## 3 The Proposed Protocol
### Registration Phase
#### 3.2.2 Registration Phase for User U\({}_{\rm i}\)  
The registration of user \(U_{i}\) includes R21\(\rightarrow\)R23:  
R21: \(U_{i}\Longrightarrow GWN:\{A_{0}\}\); user \(U_{i}\) transmits the calculated \(A_{0}\) to \(GWN\) via a secure channel.  
Specifically, \(U_{i}\) inputs the \(ID_{i}\) and \(PW_{i}\) of their own choice to the personal digital assistant (PDA). The PDA selects a random number \(r\in[1,n-1]\), where \(n\) is a system security parameter. Then, PDA calculates the following: hash value \(A_{0}=h(ID_{i}\oplus PW_{i}\parallel r)\) mod \(n_{0}\); \(n_{0}\) is a large prime number.  
R22: \(GWN\Longrightarrow U_{i}:\{\)Registration Package (RP)\(\}\). The \(GWN\) sends a registration package to \(U_{i}\).  
After \(GWN\) receives information \(A_{0}\) from user \(U_{i}\), it first records the registration timestamp \(T_{reg}^{U_{i}}\), selects a pseudo-random identity \(PID_{i}\), and computes \(V_{i}=h(PID_{i}\parallel x)\) and \(A_{1}=V_{i}\oplus A_{0}\). Secondly, \(GWN\) determines the body area sensor node identity set \(S_{M}^{U_{i}}\), which is authorized for the authentication of \(U_{i}\), and binds the authorization check polynomial; the authorized authentication time threshold; and the authorization, authentication, and verification value for user \(U_{i}\), where \(S_{M}^{U_{i}}\) is a subset of \(S_{M}\), the check polynomial is \(f_{U_{i}}(t)=h(PID_{i}\oplus x)+\prod\limits_{MIS_{j}\in S_{M}^{U_{i}}}\left(t -h\left(PID_{i}\oplus MS_{j}\right)\right)\), the time threshold is \(\Delta T_{auth}^{U_{i}}\), and the authentication verification value is \(EID_{i}=T_{reg}^{U_{i}}.\left(h(y\parallel PID_{i})\right)^{-1}\). Furthermore, \(GWN\) uses symmetrical algorithms (e.g., the well-known AES [19]) to generate symmetric ciphertext \(F_{U_{i}}(t)\) and configures the physically unclonable function \(PUF_{sum}(\cdot)\) with embedded trigger \(sum\), where \(F_{U_{i}}(t)=Enc_{(x\oplus y)}\left[f_{U_{i}}(t),\Delta T_{auth}^{U_{i}},EID_{ i}\right]\), and \(sum\) refers to the number of times the user is allowed to try to use \(PUF_{sum}(\cdot)\). Here, we set the maximum value to 3 and the initial value to 0. Finally, \(GWN\) sends the registration package (RP) to \(U_{i}\), where RP stores parameters \(PID_{i}\), \(PUF_{sum}(\cdot),A_{1},S_{M}^{U_{i}}\), and \(F_{U_{i}}(t)\).  
R23: After \(U_{i}\) receives RP, \(U_{i}\) updates \(A_{1}\) and calculates \(A_{2}\) as follows: At first, \(U_{i}\) inputs \(ID_{i}\) and \(PW_{i}\) to PDA, and PDA computes \(V_{i}=A_{0}\oplus A_{1}\) and \(V_{ii}=PUF_{sum}(PW_{i})\). PDA then uses \(FE.GEN(\cdot)\) to compute the following: \((k_{i},k_{ii})=FE.GEN(V_{ii})\), \(A_{2}=h\left(V_{i}\parallel k_{i}\parallel S_{M}^{U_{i}}\right)\) mod \(n_{0}\). After that, PDA updates secret value \(A_{1}=V_{i}\parallel S_{M}^{U_{i}}\parallel k_{ii}\oplus h(ID_{i}\parallel V _{ii})\). Finally, PDA stores a series of values: \(\left\langle PID_{i},A_{1},A_{2},PUF_{sum}(\cdot),F_{U_{i}}(t)\right\rangle\).  
During registration, the gateway node no longer issues smart cards to users, thereby avoiding offline password-guessing attacks, which result from smart card loss attacks. At the same time, the periodicity of modulo calculations makes it impossible for the adversary to guess passwords effectively in order to protect password security. Meanwhile, the gateway needs to encrypt these fine-grained authentication parameters to prevent users from tampering with them. Additionally, to ease the understanding of readers, Figure 3 summarizes the registration operation of the user and BASN.