}^{*}=h(U_{PW}\parallel R^{*})\), and \(R_{i}^{*}=h(PID_{i}^{*}\parallel PWR_{i}^{*}\parallel\sigma_{i}^{*})\). After that, the smart card checks the validity of \(R_{i}^{*}\
eq R_{i}\). Therefore, without having valid user information, the validation will fail. Similarly, the adversary cannot update the smart card's stored secret credentials without access to user information. As a result, the proposed scheme protects against denial of service attacks. * Session Key attack: The shared session key is established during the authentication step by the user Ui and the sensor node \(SK_{U\to SN}=h(HGW_{ID}\parallel SN_{ID}\parallel PID_{i}\parallel N_{j})\), which includes \(PID_{i}=h(U_{ID}\parallel R)\), and random nonce \(N_{j}\). In both cases, these parameters are protected using a one-way hash function, which means that an attacker cannot obtain the session key without knowing the secret parameters of the session key. Therefore, the session key attack is resisted in the proposed scheme. * Offline guessing attack: Assume that the user password \(U_{PW}\) is guessed by the adversary, he/she will not be able to generate a valid authentication request \(CT_{j}=E_{SK_{j}}[HGW_{ID},SN_{ID},PID_{i},N_{i}^{*},N_{j},P_{i},TS_{2}]\), where \(P_{i}=h(PID_{i}\parallel N_{j}\parallel N_{i}^{*}\parallel TS_{2})\). Because the adversary does not have the \(PID_{i}\), and \(N_{j}\) and cannot forge the user biometric \(U_{BIO}\). Even if the adversary generates \(N_{j}\), they still will not be able to compute \(CT_{j}\), because he/she does not know the secret key \(SK_{j}\). Therefore, the proposed scheme is resilient against offline guessing attacks.