## 3 The Proposed Protocol
### Authentication and Key Agreement Phase  
In the authentication and key agreement phase, three entities (i.e., user, GWN, and BASN) first verify the identity of the communicating party when communicating with each other. At the same time, \(U_{i}\) and \(MS_{j}\) can negotiate a consistent session key. This phase includes ten steps from V1 to V10:  
V1: Upon \(GWN\)'s receipt of the requested information by user \(U_{i}\), it first extracts the current timestamp \(T_{c}\) and checks whether the time gap between \(T_{c}\) and \(T_{1}\) is less than time threshold \(\Delta T\). If not, \(GWN\) directly discards the request information; if so, \(GWN\) decrypts \(F_{U_{i}}(t)\) and obtains \(\left[f_{U_{i}}^{u_{i}}(t),AT_{author}^{U_{i}*},EID_{i}^{*}\right]\). Then, \(GWN\) verifies whether \(U_{i}\) is authorized to obtain authentication with \(MS_{j}\), for which its identity is \(MIS_{j}\). \(GWN\) calculates \(f_{U_{i}}^{*}\left(h(PID_{i}\oplus MIS_{j})\right)\) and \(h(PID_{i}\oplus x)\) and checks whether the two values are equal. If so, \(GWN\) further judges whether \(EID_{i}^{*}\) belongs to case (a), case (b), or case (c):  
Figure 3: Registration of the user and BASN. \(EID_{i}^{*}\cdot h(y\parallel PID_{i})=h(PID_{i}\parallel y)\); \(\left|T_{c}-EID_{i}^{*}\cdot h(y\parallel PID_{i})\right|>\Delta T_{auth}^{U_{i }^{*}}\); \(\left|T_{c}-EID_{i}^{*}\cdot h(y\parallel PID_{i})\right|\leq\Delta T_{auth}^{U_{ i}^{*}}\). If it belongs to case (a), this means that \(U_{i}\) does not have authentication authority with respect to \(MS_{j}\); if it belongs to case (b), this means that the authentication authority of \(U_{i}\) exceeds the time threshold for \(U_{i}\) to be authorized; if it belongs to case (c), this means that the body area sensor node \(MS_{j}\) that \(U_{i}\) wants to access can be authorized for authentication within a valid period of time. \(GWN\) further computes \(V_{i}^{*}=h(PID_{i}\parallel x)\), \(h(r_{u}^{*}\parallel T_{1})\parallel e_{i}^{*}\parallel S_{M}^{U_{i}}=B_{1} \oplus h\left(V_{i}^{*}\right)\), and \(B_{2}^{*}=h\left(PID_{i}\parallel MS_{j}^{*}\parallel h\left(r_{u}^{*} \parallel T_{1}\right)\parallel e_{i}^{*}\parallel S_{M}^{U_{i}}\right)\). Finally, \(GWN\) compares \(B_{2}^{*}\) and \(B_{2}\). If they are equal, i.e., \(h(r_{u}^{*}\parallel T_{1})=h(r_{u}\parallel T_{1})\) and \(e_{i}^{*}=e_{i},S_{M}^{U_{i}}=S_{M}^{U_{i}}\), this means that \(U_{i}\) can be validated, and the operation proceeds to step V2; otherwise, \(GWN\) terminates this session. V2: \(GWN\) selects random number \(r_{g}\in[1,n-1]\), extracts the current timestamp \(T_{2}\), and computes the following: \(x_{j}=h\left(MIS_{j}\parallel x\right)\), \(B_{3}=h\left(x_{j}\parallel MIS_{j}\right)\oplus\left(r_{g}\parallel h(r_{u} \parallel T_{1})\right)\), \(B_{4}=\left(e_{i}\parallel h\left(V_{i}\parallel EID_{i})\right)\oplus h\left( x_{j}\parallel r_{g}\right)\), and \(B_{5}=h\left(h(r_{u}\parallel T_{1})\parallel r_{g}\parallel x_{j}\parallel h (V_{i}\parallel EID_{i})\parallel T_{2}\right)\). V3: \(GWN\to MS_{j}:\)\(\left\{B_{3},B_{4},B_{5},T_{2}\right\}\). \(GWN\) sends \(\left\{B_{3},B_{4},B_{5},T_{2}\right\}\) to the body area sensor node \(MS_{j}\). V4: \(MS_{j}\) firstly extracts timestamp \(T_{c}\) and checks whether the time gap between \(T_{c}\) and \(T_{2}\) is less than time threshold \(\Delta T\). If so, \(MS_{j}\) recovers \(r_{g}^{*},h(r_{u}^{*}\parallel T_{1}),e_{i}^{*},h\left(V_{i}^{*}\parallel EID_{ i}^{*}\right):r_{g}^{*}\parallel h(r_{u}^{*}\parallel T_{1})=B_{3}\oplus h \left(x_{j}\parallel MIS_{j}\right)\), and \(e_{i}^{*}\parallel h\left(V_{i}^{*}\parallel EID_{i}^{*}\right)=B_{4}\oplus h \left(x_{j}\parallel r_{g}^{*}\right)\). At the same time, \(MS_{j}\) computes \(B_{5}^{*}=h\left(h\left(r_{u}^{*}\parallel T_{1}\right)\parallel r_{g}^{*} \parallel x_{j}\parallel h\left(V_{i}^{*}\parallel EID_{i}^{*}\right)\parallel T _{2}\right)\) and compares the value of \(B_{5}^{*}\) and \(B_{5}\).