# PUF and Chaotic Map-Based Authentication Protocol for Underwater Acoustic Networks
## 5 Informal Security Analysis
### Sensor Node and Gateway Capture Attacks  
In the proposed scheme, all sensor nodes, \(Sn_{j}\), and gateways, \(GWN_{k}\), are deployed with PUF to protect the stored secret information, so our scheme can resist sensor node and gateway capture attacks. **6. Performance Comparison**  
This section will analyze and compare the proposed scheme with other related schemes [5; 7; 8; 13; 28; 29; 30] in terms of security and computation costs, which are presented in Tables 3 and 4. The client program is written based on JAVA and deployed on a mobile phone, with the environment (Version: Android 13, Hardware: MediaTek Dimensity 8100, 8 GB of RAM, Mali-G610 MC6 GPU), and the cryptographic operations are based on JAC library. The server program is written based on Python and deployed on the Ubuntu virtual machine (Version: 22.04.3 LTS, Hardware: 64-bit AMD 860K CPU @ 3.7 GHz 8 GB RAM), and the cryptographic operations are based on the gmpy2 library and pycrypto library. The sensor program is written based on Python and deployed on the Raspberry Pi 4B (Broadcom BCM2711, 1.5 GHz, 64-bit, ARM Cortex-A72, RAM: 2 GB LPDDR4-3200 RAM). According to the requirements of the protocol, the interaction at the registration stage is based on a secure channel, so we used the WebSocket library to construct the secure channel. WebSocket is a protocol that enables full-duplex communication over a single TCP connection and supports TLS. The interaction at the authentication stage is based on an open channel and is implemented using sendto in the WebSocket library. Sendto directly sends data based on UDP, which has higher efficiency compared to TCP. All the above devices were tested under the WIFI 1000 Mbps environment. We tested the transmission and reception delay during the registration and authentication, respectively. Here, we took the average value in the relevant schemes. Taking 512-bit \begin{table}
\begin{tabular}{c c c c c c c c} \hline  & [5] & [7] & [8] & [13] & [28] & [29] & [30] & **Our Scheme** \\ \hline Anonymity & T & T & F & T & T & T & F & T \\ Non-traceability & T & T & T & T & T & T & T & T \\ Mutual authentication & T & T & T & T & F & F & T & T \\ Resist malicious insider attack & T & T & T & T & F & T & T & T \\ Resist offline password guessing attack & T & T & T & T & F & T & T & T \\ Resist stolen smart card attack & T & T & F & F & T & T & T & T \\ Resist replay attack & T & T & F & F & T & T & T & T \\ Resist impersonation attack & F & F & F & F & F & T & T & T \\ Perfect forward secrecy & F & F & F & T & T & F & T & T \\ Known session key secrecy & T & T & T & T & T & F & T & T \\ Resist sensor node capture attack & F & F & F & T & F & F & F & T \\ \hline \end{tabular}
\end{table} 
Table 4: Comparison of security features. \begin{table}
\begin{tabular}{c c c c c c} \hline  & **User (A)** & **Gateway Node/Server** & **Sensor Node/User (B)** & **Total** & **Execution Cost** \\ \hline
[5] & \(7T_{h}+2T_{s}\) & \(4T_{h}\) & \(10T_{h}+2T_{s}\) & \(21T_{h}+4T_{s}\) & 3.668 ms \\
[7] & \(11T_{h}+1T_{s}+1T_{f}\) & \(11T_{h}\) & \(7T_{h}\) & \(29T_{h}+1T_{s}+1T_{f}\) & 10.57 ms \\
[8] & \(9T_{h}+2T_{c}+1T_{f}\) & \(10T_{h}+1T_{c}\) & \(5T_{h}\) & \(24T_{h}+3T_{c}+1T_{f}\) & 33.784 ms \\
[13] & \(4T_{h}+4T_{c}+2T_{s}\) & \(4T_{h}+4T_{c}+4T_{s}\) & \(4T_{h}+3T_{c}+2T_{s}\) & \(12T_{h}+11T_{c}+8T_{s}\) & 39.22 ms \\
[28] & \(11T_{h}+3T_{c}+1T_{s}\) & \(11T_{h}+3T_{c}+2T_{s}\) & \(5T_{h}+3T_{c}+1T_{s}\) & \(27T_{h}+9T_{c}+4T_{s}\) & 31.832 ms \\
[29] & \(5T_{h}\) & \(5T_{h}+T_{m}\) & \(3T_{h}+T_{m}\) & \(13T_{h}+2T_{m}\) & 33.036 ms \\
[30] & - & \(1T_{h}+3T_{c}+2T_{s}\) & \(1T_{h}+2T_{c}+T_{s}\) & \(2T_{h}+5T_{c}+3T_{s}\) & 42.006 ms \\ Our scheme & \(6T_{h}+3T_{c}+2T_{s}\) & \(5T_{h}+1T_{c}+3T_{s}\) & \(3T_{h}+2T_{c}+1T_{s}\) & \(14T_{h}+6T_{c}+6T_{s}\) & 22.816 ms \\ \hline \end{tabular}
\end{table} 
Table 3: Comparison of computation costs.