## 3 The Proposed Protocol
### Authentication and Key Agreement Phase
If the two values are equal, \(GWN^{\prime}\)s identity is verified, and \(MS_{j}\) proceeds to step V5; otherwise, \(MS_{j}\) terminates this session. V5: \(MS_{j}\) selects random number \(r_{s}\in[1,n-1]\), extracts timestamp \(T_{3}\), and computes \(r_{s}^{\prime}=(r_{s})^{e_{i}}\) via the RSA algorithm: \(SK=h\left(h(r_{u}\parallel T_{1})\parallel r_{s}\parallel h(V_{i}\parallel EID _{i})\right)\), \(B_{6}=MIS_{j}\oplus h\left(r_{g}\right),B_{7}=r_{s}^{\prime}\parallel h\left( SK\parallel r_{g}\right)\oplus x_{j},B_{8}=h\left(r_{s}^{\prime}\parallel h\left( SK\parallel r_{g}\right)\parallel x_{j}\right)\parallel T_{3}\), and \(B_{9}=h\left(SK\parallel r_{g}\right)\oplus x_{j}\oplus h\left(r_{s}^{\prime} \parallel SK\right)\), where \(B_{6},B_{7},B_{8},\) and \(B_{9}\) represent the intermediate parameters, and \(SK\) represents the session key of \(MS_{j}\) and \(U_{i}\). V6: \(MS_{j}\to GWN:\)\(\left\{B_{6},B_{7},B_{8},B_{9},T_{3}\right\}\). \(MS_{j}\) sends information \(B_{6},B_{7},B_{8},B_{9},\) and \(T_{3}\) to \(GWN\). V7: \(GWN\) firstly checks the validity of the timestamp. Next, \(GWN\) uses the secret value \(r_{g}\) to compute \({x_{s}^{*},r_{s}^{{}^{\prime}}}\): \(MIS_{j}^{*}=B_{6}\oplus h\left(r_{g}\right),x_{j}^{*}=h\left(MIS_{j}^{*} \parallel x\right)\), \(r_{s}^{{}^{\prime}*}\parallel h\left(SK^{*}\parallel r_{g}^{*}\right)=B_{7} \oplus x_{j}^{*}\), and \(B_{8}^{*}=h\left(r_{s}^{{}^{\prime}*}\parallel h\left(SK^{*}\parallel r_{g}^{*} \right)\parallel x_{j}^{*}\right)\parallel T_{3}\)). Then, \(GWN\) checks the consistency of \(B_{8}^{*}\) and \(B_{8}\). If the two values are equal, \(GWN\) executes step V8; otherwise, it terminates this communication. V8: \(GWN\) computes \(h\left(r_{s}^{\prime}\parallel SK\right)=B_{9}\oplus h\left(SK\parallel r_{g} \right)\oplus x_{j}\) and updates the parameters as follows:  
\(GWN\) updates the new pseudo-random identity \(PID_{i}^{new}\) for \(U_{i}\);  
\(GWN\) updates \(V_{i}^{new}=h\left(PID_{i}^{new}\parallel x\right)\);  
\(GWN\) updates the authorization verification value \(EID_{i}^{new}\), the authorized authentication time threshold \(\Delta T_{auth}^{U_{i}^{new}}\), and the authorized authentication body area sensor node identity set \(S_{M}^{U_{i}^{new}}\). Specifically, if the authentication authority of \(U_{i}\) needs to be revoked, then \(GWN\) computes \(EID_{i}^{new}=h\left(PID_{i}^{new}\parallel y\right)\cdot\left(h\left(y \parallel PID_{i}^{new}\right)\right)^{-1}\) and sets \(\Delta T_{auth}^{U_{i}^{new}}=\text{null},f_{U_{i}^{i}}^{new}(t)=\text{null},\) and \(S_{M}^{U_{i}^{new}}=\text{null}\); otherwise, \(GWN\) computes \(EID_{i}^{new}=\left(h\left(y\parallel PID_{i}^{new}\right)\right)^{-1}\).\(T_{c}\), updates \(\Delta T_{auth}^{U_{i}^{new}}\), and further updates the authorized authentication identity set \(S_{M}^{U_{i}^{new}}\) according to situations (d), (e), (f), and (g):  
(d) If there is no change in the identity set of the body area sensor node, then * If there is a newly added identity set \(S_{M}^{add}\) with respect to the body area sensor node, then \(S_{M}^{U_{i},new}=S_{M}^{U_{i}}+S_{M}^{add}\). * If identity set \(S_{M}^{del}\) is removed from the body area sensor node, then \(S_{M}^{U_{i},new}=S_{M}^{U_{i}}-S_{M}^{del}\). * If cases (e) and (f) occur simultaneously, then \(S_{M}^{U_{i},new}=S_{M}^{U_{i}}-S_{M}^{del}+S_{M}^{add}\). * \(GWN\) updates the value of \(f_{U_{i}}^{new}(t)\), where \(f_{U_{i}}^{new}(t)=h\big{(}PID_{i}^{new}\oplus x\big{)}+\prod\limits_{MIS_{j} \in S_{M}^{U_{i},new}}\big{(}t-h\big{(}PID_{i}\oplus MIS_{j}\big{)}\big{)}\). * \(GWN\) updates \(F_{U_{i}}^{new}(t)=Enc_{h(x\oplus y)}\Big{[}f_{U_{i}}^{new}(t),\Delta T_{auth}^{ U_{i}\;new},EID_{i}^{new}\Big{]}\).