# Secure and Efficient Authentication Scheme in IoT Environments
## 4 Cryptoanalysis of the Proposed Protocol
### Informal Security Analysis
* DoS attacks: To prevent the proposed scheme from DoS attacks, the server (\(TS\)) terminates the login session if the number of incorrect attempts to enter \(CID_{i}\) reaches the maximum limit. However, the login request will be continued as soon as the correct \(CID_{i}\) is entered. Furthermore, in the login phase, assume the adversary replaces message \(<CID_{i},X_{i},Y_{i}>\) with \(<CID_{i}^{\prime},X_{j}^{\prime},Y_{j}^{\prime}>\) by randomly selecting the elliptical curve point \(x_{i1}^{\prime}\) and sending it back to \(TS\); however, \(TS\) computes and compares the previous value with the received \(Y_{i}^{\prime}\) (i.e., \(h(X_{i}.CK)=?Y_{i}\). If \(TS\) finds a difference between the values, it terminates the protocol with a failure message to the user. Therefore, the proposed scheme is secure for DoS attacks. The resource optimization of the IoT cloud system can be influenced by the success of a major attack (i.e., DoS and replay attacks). The proposed scheme is, however, protected against both attacks. Therefore, the proposed scheme ensures the security of the performance of the proposed scheme. * Many logged-in users attacks: Suppose an adversary somehow manages to get a legally embedded device's credentials \(<CID_{i}^{\prime},CK^{\prime}>\), along with the secret identity \(I_{i}\). Subsequently, the adversary tries to communicate with the server by impersonating \(ED_{i}\). However, in the proposed scheme, out of all-knowing the valid credential, only one legal \(ED_{i}\) can communicate with \(TS\) at a time as, every time they communicate, \(TS\) sets a working bit \(W_{bit-i}\) equal to one for the corresponding communication with \(ED_{i}\) after successful authentication and stores the working bit in its database. Every time, before communication, the receiver \(TS\) will check \(W_{bit-i}\) before establishing a connection with the requested \(ED_{i}\). Furthermore, the receiver \(TS\) can deny all requests if \(W_{bit-i}=1\), representing the existing \(ED_{i}\) is still communicating with it. * Server impersonation attacks: Assume the scenario where the phase of authentication of \(ED_{i}\) is impersonated by an adversarial server. An adversarial server impersonates and receives the parameters \(<CID_{i}\), \(Xi\), \(Yi>\) from \(ED_{i}\). Then, the adversary server randomly chooses parameters \(<X_{j}^{\prime},Y_{j}^{\prime},\ T^{\prime}>\) and sends it back to the \(ED_{i}\). After receiving parameters \(<X_{j}^{\prime},Y_{j}^{\prime},\ T^{\prime}>\), the \(ED_{i}\) computes the factor and checks \(h(X_{j}^{\prime}.A)=?Y_{j}^{\prime}\). However, the equivalence comes out wrong. This is because an attacker randomly computes challenge \(T\) as \(T^{\prime}\) and is completely unaware of challenging \(A\). In addition, attackers are unable to compute a session key. This is due to the attacker being unable to extract a private server key (\(s\)) or a device password (\(psw_{i}\)) from the past session key due to security protection by ECDLP and CDHP. Furthermore, the security of \(s\) is protected in the server (\(E_{ks}=s.ID_{TS}.G\)) by ECDLP and CDHP. Therefore, the proposed scheme is secure against server impersonation attacks. * Forward secrecy attacks (or key freshness): Even if the private key of both the \(ED_{i}\) and the server is compromised by some other means, the confidentiality of the recently established session keys ought not to be affected. Suppose an adversary somehow discovers \(ED_{i}\)'s password \((Psw_{i})\) and \(TS\)'s secret key (\(s\)); thus, the adversary determines other components from the message. However, the adversary cannot derive the session key (\(S_{K}=x_{i1}.X_{j}.\Psw_{i}.P_{ks}=x_{j1}.X_{i}.S.P_{ks}\)). This is because, in order to compute it, the adversary must determine \(x_{i1}\) and \(x_{j1}\) from \(X_{i}\) and \(X_{j}\), which seems to be computationally infeasible because of the complexity of ECDLP.