## 5 The Proposed Protocol
### Login and Authentication Phase  
This phase is conducted via an unreliable channel, where \(P_{i}\) and \(P_{j}\) log in and mutually authenticate with \(S_{m}\) and \(S_{n}\), respectively. \(P_{i}\) and \(P_{j}\) also authenticate with each other and  
Figure 2: Registration procedure of the proposed protocol.  
compute a shared session key through the assistance of \(S_{m}\) and \(S_{n}\). Figure 3 shows the whole procedure in this phase.  
Step A1: \(P_{i}\) inserts \(SC_{i}\), enters \(ID_{i}^{*},PW_{i}^{*},B_{i}^{*}\) and computes \(\sigma_{i}=\varepsilon_{i}\oplus h\big{(}ID_{i}^{*}\big{|}\big{|}PW_{i}^{*} \big{|}\big{|}h_{bio}\big{(}B_{i}^{*}\big{)}\big{)}\). The \(SC_{i}\) verifies whether \(V_{i}\overset{\raisebox{-1.0 pt}{\scalebox{1.0}{$=$}}}{=}h\big{(}h\big{(}ID_{i} ^{*}\big{|}\big{|}PW_{i}^{*}\big{|}\big{|}\sigma_{i}\big{)}\big{|}\big{|}h_{bio} \big{(}B_{i}^{*}\big{)}\big{)}\). If there is a match, this allows \(P_{i}\) to select a server \(S_{m}\) from an app interface for logging into a specific service and to select a \(P_{j}\) that \(P_{i}\) wishes to communicate with. Next, \(P_{i}\) generates two random numbers \(a_{i,m}\), \(s_{i,m}\) and a timestamp \(T_{i,m}\) and computes \(R_{i,m}=a_{i,m}\cdot G=(r_{i,m1},\ r_{i,m2})\), \(C_{i,m1}=s_{i,m}\cdot G\), \(Y_{i,m}=(y_{i,m1},\ y_{i,m2})=s_{i,m}\cdot puk_{m}\), \(u_{m,j}=B_{m,j}\oplus A_{i,m}\), \(c_{i,m21}=y_{i,m1}\cdot(u_{m,j}||ID_{i})\oplus T_{i,m}mod\ p\), \(c_{i,m22}=y_{i,m2}\cdot r_{i,m1}mod\ p\), \(c_{i,m23}=y_{i,m2}\cdot r_{i,m2}mod\ p\) and \(C_{i,m2}=(c_{i,m21},\ c_{i,m22},\ c_{i,m23})\). \(P_{i}\) sends a message \(\{C_{i,m1},C_{i,m2},T_{i,m1}\}\) to \(S_{m}\) as a login request.  
Step A2: Upon receiving the login request message, \(S_{m}\) computes \(Z_{m,i}=(z_{m,i1},z_{m,i2})=prk_{m}C_{i,m1}\) and \((u_{m,i}||ID_{i})=T_{i,m}\oplus c_{i,m21}\cdot z_{m,i1}\cdot^{-1}mod\ p\). \(S_{m}\) then checks whether \(u_{m,i}\overset{\raisebox{-1.0 pt}{\scalebox{1.0}{$=$}}}{=}h\big{(}ID_{i} ||prk_{m}\big{)}\) to confirm the authenticity of \(P_{i}\). Next, \(S_{m}\) generates a random number \(b_{m,i}\) and computes \(R_{i,m}=(c_{i,m22}\cdot z_{m,i2}\cdot^{-1}mod\ p,\ c_{i,m23}\cdot z_{m,i2}\cdot ^{-1}mod\ p)\), \(Y_{m,i}=R_{i,m}\cdot b_{m,i}\) and signature \(\delta_{m,i}=Si_{gprk_{m}}(Y_{m,i})\). Thereafter, \(S_{m}\) sends \(\{\delta_{m,i}\), certificate \(Cert_{m}\}\) to \(S_{n}\) and waits for the message \(\{\delta_{n,j}\), certificate \(Cert_{n}\}\) sent by \(S_{n}\).  
Step A3: Upon receiving the message, \(S_{m}\) verifies \(Cert_{n},\delta_{n,j}\) using the public key of \(S_{n}\). If the verification is successful, \(S_{m}\) computes \(K_{m,i}=b_{m,i}\cdot Y_{n,j}\), \(W_{m,i}=b_{m,i}\cdot G\), \(\beta_{m,i}=h(Y_{m,i}||K_{m,i}||ID_{i}||ID_{S_{m}})\) and ciphertext \(\theta_{m,i}=E_{R_{i,m}}(W_{m,i}||K_{m,i}||B_{m,i})\). Next, \(S_{m}\) sends \(\{\theta_{m,i}\}\) to \(P_{i}\).  
Step A4: Upon receiving the message, \(P_{i}\) obtains \(W_{m,i},K_{m,i},\theta_{m,i}\) by symmetrically decrypting \(\theta_{m,i}\) using the key \(R_{i,m}\). Next, \(P_{i}\) computes \(Y_{i,m}=a_{i,m}\cdot W_{m,i}\) and verifies whether \(\beta_{m,i}\overset{\raisebox{-1.0 pt}{\scalebox{1.0}{$=$}}}{=}h\big{(}Y_{i,m}|| K_{m,i}||D_{i}||ID_{S_{m}}\big{)}\).  
Session key establishment: A similar procedure is carried out by \(P_{j}\) and \(S_{n}\), so that \(P_{j}\) can obtain a legitimate \(K_{n,j}\). Thereafter, \(P_{i}\) and \(P_{j}\) compute a common key \(K_{i,j}=a_{i,m}\cdot K_{m,i}=a_{j,m}\cdot a_{i,m}\cdot b_{m,i}\cdot B_{n,j}\). \(G\). In this way, a shared patient E2E session key \(K_{i,j}\) is established.  
Figure 3: Login and authentication procedure of the proposed protocol.