## 4 Security Analysis of BSNCare+
The final results are as follows:  
\(MG_{j}\) believes _Server_ believes \(\{V_{2}\}\) (From (5))  
\(MG_{j}\) believes \(\{V_{2}\}\) (From (7))  
\(BS_{i}\) believes _Server_ believes \(\{Tr,\,\,V_{3}\}\) (From (12))  
\(BS_{i}\) believes \(\{Tr,\,\,V_{3}\}\) (From (14))  
With the four results (5), (7), (12) and (14), and the assumption of the trustworthiness of _Server_, both \(BS_{i}\) and the \(MG_{j}\) can be authenticated by each other via _Server_. \(\bullet\) Claim 2: The anonymity and un-traceability of \(BS_{i}\) can be guaranteed. In the normal communication processes of the BSNCare+, we adopt three random numbers \(N_{i}\), \(N_{j}\) and \(N_{s2}\) to randomize the transmitted messages, such as \(AID_{i}\), \(M_{1}\), \(M_{2}\), \(V_{1}\), \(Tr\), \(V_{2}\) and \(V_{3}\), where some of them are involved with \(BS_{i}\). They are \(AID_{i}\), \(M_{1}\), \(N_{i}\), \(TR_{seq}\), \(Tr\) and \(V_{3}\). First, in the BSNCare+, \(TR_{seq}\) is specifically utilized to be the one-time-use token for fast identification of \(BS_{i}\) because this value, i.e., \(TR_{seq}\) contains no information revelant to \(BS_{i}\) and will be updated after each successful authentication session. The value \(TR_{seq}\) does not reveal any information about \(BS_{i}\). Second, an anonymous identity \(AID_{i}\) (or sometimes, a one-time use and meaningless value \(sid_{h}\) will be used) to be exchanged between \(BS_{i}\) and the _Server_, and will be examined by the _Server_. No one can trace and identify \(BS_{i}\) except the _Server_. Third, from the expression of equations of \(M_{1}=H(K_{is}\oplus N_{i})\oplus GPS_{i}\), \(Tr=H(K_{is}\mid\mid N_{s2})\oplus Tr_{seq_{new}}\) and \(V_{3}=H(Tr\mid\mid K_{is})\), it is obvious that these three values are randomized by the two random numbers \(N_{i}\) and \(N_{s2}\), which cannot be re-used from session to session. Based on the above arguments, we claim that the anonymity and un-traceability for \(BS_{i}\) can be guaranteed. \(\bullet\) Claim 3: Secure channels among \(BS_{i}\), the \(MG_{j}\) and the _Server_ are successfully established and data confidentiality can be achieved. As mentioned before, a simple authentication and login activity without session key agreement is not enough to guarantee any kind of security. One of the most important security requirements is to securely establish two session keys in which one session key is agreed by \(BS_{i}\) and the _Server_, and the other one is established by the \(MG_{j}\) and the _Server_. In the BSNCare+, two session keys, i.e., \(SK_{is}=H(GPS_{i}\mid\mid K_{is}\mid\mid Tr)\) and \(SK_{js}=H(K_{js}\mid\mid\)\(1D_{j}\mid\mid N_{s2}\mid\mid N_{j})\), will eventually be generated and exploited to protect the data transmissions among \(BS_{i}\), the \(MG_{j}\) and the _Server_. In that case, we claim that the secure channels among \(BS_{i}\), the \(MG_{j}\) and the _Server_ are provided by the BSNCare+. In addition, during each normal session of the BSNCare+, all the transmitted messages are either well-protected via the robust one-way hash function, i.e., SHA-3 (512 bits) or meaningless random sequences, which do not reveal any useful information regarding the communication entities or the BSNCare+ itself. Furthermore, two high-entropy secrets, i.e., \(K_{is}\) and \(K_{js}\), are chosen by the _Server_ for the purpose of protecting the communication during the authentication phase of BSNCare+. Without knowing these two secrets, it is theoretically difficult for attackers to break the SHA-3 hash function and retrieve any useful information from transmitted cipher texts owing to the irreversibility of the one-way hash function. Data confidentiality is thus guaranteed. * Claim 4: Resistance against man-in-the-middle attack, location spoofing attack, forgery attack and replay attack is provided. Attackers may intend to deceive the legal communication entities, such as \(BS_{i}\), the \(MG_{j}\) and the _Server_, via fake messages.