# A Novel Mobile Communications Authentication Scheme with Roaming Service and User Anonymity
## 3 Proposed Scheme
### Registration Phase  
Figure 1 shows the registration phase of the proposed scheme. The detailed steps as follows.  
**R1.** MU\(\rightarrow\)HA: m\({}_{\text{R1}}\)(ID\({}_{\text{MU}}\), H\({}_{2}\)(PW\({}_{\text{MU}}\oplus\)r\({}_{\text{n}}\)))  
The MU chooses ID\({}_{\text{MU}}\), PW\({}_{\text{MU}}\), and a random number r\({}_{\text{n}}\) and calculates H\({}_{2}\)(PW\({}_{\text{MU}}\oplus\)r\({}_{\text{n}}\)). Then, the MU sends the message (ID\({}_{\text{MU}}\), H\({}_{2}\)(PW\({}_{\text{MU}}\oplus\)r\({}_{\text{n}}\))) to the HA.  
**R2.** HA\(\rightarrow\)MU: m\({}_{\text{R2}}\)(ID\({}_{\text{HA}}\), E\({}_{\text{P}}\), E, n, P, P\({}_{\text{HA}}\), z\({}_{\text{i}}\), H(.), W\({}_{\text{i}}\))  
When the message H\({}_{2}\)(PW\({}_{\text{MU}}\oplus\)r\({}_{\text{n}}\)) is received from the MU, the HA calculates z\({}_{\text{i}}\) = H\({}_{2}\)(PW\({}_{\text{MU}}\oplus\)r\({}_{\text{n}}\)) \(\oplus\)H\({}_{1}\)(ID\({}_{\text{MU}}\) \(\mid\) N \(\mid\) W\({}_{\text{i}}\))\(\oplus\)H\({}_{3}\)(W\({}_{\text{i}}\)). Then, the HA chooses a random number w, calculates W\({}_{\text{i}}\) = wP, and transmits (ID\({}_{\text{HA}}\), E\({}_{\text{P}}\), E, n, P, P\({}_{\text{HA}}\), z\({}_{\text{i}}\), W\({}_{\text{i}}\), H(.)) to the MU.  
**R3.** MU: ID\({}_{\text{HA}}\), E\({}_{\text{P}}\), E, n, P, P\({}_{\text{HA}}\), z\({}_{\text{i}}\), W\({}_{\text{i}}\), H(.)  
The MU enters W\({}_{\text{i}}\) into his/her smart card, and the MU's smart card contains ID\({}_{\text{HA}}\), E\({}_{\text{P}}\), E, n, P, P\({}_{\text{HA}}\), z\({}_{\text{i}}\), W\({}_{\text{i}}\), and H(.)  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Step** & **Phase** & **Descriptions** \\ \hline \multirow{3}{*}{V1} & \multirow{3}{*}{Authentication phase} & Because ID\({}_{\text{HA}}\) is transmitted in plaintext, the attacker can intercept messages and determine the relationship among the MU, FA, and HA. Then, the attacker can use a replay attack and target a specific object, namely the HA, by a distributed denial-of-service attack. \\ \hline \multirow{3}{*}{L2} & \multirow{3}{*}{Roaming phase} & [PERSON]’s scheme does not clearly explain how to obtain corresponding session keys and the relationship between different users. So FA is impossible for a user to calculate the specific session key, and decrypt m\({}_{\text{i}}\). Therefore, this scheme lacks integrity. \\ \cline{1-2}  & & \\ \cline{1-2}  & & \\ \end{tabular}
\end{table}
Table 2: Weaknesses of [PERSON]’s scheme.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Notations** & **Descriptions** \\ \hline P\({}_{\text{FA}}\) = b & A public key of the FA based on ECC \\ G\({}_{\text{1}}\) & **Additive group** on ECC \\ G\({}_{\text{2}}\) & **Multiplicative group** on ECC \\ H\({}_{\text{1}}\) & H\({}_{\text{1}}\) = [0,1]\({}^{\text{*}}\)\(\rightarrow\)Z’ q \\ H\({}_{\text{2}}\) & H\({}_{\text{2}}\) = [0,1]\({}^{\text{n}}\)\(\rightarrow\)Z\({}^{\text{n}}\)q \\ H\({}_{\text{3}}\) & H\({}_{\text{3}}\) = G\({}_{\text{1}}\)\(\rightarrow\)[0,1]\({}^{\text{*}}\) \\ \hline \hline \end{tabular}
\end{table}
Table 3: Additional notations.